helm-charts-hardened/.github/workflows/helm-chart-ci.yaml

name: Helm Chart CI

on:
  workflow_dispatch:
  pull_request:
    types: [synchronize, opened, reopened, edited]
    paths:
      - 'charts/**'
      - '.github/workflows/helm-chart-ci.yaml'
      - '.github/kind/conf/kind-config.yaml'
      - '.github/tests/**/*.yaml'
      - '.github/tests/**/*.sh'
      - 'examples/**/*.yaml'
      - 'helm-docs.sh'

concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: true

env:
  HELM_VERSION: v3.11.1
  PYTHON_VERSION: 3.11.2
  CHART_TESTING_VERSION: v3.7.1

jobs:
  check-docs:
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout
        uses: actions/[email protected]

      - name: Verify Docs updated
        run: ./helm-docs.sh

  lint-chart:
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout
        uses: actions/[email protected]
        with:
          fetch-depth: 0

      - name: Set up Helm
        uses: azure/[email protected]
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Setup chart-testing
        uses: helm/[email protected]
        with:
          version: ${{ env.CHART_TESTING_VERSION }}

      - name: Run chart-testing (list-changed)
        id: list-changed
        run: |
          changed=$(ct list-changed --target-branch ${{ github.base_ref }})
          if [[ -n "$changed" ]]; then
            echo "changed=true" >> $GITHUB_OUTPUT
          fi

      - name: Run chart-testing (lint)
        run: |
          ct lint --debug ${{ github.base_ref != 'release' && '--check-version-increment=false' || '' }} \
            --target-branch ${{ github.base_ref }}

    outputs:
      changed: ${{ steps.list-changed.outputs.changed }}

  build-matrix:
    name: Build matrix
    runs-on: ubuntu-22.04

    needs: [lint-chart]

    if: needs.lint-chart.outputs.changed == 'true'

    steps:
      - name: Checkout
        uses: actions/[email protected]

      - id: set-matrix
        name: Collect all tests
        run: |
          tests="$(echo -e "default\n$(find .github/tests -maxdepth 1 -type d | grep -Ev 'tests$' | xargs -I % basename % | sort | uniq)")"
          tests_json="$(echo "$tests" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')"
          echo "tests=$tests_json" >> $GITHUB_OUTPUT

    outputs:
      tests: ${{ steps.set-matrix.outputs.tests }}

  test:
    runs-on: ubuntu-22.04

    needs:
      - lint-chart
      - build-matrix

    if: needs.lint-chart.outputs.changed == 'true'

    strategy:
      fail-fast: false
      matrix:
        # Choose tags corresponding to the version of Kind being used.
        # At a minimum, we should test the currently supported versions of
        # Kubernetes, but can go back farther as long as we don't need heroics
        # to pull it off (i.e. kubectl version juggling).
        k8s:
          - v1.26.0
          - v1.25.3
          - v1.24.7
          - v1.23.13
          - v1.22.15
        values:
          - ${{ fromJson(needs.build-matrix.outputs.tests) }}

    steps:
      - name: Checkout
        uses: actions/[email protected]
        with:
          fetch-depth: 0

      - name: Set up Helm
        uses: azure/[email protected]
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Setup chart-testing
        uses: helm/[email protected]
        with:
          version: ${{ env.CHART_TESTING_VERSION }}

      - name: Create kind ${{ matrix.k8s }} cluster
        uses: helm/[email protected]
        # Only build a kind cluster if there are chart changes to test.
        with:
          version: v0.17.0
          node_image: kindest/node:${{ matrix.k8s }}
          config: .github/kind/conf/kind-config.yaml
          verbosity: 1

      - name: Run chart-testing (install)
        run: |
          post-install() {
            [ -x "${TEST_DIR}/post-install.sh" ] && "${TEST_DIR}/post-install.sh" $1
            exit $1
          }

          trap 'post-install $? $LINENO' EXIT

          export scenario="$(basename "${TEST_DIR}")"
          export EXTRA_HELM_ARGS=""

          [ "${scenario}" != "default" ] && kubectl create namespace "${scenario}"
          [ -x "${TEST_DIR}/pre-install.sh" ] && "${TEST_DIR}/pre-install.sh"
          [ -f "${TEST_DIR}/.env" ] && source "${TEST_DIR}/.env"

          if [ -x "${TEST_DIR}/install.sh" ]; then
            "${TEST_DIR}/install.sh"
          else
            ct install --debug \
              --namespace "${scenario}" \
              --target-branch ${{ github.base_ref }} \
              --exclude-deprecated \
              ${{ (matrix.values != 'default' && '--helm-extra-set-args "--values=${TEST_DIR}/values.yaml ${EXTRA_HELM_ARGS}"') || '' }}
          fi
        env:
          TEST_DIR: .github/tests/${{ matrix.values }}