helm-chart.yml

name: Helm chart validation
on:
  push:
    branches:
      - main
    paths:
      - 'helm/**'
      - '.github/workflows/helm-chart.yml'
  pull_request:
    branches:
      - main
    paths:
      - 'helm/**'
      - '.github/workflows/helm-chart.yml'

jobs:
  lint:
    name: Lint and install chart
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Helm
        uses: azure/setup-helm@v4
        with:
          version: v3.13.2

      - name: Install Python
        uses: actions/setup-python@v5.4.0
        with:
          python-version: 3.9

      - name: Set up chart-testing
        uses: helm/chart-testing-action@v2.6.1

      - name: Add bitami repo
        run: helm repo add bitnami https://charts.bitnami.com/bitnami

      - name: Lint helm chart
        run: |
          ct lint --config ./.github/configs/chart-testing.yaml

      - name: Create kind cluster
        if: "${{!startsWith(github.event.pull_request.title, 'feat: Release')}}"
        uses: helm/kind-action@v1.11.0

      - name: Label cluster nodes
        if: "${{!startsWith(github.event.pull_request.title, 'feat: Release')}}"
        run: |
          for node in $(kubectl get nodes -o name); do
            kubectl label --overwrite $node "role=management"
          done

      - name: Run chart-testing (install and upgrade)
        if: "${{!startsWith(github.event.pull_request.title, 'feat: Release')}}"
        run: ct install --upgrade --config ./.github/configs/chart-testing.yaml
  
  validate:
    name: Validate chart against kubernetes API
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      
      - name: Install Helm
        uses: azure/setup-helm@v4
        with:
          version: v3.13.2
      
      - name: Create kind cluster
        uses: helm/kind-action@v1.11.0

      - name: Validate chart
        run: |
          helm template flowforge ./helm/flowforge --set forge.domain=example.com | kubectl apply --validate=true -f -

  unit-tests:
    name: Run unit tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Helm
        uses: azure/setup-helm@v4
      
      - name: Install unittest plugin
        run: helm plugin install https://github.com/helm-unittest/helm-unittest.git

      - name: Run unit tests
        run: |
          helm unittest ./helm/flowforge -t JUnit -o junit-results.xml

      - name: Publish Test Report
        uses: mikepenz/action-junit-report@v5
        if: always()
        with:
          check_name: 'Helm chart unit tests'
          report_paths: 'junit-results.xml'
          detailed_summary: true

  scan:
    name: Scan chart
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        tool:
          - checkov
          # temporary disabled due to https://github.com/zegl/kube-score/issues/559
          # - kube-score

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
    
      - name: Install Helm
        uses: azure/setup-helm@v4
        with:
          version: v3.13.2
    
      - name: Scan chart with checkov
        if: matrix.tool == 'checkov'
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: ${{ github.workspace }}/helm
          var_file: ${{ github.workspace }}/helm/flowforge/ci/default-values.yaml
          skip_path: /flowforge/charts/
          framework: helm
          output_format: cli,sarif
          output_file_path: console,results.sarif
          soft_fail: true
        env: 
          HELM_NAMESPACE: no-default-namespace

      - name: Template chart
        # temporary disabled due to https://github.com/zegl/kube-score/issues/559
        if: false
        run: |
          helm template flowforge ./helm/flowforge --set forge.domain=example.com > ${{ github.workspace }}/templated_chart.yaml
      
      - name: Install kube-score
        # temporary disabled due to https://github.com/zegl/kube-score/issues/559
        if: false
        uses: yokawasa/action-setup-kube-tools@v0.11.2
        with:
          setup-tools: "kube-score"
          kube-score: '1.17.0'
  
      - name: Scan chart with kube-score
        # temporary disabled due to https://github.com/zegl/kube-score/issues/559
        if: false
        continue-on-error: true
        run:
          kube-score score ${{ github.workspace }}/templated_chart.yaml --output-format sarif > results.sarif

      - name: "Upload SARIF file"
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif