improvement(helm): hygiene pass — CI gating, strict values schema, ESO v1 default #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Helm Chart | |
| on: | |
| push: | |
| branches: [main, staging, dev] | |
| paths: | |
| - 'helm/sim/**' | |
| - '.github/workflows/helm.yml' | |
| pull_request: | |
| branches: [main, staging, dev] | |
| paths: | |
| - 'helm/sim/**' | |
| - '.github/workflows/helm.yml' | |
| concurrency: | |
| group: helm-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| chart: | |
| name: Lint, test, and validate chart | |
| runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }} | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v4 | |
| with: | |
| version: v3.16.4 | |
| - name: Helm lint | |
| run: helm lint helm/sim --values helm/sim/ci/default-values.yaml | |
| - name: Helm unit tests | |
| run: | | |
| helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.8.2 | |
| helm unittest helm/sim | |
| - name: Install kubeconform | |
| run: | | |
| curl -sSL -o /tmp/kubeconform.tar.gz \ | |
| https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz | |
| tar -xzf /tmp/kubeconform.tar.gz -C /tmp kubeconform | |
| - name: Render and validate manifests (default configuration) | |
| run: | | |
| helm template sim helm/sim --namespace sim \ | |
| --values helm/sim/ci/default-values.yaml \ | |
| | /tmp/kubeconform -strict -summary \ | |
| -kubernetes-version 1.29.0 \ | |
| -schema-location default \ | |
| -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' | |
| - name: Render and validate manifests (all components enabled) | |
| run: | | |
| helm template sim helm/sim --namespace sim \ | |
| --values helm/sim/ci/full-values.yaml \ | |
| | /tmp/kubeconform -strict -summary \ | |
| -kubernetes-version 1.29.0 \ | |
| -schema-location default \ | |
| -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' | |
| - name: Render every example values file | |
| run: | | |
| set -euo pipefail | |
| for f in helm/sim/examples/values-*.yaml; do | |
| echo "--- $f" | |
| # Examples intentionally omit secrets (their headers document the | |
| # required --set flags), so supply the CI dummies alongside each. | |
| helm template sim helm/sim --namespace sim \ | |
| --values "$f" \ | |
| --values helm/sim/ci/default-values.yaml \ | |
| --set copilot.postgresql.auth.password=ci-dummy-password \ | |
| --set copilot.server.env.AGENT_API_DB_ENCRYPTION_KEY=cicicicicicicicicicicicicicicicicicicicicicicicicicicicicicicici \ | |
| --set copilot.server.env.INTERNAL_API_SECRET=cicicicicicicicicicicicicicicicicicicicicicicicicicicicicicicici \ | |
| --set copilot.server.env.LICENSE_KEY=ci-dummy-license \ | |
| --set copilot.server.env.SIM_BASE_URL=https://ci.example.com \ | |
| --set copilot.server.env.SIM_AGENT_API_KEY=ci-dummy-agent-key \ | |
| --set copilot.server.env.REDIS_URL=redis://ci-redis:6379 \ | |
| --set copilot.server.env.OPENAI_API_KEY_1=ci-dummy-openai-key \ | |
| --set externalDatabase.password=ci-dummy-password > /dev/null | |
| done | |
| version-bump: | |
| name: Chart version bumped | |
| if: github.event_name == 'pull_request' | |
| runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }} | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Require a Chart.yaml version bump when chart content changes | |
| run: | | |
| set -euo pipefail | |
| base="origin/${{ github.base_ref }}" | |
| git fetch origin "${{ github.base_ref }}" --depth=1 | |
| if git diff --name-only "$base"...HEAD | grep -q '^helm/sim/'; then | |
| base_version=$(git show "$base:helm/sim/Chart.yaml" | awk '/^version:/ {print $2}') | |
| head_version=$(awk '/^version:/ {print $2}' helm/sim/Chart.yaml) | |
| echo "base=$base_version head=$head_version" | |
| if [ "$base_version" = "$head_version" ]; then | |
| echo "::error::helm/sim/** changed but Chart.yaml version did not (still $head_version). Bump it per SemVer." | |
| exit 1 | |
| fi | |
| else | |
| echo "No chart changes; skipping." | |
| fi | |
| install: | |
| name: Install on kind and run helm test | |
| needs: chart | |
| runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }} | |
| timeout-minutes: 25 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v4 | |
| with: | |
| version: v3.16.4 | |
| - name: Create kind cluster | |
| uses: helm/kind-action@v1 | |
| with: | |
| version: v0.24.0 | |
| - name: Install chart | |
| run: | | |
| helm install sim helm/sim \ | |
| --namespace sim --create-namespace \ | |
| --values helm/sim/ci/default-values.yaml \ | |
| --values helm/sim/ci/kind-values.yaml \ | |
| --wait --timeout 15m | |
| - name: Diagnostics on failure | |
| if: failure() | |
| run: | | |
| kubectl -n sim get pods -o wide || true | |
| kubectl -n sim get events --sort-by=.lastTimestamp | tail -40 || true | |
| kubectl -n sim describe pods | tail -100 || true | |
| kubectl -n sim logs deploy/sim-app -c migrations --tail=50 || true | |
| kubectl -n sim logs deploy/sim-app --tail=80 || true | |
| - name: Run helm test | |
| run: helm test sim --namespace sim --timeout 5m |