validate.yaml

name: Validate Helm Charts

on:
  workflow_call:
    inputs:
      chart_dir:
        description: Directory containing the charts to validate.
        type: string
        required: false
        default: charts
      excluded_charts:
        description: Charts to exclude from validation.
        type: string
        required: false
        default: ""
      target_branch:
        description: Target branch for charts.
        type: string
        required: false
        default: main
      helm_repos:
        description: List of Helm repos to install; as a comma separated list in the format `<name>=<address>`.
        type: string
        required: false
        default: ""
      helm_docs:
        description: If helm-docs should be run.
        type: boolean
        required: false
        default: false
      helm_docs_args:
        description: Args for the helm-docs command.
        type: string
        required: false
        default: ""
      changelog:
        description: If the CHANGELOG needs to be validated.
        type: boolean
        required: false
        default: false
      ah_lint:
        description: If the Artifact Hub linter should be run.
        type: boolean
        required: false
        default: true
      kubeconform:
        description: If the Kubeconform should be run.
        type: boolean
        required: false
        default: true
      kubeconform_k8s_versions:
        description: List of Kubernetes versions to use for Kubeconform; as a comma separated list in the format `<major>.<minor>.<patch>`.
        type: string
        required: false
        default: ""
      kubeconform_skip:
        description: List of Kubeconform schemas to skip; as a comma separated list of kinds or GVKs.
        type: string
        required: false
        default: ""
      helm_extra_args:
        description: Extra arguments to pass to Helm as part of chart testing.
        type: string
        required: false
        default: ""

jobs:
  validate:
    name: Validate Helm charts
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      pull-requests: write
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Install Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          token: ${{ github.token }}
          python-version: "3.x"

      - name: Install Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
        with:
          version: latest

      - name: Configure Helm repos
        if: ${{ inputs.helm_repos }}
        run: |
          set -euo pipefail

          repos="${{ inputs.helm_repos }}"
          for repo in ${repos//,/ }
          do
            helm repo add "${repo%=*}" "${repo#*=}"
          done

      - name: Install chart-testing
        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0

      - name: Check for changes
        id: changes
        run: |
          set -euo pipefail
          changed="$(ct list-changed --target-branch=${{ inputs.target_branch }} --chart-dirs=${{ inputs.chart_dir }} --excluded-charts=${{ inputs.excluded_charts }})"
          if [[ -n "${changed}" ]]
          then
            echo "changed=true" >> "${GITHUB_OUTPUT}"
            echo "charts=$(echo "${changed}" | tr '\n' ',' | rev | cut -c 2- | rev | jq -Rrc '[split(",") | .[] | split("/") | .[1]] | join(",")')" >> "${GITHUB_OUTPUT}"
          else
            echo "changed=false" >> "${GITHUB_OUTPUT}"
            echo "charts=" >> "${GITHUB_OUTPUT}"
          fi

      - name: Install Helm Docs
        uses: action-stars/install-tool-from-github-release@1fa61c3bea52eca3bcdb1f5c961a3b113fe7fa54 # v0.2.6
        if: ${{ inputs.helm_docs && steps.changes.outputs.changed == 'true' }}
        with:
          github_token: ${{ github.token }}
          owner: norwoodj
          repository: helm-docs
          arch_amd64: x86_64
          os_linux: Linux
          check_command: helm-docs --version
          version: latest

      - name: Run Helm Docs check
        if: ${{ inputs.helm_docs && steps.changes.outputs.changed == 'true' }}
        run: |
          set -euo pipefail

          helm-docs ${{ inputs.helm_docs_args }}
          if [[ -n "$(git status --porcelain --untracked-files=no)" ]]
          then
            echo "Documentation not up to date; please run helm-docs and commit changes!" >&2
            exit 1
          fi

      - name: Install YQ
        uses: action-stars/install-tool-from-github-release@1fa61c3bea52eca3bcdb1f5c961a3b113fe7fa54 # v0.2.6
        if: ${{ inputs.changelog && steps.changes.outputs.changed == 'true' }}
        with:
          github_token: ${{ github.token }}
          owner: mikefarah
          repository: yq
          extract: false
          filename_format: "{name}_{os}_{arch}"
          check_command: yq --version
          version: latest

      - name: Install MDQ
        uses: action-stars/install-tool-from-github-release@1fa61c3bea52eca3bcdb1f5c961a3b113fe7fa54 # v0.2.6
        if: ${{ inputs.changelog && steps.changes.outputs.changed == 'true' }}
        with:
          github_token: ${{ github.token }}
          owner: yshavit
          repository: mdq
          arch_amd64: x64
          filename_format: "{name}-{os}-{arch}.{ext}"
          check_command: mdq --version
          version: latest

      - name: Run CHANGELOG check
        if: ${{ inputs.changelog && steps.changes.outputs.changed == 'true' }}
        run: |
          set -euo pipefail

          charts="${{ steps.changes.outputs.charts }}"
          for chart in ${charts//,/ }
          do
            chart_file_path="./${{ inputs.chart_dir }}/${chart}/Chart.yaml"
            changelog_file_path="./${{ inputs.chart_dir }}/${chart}/CHANGELOG.md"
            version="$(yq eval '.version' "${chart_file_path}")"
            entry="$(mdq --no-br --link-format inline "# v${version}" <"${changelog_file_path}" || true)"
            if [[ -z "${entry}" ]]
            then
              echo "No CHANGELOG entry for ${chart} version ${version}!" >&2
              exit 1
            fi

            added="$(mdq --output plain "# v${version} | # Added | -" <"${changelog_file_path}" || true)"
            changed="$(mdq --output plain "# v${version} | # Changed | -" <"${changelog_file_path}" || true)"
            deprecated="$(mdq --output plain "# v${version} | # Deprecated | -" <"${changelog_file_path}" || true)"
            removed="$(mdq --output plain "# v${version} | # Removed | -" <"${changelog_file_path}" || true)"
            fixed="$(mdq --output plain "# v${version} | # Fixed | -" <"${changelog_file_path}" || true)"
            security="$(mdq --output plain "# v${version} | # Security | -" <"${changelog_file_path}" || true)"

            changes_path="./${{ inputs.chart_dir }}/${chart}/changes.txt"
            rm -f "${changes_path}"

            old_ifs="${IFS}"
            IFS=$'\n'

            for item in ${added}; do
              printf -- '- kind: added\n  description: "%s"\n' "${item%.*}." >> "${changes_path}"
            done

            for item in ${changed}; do
              printf -- '- kind: changed\n  description: "%s"\n' "${item%.*}." >> "${changes_path}"
            done

            for item in ${deprecated}; do
              printf -- '- kind: deprecated\n  description: "%s"\n' "${item%.*}." >> "${changes_path}"
            done

            for item in ${removed}; do
              printf -- '- kind: removed\n  description: "%s"\n' "${item%.*}." >> "${changes_path}"
            done

            for item in ${fixed}; do
              printf -- '- kind: fixed\n  description: "%s"\n' "${item%.*}." >> "${changes_path}"
            done

            for item in ${security}; do
              printf -- '- kind: security\n  description: "%s"\n' "${item%.*}." >> "${changes_path}"
            done

            IFS="${old_ifs}"

            if [[ -f "${changes_path}" ]]; then
              echo "::group::Changes"
              cat "${changes_path}"
              echo "::endgroup::"

              changes="$(cat "${changes_path}")" yq eval --inplace '.annotations["artifacthub.io/changes"] |= strenv(changes)' "${chart_file_path}"
              rm -f "${changes_path}"
            fi
          done

      - name: Install Artifact Hub CLI
        uses: action-stars/install-tool-from-github-release@1fa61c3bea52eca3bcdb1f5c961a3b113fe7fa54 # v0.2.6
        if: ${{ inputs.ah_lint && steps.changes.outputs.changed == 'true' }}
        with:
          github_token: ${{ github.token }}
          owner: artifacthub
          repository: hub
          name: ah
          check_command: ah version
          version: latest

      - name: Run Artifact Hub lint
        if: ${{ inputs.ah_lint && steps.changes.outputs.changed == 'true' }}
        run: ah lint --kind helm || exit 1

      - name: Run chart-testing lint
        if: ${{ steps.changes.outputs.changed == 'true' }}
        run: ct lint --target-branch=${{ inputs.target_branch }} --chart-dirs=${{ inputs.chart_dir }} --excluded-charts=${{ inputs.excluded_charts }} --check-version-increment=false --chart-repos="${{ inputs.helm_repos }}"

      - name: Install Kubeconform
        uses: action-stars/install-tool-from-github-release@1fa61c3bea52eca3bcdb1f5c961a3b113fe7fa54 # v0.2.6
        if: ${{ inputs.kubeconform && steps.changes.outputs.changed == 'true' }}
        with:
          github_token: ${{ github.token }}
          owner: yannh
          repository: kubeconform
          filename_format: "{name}-{os}-{arch}.{ext}"
          check_command: kubeconform -v
          version: latest

      - name: Run Kubeconform
        if: ${{ inputs.kubeconform && steps.changes.outputs.changed == 'true' }}
        run: |
          set -euo pipefail

          charts="${{ steps.changes.outputs.charts }}"
          for chart in ${charts//,/ }
          do
            values="./${{ inputs.chart_dir }}/${chart}/ci/kubeconform.yaml"
            if [[ ! -f "${values}" ]]
            then
              values="./${{ inputs.chart_dir }}/${chart}/test-values.yaml"
              touch "${values}"
            fi

            k8s_version_stable="$(curl -sL https://dl.k8s.io/release/stable.txt | grep -Eo '[0-9]+\.[0-9]+').0"
            k8s_versions_in="${{ inputs.kubeconform_k8s_versions }}"
            k8s_versions="${k8s_versions_in:-$k8s_version_stable}"
            for k8s_version in ${k8s_versions//,/ }
            do
              echo "Chart: ${chart}, K8s: ${k8s_version}"
              helm template --kube-version "${k8s_version}" "./${{ inputs.chart_dir }}/${chart}" --values "${values}" | kubeconform --kubernetes-version "${k8s_version}" --schema-location default --schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' --schema-location 'https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/{{.NormalizedKubernetesVersion}}/{{.ResourceKind}}.json' --skip "${{ inputs.kubeconform_skip }}" --strict --summary
            done
          done

      - name: Create Kind cluster
        if: ${{ steps.changes.outputs.changed == 'true' }}
        uses: helm/kind-action@92086f6be054225fa813e0a4b13787fc9088faab # v1.13.0

      - name: Run chart-testing install
        if: ${{ steps.changes.outputs.changed == 'true' }}
        run: ct install --target-branch=${{ inputs.target_branch }} --chart-dirs=${{ inputs.chart_dir }} --excluded-charts=${{ inputs.excluded_charts }} --helm-extra-args="${{ inputs.helm_extra_args }}" --chart-repos="${{ inputs.helm_repos }}"