helm-ci.yml

name: Helm CI

on:
  push:
    branches:
    - main
    paths:
    - .github/workflows/**
    - charts/**
  pull_request:
    branches:
    - main
    paths:
    - .github/workflows/**
    - charts/**

permissions: { }

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      security-events: write
    steps:
    - name: Checkout Repository
      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # tag=v4.2.1
      with:
        fetch-depth: "0"
    - name: Set up Helm
      uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # tag=v4.2.0
    - name: Set up Python
      uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # tag=v5.2.0
      with:
        python-version: "3.11"
        check-latest: true
    - name: Set up Chart Testing
      uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # tag=v2.6.1
    - name: Lint Chart
      run: ct lint --config ct.yaml
    - name: Scan for Misconfiguration
      uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # tag=v0.28.0
      with:
        scan-type: config
        format: sarif
        output: misconfig.sarif
    - name: Upload Misconfiguration Scan Results
      uses: github/codeql-action/upload-sarif@956f09c2ef1926b580554b9014cfb8a51abf89dd # tag=codeql-bundle-v2.16.6
      with:
        sarif_file: misconfig.sarif

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
    - name: Checkout Repository
      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # tag=v4.2.1
      with:
        fetch-depth: "0"
    - name: Set up Helm
      uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # tag=v4.2.0
    - name: Set up Python
      uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # tag=v5.2.0
      with:
        python-version: "3.11"
        check-latest: true
    - name: Set up Chart Testing
      uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # tag=v2.6.1
    - name: Create Kind Cluster
      uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # tag=v1.10.0
    - name: Test
      run: ct install --config ct.yaml --debug