build(deps): bump aes-gcm from 0.10.3 to 0.11.1 #259
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Helm | |
| # ------------------------------------------------------------------------------ | |
| # Workflow Settings | |
| # ------------------------------------------------------------------------------ | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| merge_group: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| permissions: {} | |
| env: | |
| HELM_VERSION: v3.17.3 | |
| KIND_VERSION: v0.32.0 | |
| KUBECONFORM_VERSION: 0.6.7 | |
| # v1.x's plugin.yaml uses the platformCommand/platformHooks manifest | |
| # schema, which the pinned Helm v3.17.3 cannot load. v0.8.2 is the last | |
| # release using the command/hooks schema Helm 3.17 supports. | |
| HELM_UNITTEST_VERSION: v0.8.2 | |
| jobs: | |
| # ------------------------------------------------------------------------------ | |
| # Avoid building runtime images for documentation-only pull requests. | |
| # ------------------------------------------------------------------------------ | |
| changes: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| outputs: | |
| runtime: ${{ steps.changed.outputs.runtime }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Detect runtime changes | |
| id: changed | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| run: | | |
| set -euo pipefail | |
| if [ "${EVENT_NAME}" != "pull_request" ]; then | |
| echo "runtime=true" >> "${GITHUB_OUTPUT}" | |
| exit 0 | |
| fi | |
| changed_files="$(git diff --name-only "${BASE_SHA}...${GITHUB_SHA}")" | |
| if printf '%s\n' "${changed_files}" | grep -qvE '(^docs/|(^|/)README[^/]*$|\.md$)'; then | |
| echo "runtime=true" >> "${GITHUB_OUTPUT}" | |
| else | |
| echo "runtime=false" >> "${GITHUB_OUTPUT}" | |
| fi | |
| # ---------------------------------------------------------------------------- | |
| # Static chart validation (lint, template, schema, CRD sync, package) | |
| # ---------------------------------------------------------------------------- | |
| validate: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Helm | |
| uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 | |
| with: | |
| version: ${{ env.HELM_VERSION }} | |
| - name: Install kubeconform | |
| run: | | |
| curl -fsSL -o /tmp/kubeconform.tar.gz \ | |
| "https://github.com/yannh/kubeconform/releases/download/v${KUBECONFORM_VERSION}/kubeconform-linux-amd64.tar.gz" | |
| echo "95f14e87aa28c09d5941f11bd024c1d02fdc0303ccaa23f61cef67bc92619d73 /tmp/kubeconform.tar.gz" | sha256sum -c | |
| tar xz -C /usr/local/bin kubeconform < /tmp/kubeconform.tar.gz | |
| rm /tmp/kubeconform.tar.gz | |
| kubeconform -v | |
| - name: Install helm-unittest | |
| run: helm plugin install https://github.com/helm-unittest/helm-unittest --version "${HELM_UNITTEST_VERSION}" | |
| - name: Chart template unit tests | |
| run: helm unittest charts/grid-site charts/grid-operator | |
| - name: Validate charts (static) | |
| run: ./scripts/verify-helm-chart.sh | |
| - name: Validate rendered manifests against Kubernetes schema | |
| run: | | |
| for chart in charts/grid-operator charts/praxis-gateway; do | |
| echo "--- Validating $chart ---" | |
| EXTRA_ARGS=() | |
| if [ "$chart" = "charts/praxis-gateway" ]; then | |
| EXTRA_ARGS=(--set config.existingConfigMap=schema-check --set image.tag=v0.1.0-ci) | |
| fi | |
| helm template validate-schema "$chart" --namespace grid-system "${EXTRA_ARGS[@]}" \ | |
| | kubeconform -strict -kubernetes-version 1.30.0 -summary | |
| done | |
| - name: Upload rendered manifests | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: rendered-manifests | |
| path: /tmp/helm-rendered-*.yaml | |
| if-no-files-found: ignore | |
| retention-days: 5 | |
| # ---------------------------------------------------------------------------- | |
| # Kind chart lifecycle test (install/upgrade/uninstall wiring with pause:3.9; | |
| # real Praxis runtime behavior is proven by the GLB demo) | |
| # ---------------------------------------------------------------------------- | |
| kind: | |
| needs: changes | |
| if: needs.changes.outputs.runtime == 'true' | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Helm | |
| uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 | |
| with: | |
| version: ${{ env.HELM_VERSION }} | |
| - name: Install Kind | |
| run: | | |
| curl -fsSL -o /tmp/kind \ | |
| "https://github.com/kubernetes-sigs/kind/releases/download/${KIND_VERSION}/kind-linux-amd64" | |
| echo "50030de23cf40a18505f20426f6a8506bedf13c6e509244bd1fa9463721b0f54 /tmp/kind" | sha256sum -c | |
| sudo install -m 0755 /tmp/kind /usr/local/bin/kind | |
| rm /tmp/kind | |
| kind version | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 | |
| - name: Build operator image for Kind | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| file: deploy/operator/Containerfile | |
| push: false | |
| load: true | |
| tags: ghcr.io/praxis-proxy/grid-operator:ci | |
| cache-from: type=gha,scope=helm-kind-operator | |
| cache-to: type=gha,mode=max,scope=helm-kind-operator | |
| - name: Run Kind lifecycle tests | |
| run: | | |
| KIND=1 GRID_OPERATOR_CI_TAG=ci ./scripts/verify-helm-chart.sh | |
| - name: Upload test logs | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: kind-test-logs | |
| path: /tmp/helm-kind-logs/ | |
| if-no-files-found: ignore | |
| retention-days: 5 |