helm-charts-hardened/.github/workflows/helm-chart-ci.yaml

name: Helm Chart CI

on:
  workflow_dispatch:
  pull_request:
    types: [synchronize, opened, reopened]
    paths:
      - 'charts/**'
      - '.github/workflows/helm-chart-ci.yaml'
      - '.github/kind/conf/kind-config.yaml'
      - '.github/tests/**/*.yaml'
      - '.github/tests/**/*.sh'
      - '.github/tests/**/*.json'
      - 'examples/**/*.yaml'
      - 'helm-docs.sh'

concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: true

env:
  HELM_VERSION: v3.12.0
  PYTHON_VERSION: 3.11.3
  CHART_TESTING_VERSION: v3.8.0

jobs:
  checks:
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout
        uses: actions/[email protected]

      - name: Verify Docs updated
        run: ./helm-docs.sh

      - name: Verify Spire appVersion
        run: |
          set +e
          BASEVER=$(yq e .appVersion Chart.yaml)
          for FILE in spiffe-oidc-discovery-provider spire-agent spire-server; do
            VER=$(yq .appVersion charts/$FILE/Chart.yaml)
            if [ "$VER" != "$BASEVER" ]; then
              {
                echo "## Version mismatch"
                echo
                echo "There is a mismatch between the chart version ($BASEVER) and subchart version ($VER). The issue may be in file $FILE. Please fix."
              } >> "$GITHUB_STEP_SUMMARY"
              exit 1
            fi
          done

      - name: Check objects for images without overrides
        run: |
          set +e
          set -o pipefail
          # Look for image: definitions that are not templated. If we find none, exit is not 0 and we invert the error code to get the
          # test to pass. Ignore tests for now...
          grep -r "image:" charts/spire  | grep "templates/" | grep -v 'image: {{ template "' > /tmp/findings
          res=$?
          if [ $res -eq 0 ]; then
            {
              echo "## Hardcoded images"
              echo
              echo ":x: These templates were found to be using statically defined images and not overridable ones. Please fix."
              echo
              cat /tmp/findings
            } >> "$GITHUB_STEP_SUMMARY"
            exit 1
          fi

  lint-chart:
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout
        uses: actions/[email protected]
        with:
          fetch-depth: 0

      - name: Set up Helm
        uses: azure/[email protected]
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Setup chart-testing
        uses: helm/[email protected]
        with:
          version: ${{ env.CHART_TESTING_VERSION }}

      - name: Run chart-testing (lint)
        run: TARGET_BRANCH=${{ github.base_ref }} make lint${{ github.base_ref == 'release' && '-release' || '' }}

    outputs:
      changed: ${{ steps.list-changed.outputs.changed }}

  build-matrix:
    name: Build matrix
    runs-on: ubuntu-22.04

    needs: [lint-chart]

    steps:
      - name: Checkout
        uses: actions/[email protected]

      - id: set-matrix
        name: Collect all tests
        run: |
          tests="$(echo -e "default\n$(find .github/tests -maxdepth 1 -type d | grep -Ev 'tests$' | xargs -I % basename % | sort | uniq)")"
          tests_json="$(echo "$tests" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')"
          echo "tests=$tests_json" >> $GITHUB_OUTPUT

    outputs:
      tests: ${{ steps.set-matrix.outputs.tests }}

  test:
    runs-on: ubuntu-22.04

    needs:
      - lint-chart
      - build-matrix

    strategy:
      fail-fast: false
      matrix:
        # Choose tags corresponding to the version of Kind being used.
        # At a minimum, we should test the currently supported versions of
        # Kubernetes, but can go back farther as long as we don't need heroics
        # to pull it off (i.e. kubectl version juggling).
        k8s:
          - v1.27.2
          - v1.26.4
          - v1.25.9
        values:
          - ${{ fromJson(needs.build-matrix.outputs.tests) }}

    steps:
      - name: Checkout
        uses: actions/[email protected]
        with:
          fetch-depth: 0

      - name: Set up Helm
        uses: azure/[email protected]
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Setup chart-testing
        uses: helm/[email protected]
        with:
          version: ${{ env.CHART_TESTING_VERSION }}

      - name: Create kind ${{ matrix.k8s }} cluster
        uses: helm/[email protected]
        # Only build a kind cluster if there are chart changes to test.
        with:
          version: v0.19.0
          node_image: kindest/node:${{ matrix.k8s }}
          config: .github/kind/conf/kind-config.yaml
          verbosity: 1

      - name: Run chart-testing (install)
        run: |
          post-install() {
            [ -x "${TEST_DIR}/post-install.sh" ] && "${TEST_DIR}/post-install.sh" $1
            exit $1
          }

          trap 'post-install $? $LINENO' EXIT

          export scenario="$(basename "${TEST_DIR}")"
          export EXTRA_HELM_ARGS=""

          source .github/tests/charts.sh

          [ "${scenario}" != "default" ] && kubectl create namespace "${scenario}"
          [ -x "${TEST_DIR}/pre-install.sh" ] && "${TEST_DIR}/pre-install.sh"
          [ -f "${TEST_DIR}/.env" ] && source "${TEST_DIR}/.env"

          if [ -x "${TEST_DIR}/install.sh" ]; then
            "${TEST_DIR}/install.sh"
          else
            ct install --debug \
              --charts "charts/spire" \
              --namespace "${scenario}" \
              --target-branch ${{ github.base_ref }} \
              --exclude-deprecated \
              --skip-clean-up \
              ${{ (matrix.values != 'default' && '--helm-extra-set-args "--values=${TEST_DIR}/values.yaml ${EXTRA_HELM_ARGS}"') || '' }}
          fi
        env:
          TEST_DIR: .github/tests/${{ matrix.values }}