Merge branch 'main' into BRE-896-update-cd-workflows-for-semver

Author: mimartin12

.github/CODEOWNERS

@@ -12,3 +12,9 @@ charts/ @bitwarden/dept-shot
 
 ## BRE team owns these workflows ##
 .github/workflows/release.yml @bitwarden/dept-bre
+
+# Docker-related files
+**/Dockerfile @bitwarden/team-appsec @bitwarden/dept-bre @bitwarden/dept-shot
+**/*.dockerignore @bitwarden/team-appsec @bitwarden/dept-bre @bitwarden/dept-shot
+**/entrypoint.sh @bitwarden/team-appsec @bitwarden/dept-bre @bitwarden/dept-shot
+**/docker-compose.yml @bitwarden/team-appsec @bitwarden/dept-bre @bitwarden/dept-shot

.github/config/sample-bw-secret.yaml

@@ -12,3 +12,10 @@ spec:
   authToken:
     secretName: bw-auth-token
     secretKey: token
+  map:
+    - bwSecretId: e30f88bd-9e9c-42ae-83b7-b155012da672
+      secretKeyName: test__secret__1
+    - bwSecretId: 9f66ccaf-998e-4e5d-9294-b155012db579
+      secretKeyName: test__secret__2
+    - bwSecretId: c2d703cb-9ce0-43b4-a0ab-b155012dc651
+      secretKeyName: test__secret__3

.github/workflows/_build.yml

@@ -12,17 +12,23 @@ permissions:
   id-token: write
   packages: write
 
+env:
+  _CHART_NAME: ${{ inputs.chart_name }}
+
 jobs:
   build:
     name: Build Helm charts
     runs-on: ubuntu-22.04
-    environment: Production
     permissions:
       contents: read
       id-token: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+          fetch-tags: true
 
       - name: Set up Helm
         uses: Azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
@@ -59,6 +65,110 @@ jobs:
       - name: Log out from Azure
         uses: bitwarden/gh-actions/azure-logout@main
 
+      - name: Generate release notes
+        id: release_notes
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Get the last release tag
+          last_tag=$(gh release list --exclude-pre-releases --exclude-drafts --json "tagName" --limit 100 | jq -r --arg prefix "$_CHART_NAME" '.[] | select(.tagName | startswith($prefix)) | .tagName' | head -1)
+
+          if [ -z "$last_tag" ]; then
+            echo "No previous release tag found, generating notes from initial commit"
+            commit_range="$(git rev-list --max-parents=0 HEAD)..HEAD"
+          else
+            echo "Generating release notes since tag: $last_tag"
+            commit_range="${last_tag}..HEAD"
+          fi
+
+          changelog_file="charts/${_CHART_NAME}/CHANGELOG.md"
+          chart_description=$(helm show chart "charts/${_CHART_NAME}" | yq -e '.description')
+          chart_version=$(helm show chart "charts/${_CHART_NAME}" | yq -e '.version')
+
+          # Initialize arrays for tracking
+          declare -A prs_found
+          declare -A contributors
+          declare -A new_contributors
+          whats_changed=""
+
+          # Get all commits for this chart
+          while IFS= read -r commit_hash; do
+            commit_msg=$(git log -1 --pretty=format:"%s" "$commit_hash")
+            commit_author=$(git log -1 --pretty=format:"%an" "$commit_hash")
+            commit_email=$(git log -1 --pretty=format:"%ae" "$commit_hash")
+
+            # Try to extract PR number from commit message (e.g., "message (#123)" or "Merge pull request #123")
+            pr_num=""
+            if [[ $commit_msg =~ \(#([0-9]+)\) ]]; then
+              pr_num="${BASH_REMATCH[1]}"
+            elif [[ $commit_msg =~ Merge\ pull\ request\ #([0-9]+) ]]; then
+              pr_num="${BASH_REMATCH[1]}"
+            elif [[ $commit_msg =~ \#([0-9]+) ]]; then
+              pr_num="${BASH_REMATCH[1]}"
+            fi
+
+            # If we found a PR number and haven't processed it yet
+            if [[ -n "$pr_num" ]] && [[ -z "${prs_found[$pr_num]}" ]]; then
+              prs_found[$pr_num]=1
+
+              # Try to get PR details from GitHub API
+              if pr_data=$(gh pr view "$pr_num" --json title,author,number,url 2>/dev/null); then
+                pr_title=$(echo "$pr_data" | jq -r '.title')
+                pr_author=$(echo "$pr_data" | jq -r '.author.login')
+                pr_url=$(echo "$pr_data" | jq -r '.url')
+
+                # Add to what's changed
+                whats_changed+="- ${pr_title} by [@${pr_author}](https://github.com/${pr_author}) in [#${pr_num}](${pr_url})"$'\n'
+
+                # Track contributor
+                contributors[$pr_author]=1
+
+                # Check if this is a new contributor (first PR)
+                pr_count=$(gh pr list --author "$pr_author" --state merged --limit 100 --json number | jq '. | length')
+                if [[ "$pr_count" -eq 1 ]]; then
+                  new_contributors[$pr_author]="[#${pr_num}](${pr_url})"
+                fi
+              else
+                # Fallback if API call fails - use commit info
+                whats_changed+="- ${commit_msg} (${commit_hash:0:7})"$'\n'
+              fi
+            elif [[ -z "$pr_num" ]]; then
+              # No PR found, add commit directly
+              whats_changed+="- ${commit_msg} (${commit_hash:0:7})"$'\n'
+            fi
+          done < <(git log "$commit_range" --pretty=format:"%H" --reverse -- "charts/${_CHART_NAME}")
+
+          # Build the changelog content
+          {
+            echo "$chart_description"
+            echo ""
+            echo "## What's Changed"
+            if [[ -n "$whats_changed" ]]; then
+              echo "$whats_changed"
+            else
+              echo "No changes found for this chart."
+            fi
+
+            # Add new contributors section if any
+            if [[ ${#new_contributors[@]} -gt 0 ]]; then
+              echo ""
+              echo "## New Contributors"
+              for contributor in "${!new_contributors[@]}"; do
+                pr_link="${new_contributors[$contributor]}"
+                echo "- [@${contributor}](https://github.com/${contributor}) made their first contribution in ${pr_link}"
+              done
+            fi
+
+            # Add full changelog link
+            if [[ -n "$last_tag" ]]; then
+              echo ""
+              echo "**Full Changelog**: https://github.com/${{ github.repository }}/compare/${last_tag}...${_CHART_NAME}-${chart_version}"
+            fi
+          } > "$changelog_file"
+
+          echo "Release notes generated:"
+          cat "$changelog_file"
+
       - name: Package Helm chart
         id: helm_package
         run: |
@@ -67,12 +177,14 @@ jobs:
             --key "DevOps Team" \
             --keyring private.gpg \
             --passphrase-file .passphrase \
-            charts/${{ inputs.chart_name }}
-          PKG_NAME=$(ls *.tgz)
+            "charts/${_CHART_NAME}"
+          PKG_NAME=$(ls ./*.tgz)
           echo "name=$PKG_NAME" >> "$GITHUB_OUTPUT"
 
       - name: Verify Helm chart
-        run: helm verify ${{ steps.helm_package.outputs.name }} --keyring public.gpg
+        env:
+          _HELM_OUTPUT_NAME: ${{ steps.helm_package.outputs.name }}
+        run: helm verify "${_HELM_OUTPUT_NAME}" --keyring public.gpg
 
       - name: Upload Helm chart artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

.github/workflows/_lint_chart.yml

@@ -0,0 +1,42 @@
+name: Lint Chart (Common)
+
+on:
+  workflow_call:
+    inputs:
+      chart_name:
+        description: 'Name of the chart to lint'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+env:
+  _CHART_PATH: charts/${{ inputs.chart_name }}
+
+jobs:
+  lint:
+    name: Lint Helm chart
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Helm
+        uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        with:
+          version: 'v3.19.0'
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2.7.0
+
+      - name: Run chart-testing (lint)
+        env:
+          CT_CHECK_VERSION_INCREMENT: false
+          _DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: ct lint --charts "$_CHART_PATH"

.github/workflows/kubectl-image.yml

@@ -0,0 +1,51 @@
+name: Build and push kubectl image
+
+on:
+  workflow_dispatch:
+    inputs:
+      kubectl_version:
+        description: "kubectl version"
+        required: false
+        default: "1.34"
+      push:
+        description: "Push image to GitHub Container Registry"
+        required: false
+        type: boolean
+        default: true
+
+jobs:
+  build-docker:
+    name: Build and push kubectl Docker image
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    steps:
+      - name: Checkout Bitnami repo
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          repository: bitnami/containers
+          ref: main
+          persist-credentials: false
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      
+      - name: Build and push kubectl image
+        id: build-docker
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        env:
+          _KUBECTL_VERSION: ${{ inputs.kubectl_version }}
+          _INPUT_PUSH: ${{ inputs.push }}
+        with:
+          context: ./bitnami/kubectl/${_KUBECTL_VERSION}/debian-12
+          file: ./bitnami/kubectl/${_KUBECTL_VERSION}/debian-12/Dockerfile
+          push: ${_INPUT_PUSH}
+          tags: |
+            ghcr.io/bitwarden/helm-charts/kubectl:latest
+            ghcr.io/bitwarden/helm-charts/kubectl:${_KUBECTL_VERSION}

.github/workflows/lint-self-host.yml

@@ -0,0 +1,24 @@
+name: Lint self-host
+
+on:
+  pull_request:
+    paths:
+      - "charts/self-host/**"
+      - ".github/workflows/lint-self-host.yml"
+      - ".github/workflows/_lint_chart.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "charts/self-host/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  lint-self-host:
+    name: Lint self-host chart
+    uses: ./.github/workflows/_lint_chart.yml
+    with:
+      chart_name: self-host

.github/workflows/lint-sm-operator.yml

@@ -0,0 +1,24 @@
+name: Lint sm-operator
+
+on:
+  pull_request:
+    paths:
+      - "charts/sm-operator/**"
+      - ".github/workflows/lint-sm-operator.yml"
+      - ".github/workflows/_lint_chart.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "charts/sm-operator/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  lint-sm-operator:
+    name: Lint sm-operator chart
+    uses: ./.github/workflows/_lint_chart.yml
+    with:
+      chart_name: sm-operator

.github/workflows/linter.yml

@@ -28,6 +28,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: main
+          persist-credentials: false
 
       - name: Log in to Azure
         uses: bitwarden/gh-actions/azure-login@main
@@ -83,7 +84,8 @@ jobs:
       - name: Release Helm chart
         if: ${{ github.event.inputs.release_mode != 'Dry Run' }}
         env:
-          CR_GENERATE_RELEASE_NOTES: true
+          CR_GENERATE_RELEASE_NOTES: false
+          CR_RELEASE_NOTES_FILE: CHANGELOG.md # Relative path to use chart specific CHANGELOG.md from respective chart directory
           CR_MAKE_RELEASE_LATEST: true
           CR_SKIP_EXISTING: true
           CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}