ci.yaml

name: CI
permissions: {}

on:
  pull_request:
    branches:
      - main

jobs:
  chart-testing:
    name: Chart Testing
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Helm
        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
        with:
          # renovate: github=helm/helm
          version: v4.1.4

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.13"

      - name: Set up chart-testing
        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
        with:
          # renovate: github=helm/chart-testing
          version: v3.14.0

      - name: Run chart-testing (list-changed)
        id: list-changed
        run: |
          changed="$(ct list-changed --config .github/linters/ct.yaml)"
          if [[ -n "$changed" ]]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
            echo "changed_list=\"${changed//$'\n'/ }\"" >> "$GITHUB_OUTPUT"
          fi

      - name: install helm unittest plugin
        if: steps.list-changed.outputs.changed == 'true'
        run: helm plugin install https://github.com/helm-unittest/helm-unittest.git --version 1.0.3 --verify=false

      - name: Run chart-testing (lint)
        run: ct lint --config .github/linters/ct.yaml

      - name: Create kind cluster
        if: steps.list-changed.outputs.changed == 'true'
        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0

      - name: Apply Gateway API CRDs
        if: steps.list-changed.outputs.changed == 'true'
        run: kubectl apply -k https://github.com/kubernetes-sigs/gateway-api/config/crd

      - name: Apply Prometheus Operator CRDs
        if: steps.list-changed.outputs.changed == 'true'
        run: |
          helm install prometheus-operator-crds oci://ghcr.io/prometheus-community/charts/prometheus-operator-crds

      - name: Apply KEDA CRDs
        if: steps.list-changed.outputs.changed == 'true'
        run: kubectl apply --server-side -f "https://github.com/kedacore/keda/releases/download/v${KEDA_VERSION}/keda-${KEDA_VERSION}-crds.yaml"
        env:
          #renovate: github=kedacore/keda
          KEDA_VERSION: 2.19.0

      - name: Run chart-testing (install)

        if: steps.list-changed.outputs.changed == 'true'
        run: ct install --config .github/linters/ct.yaml

  check-generated-files:
    name: Check Generated Files
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: generate CODEOWNERS
        run: |
          ./scripts/generate-codeowners.sh | tee .github/CODEOWNERS

      - name: check CODEOWNERS for modifications
        run: |
          git diff --exit-code

      - name: generate MAINTAINERS.md
        run: |
          ./scripts/generate-maintainers.sh | tee MAINTAINERS.md

      - name: check MAINTAINERS.md for modifications
        run: |
          git diff --exit-code

      - name: generate advanced-issue-labeler.yml
        run: |
          ./scripts/generate-labeler.sh | tee .github/advanced-issue-labeler.yml

      - name: check advanced-issue-labeler.yml for modifications
        run: |
          git diff --exit-code

      - name: check issue template chart dropdowns
        run: |
          EXPECTED=$(find charts/ -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | sort)
          for template in .github/ISSUE_TEMPLATE/*.yml; do
            ACTUAL=$(yq -r '.body[] | select(.id == "chart-name") | .attributes.options[]' "$template" 2>/dev/null | sort)
            if [[ -z "$ACTUAL" ]]; then
              continue
            fi
            if [[ "$EXPECTED" != "$ACTUAL" ]]; then
              echo "ERROR: Chart dropdown in $template is out of sync with charts/ directory." >&2
              diff <(echo "$EXPECTED") <(echo "$ACTUAL")
              exit 1
            fi
          done

  super-linter:
    name: Super Linter
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Lint Code Base
        uses: super-linter/super-linter/slim@9e863354e3ff62e0727d37183162c4a88873df41 # v8.6.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MULTI_STATUS: false
          LINTER_RULES_PATH: .github/linters
          ENABLE_GITHUB_ACTIONS_STEP_SUMMARY: true
          ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT: false
          SAVE_SUPER_LINTER_SUMMARY: true
          VALIDATE_ALL_CODEBASE: false
          VALIDATE_BASH: true
          VALIDATE_BASH_EXEC: true
          VALIDATE_EDITORCONFIG: true
          VALIDATE_ENV: true
          VALIDATE_GITHUB_ACTIONS: true
          VALIDATE_GITHUB_ACTIONS_ZIZMOR: true
          VALIDATE_GITLEAKS: true
          VALIDATE_HTML: true
          VALIDATE_JSON: true
          VALIDATE_NATURAL_LANGUAGE: true
          # VALIDATE_MARKDOWN: true - disable to for now.
          VALIDATE_RENOVATE: true
          VALIDATE_SHELL_SHFMT: true
          VALIDATE_SPELL_CODESPELL: true
          # VALIDATE_XML: true
          # VALIDATE_YAML: true

  renovate-auto-merge:
    name: Auto-approve PRs from Renovate
    runs-on: ubuntu-24.04
    environment: renovate-auto-merge
    needs:
      - chart-testing
      - check-generated-files
      - super-linter
    if: >-
      github.event.pull_request.head.repo.full_name == github.repository
      && contains(github.event.pull_request.labels.*.name, 'dependencies/auto-merge')
      && (github.event.pull_request.user.login  == 'renovate[bot]' || github.event.pull_request.user.login  == 'helm-charts-renovate-helper-app[bot]')
    steps:
      # Using a GitHub App token, because GitHub Actions doesn't run on commits from github-actions bot
      # Used App:
      # https://github.com/organizations/prometheus-community/settings/apps/helm-charts-renovate-helper.
      # Ref: https://github.com/prometheus-community/helm-charts/issues/5213.
      - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
        id: app-token
        with:
          app-id: ${{ secrets.APP_RENOVATE_HELPER_APP_ID }}
          private-key: ${{ secrets.APP_RENOVATE_HELPER_PRIVATE_KEY }}

      - name: Approve PR
        run: |
          gh pr review ${{ github.event.pull_request.number }} --approve --repo "${{ github.repository }}"
          gh pr merge ${{ github.event.pull_request.number }} --admin --squash --repo "${{ github.repository }}" --match-head-commit "${{ github.event.pull_request.head.sha }}" --delete-branch
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}