OSMO-6648 - Move service auth identity to Kubernetes Secret #873
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| # | |
| # Licensed under the Apache License, Version 2.0 (the "License"); | |
| # you may not use this file except in compliance with the License. | |
| # You may obtain a copy of the License at | |
| # | |
| # http://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, software | |
| # distributed under the License is distributed on an "AS IS" BASIS, | |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| # See the License for the specific language governing permissions and | |
| # limitations under the License. | |
| # | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: Helm Chart Lint | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| branches: [ main, 'feature/**', 'release/**' ] | |
| paths: | |
| - 'deployments/charts/**' | |
| - '.github/workflows/helm-chart-lint.yaml' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| ####################### | |
| # Detect Changes # | |
| ####################### | |
| detect-chart-changes: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| charts: ${{ steps.detect.outputs.charts }} | |
| has_changes: ${{ steps.detect.outputs.has_changes }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Detect changed charts | |
| id: detect | |
| run: | | |
| # Get list of changed files | |
| if [ "${{ github.event_name }}" == "pull_request" ]; then | |
| CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD) | |
| else | |
| CHANGED_FILES=$(git diff --name-only HEAD~1) | |
| fi | |
| # Find unique chart directories that have changes | |
| CHARTS="" | |
| for chart_dir in deployments/charts/*/; do | |
| chart_name=$(basename "$chart_dir") | |
| if echo "$CHANGED_FILES" | grep -q "^deployments/charts/${chart_name}/"; then | |
| if [ -z "$CHARTS" ]; then | |
| CHARTS="\"${chart_name}\"" | |
| else | |
| CHARTS="${CHARTS},\"${chart_name}\"" | |
| fi | |
| fi | |
| done | |
| if [ -z "$CHARTS" ]; then | |
| echo "No chart changes detected" | |
| echo "has_changes=false" >> $GITHUB_OUTPUT | |
| echo "charts=[]" >> $GITHUB_OUTPUT | |
| else | |
| echo "Changed charts: [$CHARTS]" | |
| echo "has_changes=true" >> $GITHUB_OUTPUT | |
| echo "charts=[$CHARTS]" >> $GITHUB_OUTPUT | |
| fi | |
| ####################### | |
| # Helm Lint # | |
| ####################### | |
| helm-lint: | |
| needs: [detect-chart-changes] | |
| if: needs.detect-chart-changes.outputs.has_changes == 'true' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| chart: ${{ fromJson(needs.detect-chart-changes.outputs.charts) }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1 | |
| with: | |
| version: 'v3.14.0' | |
| - name: Build Helm Dependencies | |
| env: | |
| CHART: ${{ matrix.chart }} | |
| run: | | |
| echo "Building dependencies for: $CHART" | |
| if [ "$CHART" = "osmo" ]; then | |
| helm repo add cnpg https://cloudnative-pg.github.io/charts | |
| helm repo add rustfs https://charts.rustfs.com | |
| fi | |
| helm dependency build "deployments/charts/$CHART" | |
| if [ "$CHART" = "osmo" ]; then | |
| bash deployments/charts/osmo/tests/verify_rustfs_chart_archive.sh | |
| fi | |
| # Show what was fetched | |
| if [ -d "deployments/charts/$CHART/charts" ]; then | |
| echo "Dependencies fetched:" | |
| ls -la "deployments/charts/$CHART/charts/" | |
| fi | |
| - name: Helm Lint | |
| env: | |
| CHART: ${{ matrix.chart }} | |
| run: | | |
| echo "Linting chart: $CHART" | |
| if [ "$CHART" = "osmo" ]; then | |
| helm lint deployments/charts/osmo \ | |
| --kube-version 1.30.0 \ | |
| -f deployments/charts/osmo/profiles/split-plane-control.yaml \ | |
| -f deployments/charts/osmo/tests/control-external-values.yaml | |
| helm lint deployments/charts/osmo \ | |
| --kube-version 1.30.0 \ | |
| -f deployments/charts/osmo/profiles/split-plane-compute.yaml \ | |
| --set-string compute.backendName=test-backend | |
| helm lint deployments/charts/osmo \ | |
| --kube-version 1.30.0 \ | |
| -f deployments/charts/osmo/profiles/kind-self-contained.yaml \ | |
| --set-string compute.backendName=test-backend \ | |
| --set embeddedDependencies.postgresql.enabled=false \ | |
| --set externalDependencies.postgresql.host=lint-postgresql \ | |
| --set secrets.postgresql.existingSecret=lint-postgresql | |
| else | |
| helm lint "deployments/charts/$CHART" | |
| fi | |
| - name: Helm Template (validate rendering) | |
| env: | |
| CHART: ${{ matrix.chart }} | |
| run: | | |
| echo "Validating template rendering for: $CHART" | |
| # Capture output, only show on failure | |
| HELM_ARGS=() | |
| if [ "$CHART" = "osmo" ]; then | |
| HELM_ARGS+=( | |
| --kube-version 1.30.0 | |
| -f deployments/charts/osmo/profiles/split-plane-control.yaml | |
| -f deployments/charts/osmo/tests/control-external-values.yaml | |
| ) | |
| fi | |
| if ! OUTPUT=$(helm template test-release "deployments/charts/$CHART" "${HELM_ARGS[@]}" 2>&1); then | |
| echo "❌ Template rendering failed:" | |
| echo "$OUTPUT" | |
| exit 1 | |
| fi | |
| echo "✓ Template rendering successful" | |
| if [ "$CHART" = "osmo" ]; then | |
| helm template test-compute deployments/charts/osmo \ | |
| --kube-version 1.30.0 \ | |
| -f deployments/charts/osmo/profiles/split-plane-compute.yaml \ | |
| --set-string compute.backendName=test-backend \ | |
| >/dev/null | |
| helm template test-kind deployments/charts/osmo \ | |
| --kube-version 1.30.0 \ | |
| --api-versions postgresql.cnpg.io/v1 \ | |
| -f deployments/charts/osmo/profiles/kind-self-contained.yaml \ | |
| --set-string compute.backendName=test-backend \ | |
| >/dev/null | |
| fi | |
| - name: Validate MCP-enabled service chart | |
| if: matrix.chart == 'service' | |
| run: bash deployments/charts/service/ci/validate-mcp-chart.sh | |
| - name: Chart-specific render tests | |
| run: | | |
| TEST_SCRIPT="deployments/charts/${{ matrix.chart }}/tests/render-tests.sh" | |
| if [ -f "$TEST_SCRIPT" ]; then | |
| bash "$TEST_SCRIPT" | |
| fi | |
| - name: Validate unified OSMO chart | |
| if: matrix.chart == 'osmo' | |
| run: bash deployments/charts/osmo/tests/test_osmo_charts.sh osmo |