helm-chart-validation.yml

name: Helm Chart Validation

on:
  push:
    branches: [main]
    paths:
      - "k8s/helm/**"
      - "scripts/helm-chart-kind-smoke.sh"
      - ".github/workflows/helm-chart-validation.yml"
  pull_request:
    paths:
      - "k8s/helm/**"
      - "scripts/helm-chart-kind-smoke.sh"
      - ".github/workflows/helm-chart-validation.yml"
  workflow_dispatch:

permissions:
  contents: read

env:
  CHART_PATH: k8s/helm/durable-workflow
  HELM_VERSION: v3.16.2
  KUBECONFORM_VERSION: v0.6.7
  KUBE_VERSIONS: "1.27.0 1.28.0 1.29.0 1.30.0"
  HELM_CT_CLUSTER_NAME: dw-helm-ct-${{ github.run_id }}-${{ github.run_attempt }}

jobs:
  lint-and-template:
    name: Lint, render, and validate manifests
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout server
        uses: actions/checkout@v6

      - name: Set up Helm
        uses: azure/setup-helm@v4.2.0
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Helm lint
        run: |
          helm lint "${CHART_PATH}"
          for f in "${CHART_PATH}"/ci/*-values.yaml; do
            echo "::group::helm lint with $(basename "$f")"
            helm lint "${CHART_PATH}" -f "$f"
            echo "::endgroup::"
          done

      - name: Render every CI fixture
        run: |
          mkdir -p rendered
          for f in "${CHART_PATH}"/ci/*-values.yaml; do
            name="$(basename "$f" .yaml)"
            echo "::group::helm template ${name}"
            helm template "rel-${name}" "${CHART_PATH}" \
              --namespace durable-workflow \
              -f "$f" \
              > "rendered/${name}.yaml"
            echo "::endgroup::"
          done

      - name: Validate rendered manifests against Kubernetes schemas
        run: |
          docker run --rm \
            -v "${PWD}/rendered:/manifests:ro" \
            ghcr.io/yannh/kubeconform:${KUBECONFORM_VERSION} \
            -strict \
            -summary \
            -schema-location default \
            -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
            -kubernetes-version 1.29.0 \
            /manifests

      - name: Validate against the supported Kubernetes version matrix
        run: |
          for kv in ${KUBE_VERSIONS}; do
            echo "::group::kubeconform against ${kv}"
            docker run --rm \
              -v "${PWD}/rendered:/manifests:ro" \
              ghcr.io/yannh/kubeconform:${KUBECONFORM_VERSION} \
              -strict \
              -summary \
              -kubernetes-version "${kv}" \
              /manifests
            echo "::endgroup::"
          done

      - name: Upload rendered manifests
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@v3.2.2
        with:
          name: helm-rendered-manifests
          path: rendered/
          if-no-files-found: error

  ct-lint-install:
    name: chart-testing lint + install (kind)
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout server
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Set up Helm
        uses: azure/setup-helm@v4.2.0
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Set up chart-testing
        uses: helm/chart-testing-action@v2.6.1

      - name: Configure kind networking for containerized runners
        if: env.JOB_CONTAINER_NAME != ''
        run: |
          workflow_network="$(docker inspect -f '{{range $k, $v := .NetworkSettings.Networks}}{{printf "%s" $k}}{{end}}' "${JOB_CONTAINER_NAME}")"
          if [ -z "${workflow_network}" ]; then
            echo "unable to determine workflow network for ${JOB_CONTAINER_NAME}" >&2
            exit 1
          fi
          echo "KIND_EXPERIMENTAL_DOCKER_NETWORK=${workflow_network}" >> "${GITHUB_ENV}"

      - name: Set up kind
        uses: helm/kind-action@v1.10.0
        with:
          version: v0.23.0
          node_image: kindest/node:v1.29.4
          cluster_name: ${{ env.HELM_CT_CLUSTER_NAME }}
          wait: 120s

      - name: Export internal kind kubeconfig for containerized runners
        if: env.JOB_CONTAINER_NAME != ''
        run: kind export kubeconfig --name "${HELM_CT_CLUSTER_NAME}" --internal

      - name: ct lint
        run: |
          ct lint \
            --target-branch "${{ github.event.repository.default_branch }}" \
            --chart-dirs k8s/helm \
            --charts "${CHART_PATH}" \
            --validate-maintainers=false

      - name: Run kind smoke script
        env:
          K8S_HELM_SMOKE_KIND_NODE_IMAGE: kindest/node:v1.29.4
          K8S_HELM_SMOKE_CLUSTER: ${{ env.HELM_CT_CLUSTER_NAME }}
          K8S_HELM_SMOKE_REUSE_CLUSTER: "1"
          K8S_HELM_SMOKE_IMAGE: durableworkflow/server:helm-smoke-${{ github.run_id }}-${{ github.run_attempt }}
          K8S_HELM_SMOKE_ARTIFACT_DIR: ${{ runner.temp }}/helm-smoke
        run: scripts/helm-chart-kind-smoke.sh

      - name: Print smoke diagnostics
        if: failure()
        run: |
          artifact_dir="${{ runner.temp }}/helm-smoke"
          if [ ! -d "${artifact_dir}" ]; then
            echo "no smoke artifacts collected"
            exit 0
          fi

          for file in \
            helm-status.txt \
            events.txt \
            describe.txt \
            resources.txt \
            migration-job.log \
            server.log \
            worker.log \
            mysql.log \
            redis.log \
            port-forward.log; do
            path="${artifact_dir}/${file}"
            if [ ! -f "${path}" ]; then
              continue
            fi
            echo "::group::${file}"
            tail -n 200 "${path}" || cat "${path}" || true
            echo "::endgroup::"
          done

      - name: Upload smoke artifacts
        if: failure()
        continue-on-error: true
        uses: actions/upload-artifact@v3.2.2
        with:
          name: helm-chart-kind-smoke
          path: ${{ runner.temp }}/helm-smoke
          if-no-files-found: ignore