ci: publish artifacts to NGC

.github/workflows/docker-gh.yml

@@ -0,0 +1,130 @@
+name: Docker
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions: {}
+
+env:
+  REGISTRY: ghcr.io
+  # github.repository as <account>/<repo>
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build:
+    runs-on: linux-amd64-cpu16
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Validate manual branch
+        if: github.event_name == 'workflow_dispatch' && github.ref_type == 'branch'
+        env:
+          BRANCH_NAME: ${{ github.ref_name }}
+        run: |
+          if [[ "${BRANCH_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Branch ${BRANCH_NAME} conflicts with the official release tag namespace."
+            echo "::error::Publish official releases by pushing the matching Git tag instead."
+            exit 1
+          fi
+
+      - name: Validate release tag
+        if: github.ref_type == 'tag'
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+
+          if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Release tag must match vX.Y.Z; got ${RELEASE_TAG}"
+            exit 1
+          fi
+
+          version=${RELEASE_TAG#v}
+          chart_version=$(awk '$1 == "version:" {gsub(/"/, "", $2); print $2; exit}' charts/topograph/Chart.yaml)
+          app_version=$(awk '$1 == "appVersion:" {gsub(/"/, "", $2); print $2; exit}' charts/topograph/Chart.yaml)
+
+          if [[ "${chart_version}" != "${version}" ]]; then
+            echo "::error::Chart version ${chart_version} does not match release version ${version}."
+            exit 1
+          fi
+          if [[ "${app_version}" != "${RELEASE_TAG}" ]]; then
+            echo "::error::Chart appVersion ${app_version} does not match release tag ${RELEASE_TAG}."
+            exit 1
+          fi
+
+      # Login against a Docker registry except on PR
+      # https://github.com/docker/login-action
+      - name: Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Normalize image name
+        id: image
+        env:
+          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+        run: echo "name=${IMAGE,,}" >> "$GITHUB_OUTPUT"
+
+      # Extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          flavor: latest=false
+          images: ${{ steps.image.outputs.name }}
+          tags: |
+            type=ref,event=tag
+            type=ref,event=branch
+            type=sha,priority=100,prefix=,suffix=,format=short
+
+      # Set up QEMU for cross-platform builds
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+
+      # Set up Docker Buildx
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        with:
+          buildkitd-config: /etc/buildkit/buildkitd.toml
+
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: ./Dockerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          provenance: mode=max,version=v1
+
+      - name: Generate SLSA provenance
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-name: ${{ steps.image.outputs.name }}
+          subject-digest: ${{ steps.build-and-push.outputs.digest }}
+          push-to-registry: true

.github/workflows/docker.yml

@@ -6,24 +6,21 @@ name: Docker
 # documentation.
 
 on:
-  push:
-    tags:
-      - "v*"
   workflow_dispatch:
 
 permissions: {}
 
 env:
-  REGISTRY: ghcr.io
-  # github.repository as <account>/<repo>
-  IMAGE_NAME: ${{ github.repository }}
+  REGISTRY: nvcr.io
+  # NGC <organization>/<team>/<image>
+  IMAGE_NAME: 1070195845945670/topograph/topograph
 
 jobs:
   build:
     runs-on: linux-amd64-cpu16
+    environment: ngc-publish
     permissions:
       contents: read
-      packages: write
       id-token: write
       attestations: write
       artifact-metadata: write
@@ -34,26 +31,15 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Validate manual branch
-        if: github.event_name == 'workflow_dispatch' && github.ref_type == 'branch'
-        env:
-          BRANCH_NAME: ${{ github.ref_name }}
-        run: |
-          if [[ "${BRANCH_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::Branch ${BRANCH_NAME} conflicts with the official release tag namespace."
-            echo "::error::Publish official releases by pushing the matching Git tag instead."
-            exit 1
-          fi
-
-      - name: Validate release tag
-        if: github.ref_type == 'tag'
+      - name: Validate release version
+        if: github.ref_type == 'tag' || startsWith(github.ref_name, 'v')
         env:
           RELEASE_TAG: ${{ github.ref_name }}
         run: |
           set -euo pipefail
 
           if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::Release tag must match vX.Y.Z; got ${RELEASE_TAG}"
+            echo "::error::Release version must match vX.Y.Z; got ${RELEASE_TAG}"
             exit 1
           fi
 
@@ -76,8 +62,8 @@ jobs:
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          username: $oauthtoken
+          password: ${{ secrets.NGC_API_KEY }}
 
       - name: Normalize image name
         id: image

.github/workflows/helm-release-gh.yaml

@@ -0,0 +1,81 @@
+name: Release Helm Charts
+
+on: workflow_dispatch
+
+concurrency:
+  group: helm-repository-publication
+  cancel-in-progress: false
+
+permissions: {}
+
+jobs:
+  release:
+    runs-on: linux-amd64-cpu8
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Helm
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+        with:
+          version: v3.14.0
+
+      - name: Package Helm chart
+        run: |
+          mkdir -p packaged
+          helm lint charts/topograph
+          helm package charts/topograph --destination packaged
+
+      - name: Generate SHA-256 checksum
+        run: |
+          set -euo pipefail
+          cd packaged
+          for chart in topograph-*.tgz; do
+            sha256sum "${chart}" > "${chart}.sha256"
+            sha256sum --check "${chart}.sha256"
+          done
+
+      - name: Generate SLSA provenance
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: packaged/topograph-*.tgz
+
+      - name: Fetch existing Helm repo index
+        run: |
+          set -euo pipefail
+          if ! remote_ref=$(git ls-remote --heads origin refs/heads/gh-pages); then
+            echo "::error::Failed to check for the existing gh-pages branch."
+            exit 1
+          fi
+          if [[ -n "${remote_ref}" ]]; then
+            git fetch origin refs/heads/gh-pages:refs/remotes/origin/gh-pages
+            git checkout origin/gh-pages -- index.yaml
+          fi
+
+      - name: Generate Helm repo index
+        # Pass context values through env rather than expanding ${{ }} inside
+        # the script, so the shell never parses them as code.
+        env:
+          REPO_OWNER: ${{ github.repository_owner }}
+          REPO_NAME: ${{ github.event.repository.name }}
+        run: |
+          if [ -f index.yaml ]; then
+            helm repo index packaged --url "https://${REPO_OWNER}.github.io/${REPO_NAME}" --merge index.yaml
+          else
+            helm repo index packaged --url "https://${REPO_OWNER}.github.io/${REPO_NAME}"
+          fi
+
+      - name: Deploy to GitHub Pages
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./packaged
+          publish_branch: gh-pages
+          keep_files: true