ci: bump actions/checkout from 4 to 7 #56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint and Test Charts | |
| on: | |
| pull_request: | |
| paths: | |
| - 'charts/**' | |
| - 'ct.yaml' | |
| - 'lintconf.yaml' | |
| - '.github/workflows/lint-test.yaml' | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - 'charts/**' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| changed: ${{ steps.list-changed.outputs.changed }} | |
| charts: ${{ steps.list-changed.outputs.charts }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v5 | |
| with: | |
| version: v3.19.4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.12' | |
| - name: Set up chart-testing | |
| uses: helm/chart-testing-action@v2.8.0 | |
| - name: List changed charts | |
| id: list-changed | |
| run: | | |
| changed=$(ct list-changed --config ct.yaml) | |
| if [[ -n "$changed" ]]; then | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| # Convert to JSON array for matrix | |
| echo "charts=$(echo "$changed" | jq -R -s -c 'split("\n") | map(select(. != ""))')" >> "$GITHUB_OUTPUT" | |
| echo "Changed charts:" | |
| echo "$changed" | |
| else | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| echo "charts=[]" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Run chart-testing (lint) | |
| if: steps.list-changed.outputs.changed == 'true' | |
| run: ct lint --config ct.yaml | |
| unittest: | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| if: needs.lint.outputs.changed == 'true' | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v5 | |
| with: | |
| version: v3.19.4 | |
| - name: Set up chart-testing | |
| uses: helm/chart-testing-action@v2.8.0 | |
| - name: Get changed charts | |
| id: set-matrix | |
| run: | | |
| # Use main as target branch for push events | |
| TARGET_BRANCH="main" | |
| if [[ "${{ github.event_name }}" == "pull_request" ]]; then | |
| TARGET_BRANCH="${{ github.base_ref }}" | |
| fi | |
| changed=$(ct list-changed --config ct.yaml --target-branch $TARGET_BRANCH 2>/dev/null || echo "") | |
| if [[ -z "$changed" ]]; then | |
| # Fallback: check git diff | |
| changed=$(git diff --name-only origin/$TARGET_BRANCH HEAD -- charts/ 2>/dev/null | grep -oP 'charts/\K[^/]+' | sort -u || echo "") | |
| fi | |
| if [[ -n "$changed" ]]; then | |
| CHARTS=$(echo "$changed" | jq -R -s -c 'split("\n") | map(select(. != ""))') | |
| else | |
| CHARTS='[]' | |
| fi | |
| echo "matrix={\"chart\":$CHARTS}" >> "$GITHUB_OUTPUT" | |
| - name: Install helm-unittest plugin | |
| run: | | |
| helm plugin install https://github.com/helm-unittest/helm-unittest.git | |
| - name: Run unit tests | |
| run: | | |
| failed=0 | |
| for chart in ${{ fromJson(needs.lint.outputs.charts) }}; do | |
| if [[ -d "charts/${chart}/tests" ]]; then | |
| echo "Testing charts/${chart}" | |
| if ! helm unittest "charts/${chart}"; then | |
| failed=1 | |
| fi | |
| fi | |
| done | |
| exit $failed | |
| kubeconform: | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| if: needs.lint.outputs.changed == 'true' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v5 | |
| with: | |
| version: v3.19.4 | |
| - name: Install kubeconform | |
| run: | | |
| curl -L https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz | tar xz | |
| sudo mv kubeconform /usr/local/bin/ | |
| - name: Validate manifests | |
| run: | | |
| failed=0 | |
| for chart in ${{ fromJson(needs.lint.outputs.charts) }}; do | |
| chart_path="charts/${chart}" | |
| echo "Validating ${chart}" | |
| # Use ci values if available, otherwise default | |
| values_file="" | |
| if [[ -f "${chart_path}ci/default-values.yaml" ]]; then | |
| values_file="-f ${chart_path}ci/default-values.yaml" | |
| fi | |
| helm dependency update "$chart_path" 2>/dev/null || true | |
| if ! helm template "$chart_path" $values_file | kubeconform -strict -summary -output json; then | |
| failed=1 | |
| fi | |
| echo "::endgroup::" | |
| done | |
| exit $failed | |
| security: | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| if: needs.lint.outputs.changed == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{ fromJson(needs.lint.outputs.charts) }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Run Trivy config scanner | |
| uses: aquasecurity/trivy-action@0.35.0 | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: 'charts/${{ matrix.chart }}' | |
| scanners: 'misconfig' | |
| format: 'table' | |
| exit-code: '1' | |
| severity: 'CRITICAL,HIGH' | |
| trivyignore: '.trivyignore' | |
| test: | |
| runs-on: ubuntu-latest | |
| needs: [lint, unittest] | |
| if: needs.lint.outputs.changed == 'true' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v5 | |
| with: | |
| version: v3.19.4 | |
| - name: Set up chart-testing | |
| uses: helm/chart-testing-action@v2.8.0 | |
| - name: Create kind cluster | |
| uses: helm/kind-action@v1.14.0 | |
| with: | |
| cluster_name: chart-testing | |
| - name: Run chart-testing (install) | |
| run: ct install --config ct.yaml |