helm-ci.yml

name: Helm CI

on:
  push:
    branches:
    - main
    paths:
    - .github/workflows/**
    - charts/**
  pull_request:
    branches:
    - main
    paths:
    - .github/workflows/**
    - charts/**

permissions: { }

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      security-events: write
    steps:
    - name: Checkout Repository
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
      with:
        fetch-depth: "0"
    - name: Set up Helm
      uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # tag=v4.2.0
    - name: Set up Python
      uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # tag=v5.1.1
      with:
        python-version: "3.11"
        check-latest: true
    - name: Set up Chart Testing
      uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # tag=v2.6.1
    - name: Lint Chart
      run: ct lint --config ct.yaml
    - name: Scan for Misconfiguration
      uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # tag=v0.24.0
      with:
        scan-type: config
        format: sarif
        output: misconfig.sarif
    - name: Upload Misconfiguration Scan Results
      uses: github/codeql-action/upload-sarif@956f09c2ef1926b580554b9014cfb8a51abf89dd # tag=codeql-bundle-v2.16.6
      with:
        sarif_file: misconfig.sarif

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
    - name: Checkout Repository
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
      with:
        fetch-depth: "0"
    - name: Set up Helm
      uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # tag=v4.2.0
    - name: Set up Python
      uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # tag=v5.1.1
      with:
        python-version: "3.11"
        check-latest: true
    - name: Set up Chart Testing
      uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # tag=v2.6.1
    - name: Create Kind Cluster
      uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # tag=v1.10.0
    - name: Test
      run: ct install --config ct.yaml --debug