[DO NOT MERGE] test(ci): validate GH_PAT_TO_ACCESS_GITHUB_API as release-push token #31

Workflow file for this run

.github/workflows/helm-diff.yaml at 840d967

	name: Helm Render Diff

	# Informational: renders every test-values scenario on both the PR base and head,
	# diffs the resulting Kubernetes manifests, and posts a sticky PR comment so
	# reviewers can see exactly what a change does to the rendered output.
	#
	# This ports the diff/report logic from comet-ml/gha-tools helm/helm-diff, but
	# runs self-contained on GitHub-hosted runners with public actions — that private
	# action runs on the self-hosted `helm` runner and can't be used from a public
	# repo (fork PRs can't pull a private action, and self-hosted runners must not run
	# fork code). Never fails the PR (the hard gate is lint-render.yaml).

	on:
	pull_request:
	branches:
	- main

	permissions:
	contents: read
	pull-requests: write
	issues: write

	env:
	KUBE_VERSION: "1.29.0"
	CHART_PATH: charts/s3proxy
	# Match gha-tools helm-diff defaults so output is consistent with our other charts.
	RELEASE_NAME: release
	NAMESPACE: default

	jobs:
	render-diff:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout PR head
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	ref: ${{ github.event.pull_request.head.sha }}
	path: pr-repo

	- name: Checkout base
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	ref: ${{ github.event.pull_request.base.sha }}
	path: base-repo

	- name: Set up Helm
	uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
	with:
	version: v3.19.2

	- name: Build chart dependencies
	# comet-common is not vendored in-repo; resolve it from Chart.lock on each
	# side that has one (base may predate the dependency), before rendering.
	run: \|
	for dir in base-repo pr-repo
	do
	if [ -f "${dir}/${CHART_PATH}/Chart.lock" ]
	then
	helm dependency build "${dir}/${CHART_PATH}"
	fi
	done

	- name: Render and diff
	run: \|
	set -uo pipefail

	# render <repo-dir> <values-relpath> <out-file>
	# Renders the chart if both the chart dir and the values file exist on
	# that side; otherwise writes an empty baseline (mirrors gha-tools, so a
	# values file that only exists on the PR shows up as fully added).
	render() {
	local dir="$1" vals="$2" out="$3"
	if [ -f "${dir}/${vals}" ] && [ -d "${dir}/${CHART_PATH}" ]
	then
	if ! helm template "${RELEASE_NAME}" "${dir}/${CHART_PATH}" \
	--namespace "${NAMESPACE}" \
	--values "${dir}/${vals}" \
	--kube-version "${KUBE_VERSION}" > "$out" 2>"${out}.err"
	then
	echo "⚠️ render error for ${dir}/${vals}:"
	cat "${out}.err"
	: > "$out"
	fi
	else
	: > "$out"
	fi
	}

	RUN_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
	COMMENT_LIMIT=60000

	# Union of scenario files across base and head, so a scenario removed in
	# the PR (present on base, absent on head) still shows up as a deletion.
	names="$(
	{ ls -1 pr-repo/test-values/.yaml base-repo/test-values/.yaml 2>/dev/null \|\| true; } \
	\| xargs -r -n1 basename \| sort -u
	)"

	# Two parts: a summary table (always small) and the detailed diffs.
	table=/tmp/table.md
	details=/tmp/details.md
	{
	echo "<!-- helm-render-diff -->"
	echo "## 📊 Helm Render Diff Summary"
	echo ""
	echo "Chart \`${CHART_PATH}\` rendered with Kubernetes \`${KUBE_VERSION}\`. Informational only — this check never fails the PR."
	echo ""
	echo "\| Values File \| Chart Path \| Changes \| Status \|"
	echo "\|-------------\|------------\|---------\|--------\|"
	} > "$table"
	echo "## 🔍 Detailed Changes" > "$details"

	any_changes=0
	while IFS= read -r name
	do
	[ -n "$name" ] \|\| continue
	render pr-repo "test-values/${name}" "/tmp/after-${name}"
	render base-repo "test-values/${name}" "/tmp/before-${name}"

	diff -u "/tmp/before-${name}" "/tmp/after-${name}" > "/tmp/diff-${name}" \|\| true

	if [ -s "/tmp/diff-${name}" ]
	then
	any_changes=1
	# Additions/deletions, excluding the +++/--- file headers (as gha-tools does).
	additions=$(grep '^+' "/tmp/diff-${name}" \| grep -vc '^+++' \|\| true)
	deletions=$(grep '^-' "/tmp/diff-${name}" \| grep -vc '^---' \|\| true)
	echo "\| \`test-values/${name}\` \| \`${CHART_PATH}\` \| +${additions} -${deletions} \| 🔄 Changes Detected ([summary](${RUN_URL})) \|" >> "$table"
	{
	echo ""
	echo "### 📝 Changes in \`${CHART_PATH}\` with \`test-values/${name}\`"
	echo ""
	echo "<details><summary>🔍 Click to view complete diff</summary>"
	echo ""
	echo '```diff'
	cat "/tmp/diff-${name}"
	echo '```'
	echo ""
	echo "</details>"
	} >> "$details"
	else
	echo "\| \`test-values/${name}\` \| \`${CHART_PATH}\` \| - \| ✅ No Changes \|" >> "$table"
	fi
	done <<< "$names"

	if [ "$any_changes" -eq 0 ]
	then
	{
	echo ""
	echo "### 🎉 No changes detected in any of the tested configurations!"
	} >> "$table"
	fi

	# Full report (table + detailed diffs) always goes to the job summary.
	cat "$table" >> "$GITHUB_STEP_SUMMARY"
	if [ "$any_changes" -eq 1 ]
	then
	{
	echo ""
	echo "---"
	echo ""
	cat "$details"
	} >> "$GITHUB_STEP_SUMMARY"
	fi

	# PR comment: table + inline diffs when it fits, otherwise a slimmed
	# table-only comment linking to the full diffs in the job summary
	# (mirrors the self-hosted chart's behaviour on large diffs).
	{
	cat "$table"
	if [ "$any_changes" -eq 1 ]
	then
	echo ""
	echo "---"
	echo ""
	cat "$details"
	fi
	} > /tmp/comment-full.md

	if [ "$(wc -c < /tmp/comment-full.md)" -le "$COMMENT_LIMIT" ]
	then
	cp /tmp/comment-full.md diff-comment.md
	else
	{
	cat "$table"
	echo ""
	echo "---"
	echo ""
	echo "> ℹ️ Per-scenario diffs are omitted from this comment because the full render diff exceeds GitHub's comment size limit. See the complete diffs in the [workflow job summary](${RUN_URL})."
	} > diff-comment.md
	fi

	# Match the repo's preview-readme.yaml convention: minimize (collapse) any
	# previous render-diff comments as OUTDATED, then post a fresh one. Uses
	# first-party actions/github-script (no third-party comment action).
	# continue-on-error: fork PRs get a read-only token and cannot comment; the
	# full diff is still available in the job summary.
	- name: Minimize outdated diff comments and post the latest
	continue-on-error: true
	uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
	with:
	script: \|
	const fs = require('fs');
	const marker = '<!-- helm-render-diff -->';
	const body = fs.readFileSync('diff-comment.md', 'utf8');

	const comments = await github.paginate(github.rest.issues.listComments, {
	owner: context.repo.owner,
	repo: context.repo.repo,
	issue_number: context.issue.number,
	});

	for (const comment of comments) {
	if (comment.user.type === 'Bot' && comment.body.includes(marker)) {
	await github.graphql(
	`mutation($id: ID!) {
	minimizeComment(input: { subjectId: $id, classifier: OUTDATED }) {
	clientMutationId
	}
	}`,
	{ id: comment.node_id },
	);
	}
	}

	await github.rest.issues.createComment({
	owner: context.repo.owner,
	repo: context.repo.repo,
	issue_number: context.issue.number,
	body,
	});

Navigation Menu

Uh oh!

[DO NOT MERGE] test(ci): validate GH_PAT_TO_ACCESS_GITHUB_API as release-push token #31

Workflow file

[DO NOT MERGE] test(ci): validate GH_PAT_TO_ACCESS_GITHUB_API as release-push token #31

Uh oh!

Workflow file for this run