chore: Update various github workflows (#100)

* add title to release

* run helm docs in the pr & use github env

* use the centrazlied image build process we use internally

---------

Co-authored-by: jamie zieziula <[email protected]>

.github/workflows/build-and-push-image.yaml

@@ -0,0 +1,58 @@
+---
+name: Build and push image
+
+"on":
+  workflow_call:
+    inputs:
+      environment:
+        description: Determines which docker registry credentials to use
+        required: true
+        type: string
+      image:
+        description: Image name (without the tag & registry)
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  build_push_image:
+    name: Build and push image
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          # These credentials are managed in Terraform. Depending on the 'environment' value above,
+          # these will either be the credentials for 'dev' or 'prod'.
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Docker image metadata
+        id: metadata
+        uses: docker/metadata-action@v5
+        with:
+          images: prefecthq/${{ inputs.image }}
+          tags: |
+            type=ref,event=pr
+            type=ref,event=branch
+            type=semver,pattern={{version}}
+          labels: |
+            org.opencontainers.image.title=prefect-operator
+            org.opencontainers.image.description=Prefect Operator image
+            org.opencontainers.image.vendor=Prefect
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}

.github/workflows/helm-release.yaml

@@ -95,6 +95,7 @@ jobs:
       - name: Create Github Release + Tag
         run: |
           gh release create $RELEASE_VERSION \
+            --title $RELEASE_VERSION \
             --latest=false \
             --notes "Packaged with prefect-operator version \
             [v$IMAGE_VERSION](https://github.com/PrefectHQ/prefect-operator/releases/tag/v$IMAGE_VERSION)"

.github/workflows/images-main.yaml

@@ -0,0 +1,28 @@
+---
+name: Build and push images for merges to main
+
+"on":
+  push:
+    branches:
+      - main
+    paths:
+      - api/**
+      - cmd/**
+      - internal/**
+      - Dockerfile
+
+permissions: {}
+
+jobs:
+  run_unit_tests:
+    uses: ./.github/workflows/tests.yaml
+    permissions:
+      # required by downstream jobs
+      contents: read
+
+  build_and_push_image_for_main:
+    needs: run_unit_tests
+    uses: ./.github/workflows/build-and-push-image.yaml
+    with:
+      environment: dev
+      image: prefect-operator-dev

.github/workflows/images-prs.yaml

@@ -0,0 +1,35 @@
+---
+name: Build and push images for pull requests
+
+"on":
+  pull_request:
+    branches:
+      - main
+    paths:
+      - api/**
+      - cmd/**
+      - internal/**
+      - Dockerfile
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - labeled
+      - unlabeled
+
+permissions: {}
+
+jobs:
+  run_unit_tests:
+    uses: ./.github/workflows/tests.yaml
+    permissions:
+      # required by downstream jobs
+      contents: read
+
+  build_and_push_image_for_prs:
+    needs: run_unit_tests
+    if: contains(github.event.pull_request.labels.*.name, 'build-image')
+    uses: ./.github/workflows/build-and-push-image.yaml
+    with:
+      environment: dev
+      image: prefect-operator-dev

.github/workflows/images-tags.yaml

@@ -0,0 +1,70 @@
+---
+name: Build and push images for tags
+
+"on":
+  push:
+    tags:
+      - '*'
+
+permissions: {}
+
+jobs:
+  run_unit_tests:
+    uses: ./.github/workflows/tests.yaml
+    permissions:
+      # required by downstream jobs
+      contents: read
+
+  build_and_upload_manifests:
+    needs: run_unit_tests
+    permissions:
+      # required to write artifacts to a release
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Install tool dependencies
+        uses: jdx/mise-action@v2
+        with:
+          experimental: true
+
+      - name: Package kubernetes manifests & CRDs
+        run: |
+          # package just CRDs
+          cat deploy/charts/prefect-operator/crds/*.yaml > prefect-crds.yaml
+          make helmbuild
+          # template the helm chart including the CRDs
+          helm template prefect-operator deploy/charts/prefect-operator \
+          --include-crds --set operator.image.tag=${{ github.ref_name }} \
+          > prefect-operator.yaml
+          # Remove labels relevant only for Helm installs
+          yq -i 'del(.metadata.labels."app.kubernetes.io/managed-by")' prefect-operator.yaml
+          yq -i 'del(.metadata.labels."helm.sh/chart")' prefect-operator.yaml
+          yq -i 'del(.spec.template.metadata.labels."app.kubernetes.io/managed-by")' prefect-operator.yaml
+          yq -i 'del(.spec.template.metadata.labels."helm.sh/chart")' prefect-operator.yaml
+          # Ensure all references to app version match the released version tag
+          yq -i '(.. | select(tag == "!!str" and . == "v0.0.0")) |= "${{ github.ref_name }}"' prefect-operator.yaml
+
+      - name: Upload release assets
+        run: gh release upload ${{ github.ref_name }} prefect-crds.yaml prefect-operator.yaml
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+  build_and_push_image_for_tags:
+    needs: run_unit_tests
+    uses: ./.github/workflows/build-and-push-image.yaml
+    with:
+      environment: prod
+      image: prefect-operator
+
+  create_helm_release:
+    needs: build_and_push_image_for_tags
+    uses: ./.github/workflows/helm-release.yaml
+    permissions:
+      # required by downstream jobs
+      contents: write
+    # this is required so that the workflow can read secrets
+    # from the environment
+    secrets: inherit

.github/workflows/update-helm-versions.yaml

@@ -28,24 +28,35 @@ jobs:
 
       - name: Get current date
         id: date
-        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+        run: echo "DATE=$(date +'%Y-%m-%d')" >> $GITHUB_ENV
 
       - name: Create branch for helm version updates
         run: |
-          git checkout -b "helm-version-${{ steps.date.outputs.date }}"
+          git checkout -b "helm-version-$DATE}"
 
       - name: Install updatecli in the runner
         uses: updatecli/updatecli-action@v2
 
       - name: Run updatecli in apply mode
         run: |
           updatecli apply --config .github/updatecli/manifest.yaml
-          git commit -am "helm-version-${{ steps.date.outputs.date }}"
-          git push --set-upstream origin "helm-version-${{ steps.date.outputs.date }}"
+          git commit -am "helm-version-$DATE}"
+          git push --set-upstream origin "helm-version-$DATE}"
+
+      - name: Install `helm-docs`
+        uses: jdx/mise-action@v2
+        with:
+          install_args: helm-docs
+
+      - name: Run helm-docs
+        run: |
+          helm-docs --template-files=README.md.gotmpl
+          git commit -am "update readme"
+          git push
 
       - name: Create pr
         run: |
-          git checkout "helm-version-${{ steps.date.outputs.date }}"
-          gh pr create --base main --title "helm-version-bump-${{ steps.date.outputs.date }}" -b "please run helm-docs locally to update chart readmes" --label dependencies
+          git checkout "helm-version-$DATE}"
+          gh pr create --base main --title "helm-version-bump-$DATE}" --label dependencies
         env:
           GH_TOKEN: ${{ github.token }}