helm.yml

name: Helm chart

# Lint and schema-validate the Kubernetes Helm chart. Runs only when the chart (or this
# workflow) changes, so it stays out of the way of pure-Python PRs.
on:
  push:
    branches: [master]
    paths:
      - "deploy/helm/**"
      - ".github/workflows/helm.yml"
  pull_request:
    branches: [master]
    paths:
      - "deploy/helm/**"
      - ".github/workflows/helm.yml"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: helm-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CHART: deploy/helm/coderag
  KUBECONFORM_VERSION: "0.6.7"

jobs:
  lint-and-validate:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Set up Helm
        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
        with:
          version: v3.16.4

      - name: Helm lint (default + full value sets)
        run: |
          helm lint "$CHART" -f "$CHART/ci/default-values.yaml"
          helm lint "$CHART" -f "$CHART/ci/full-values.yaml"

      - name: Install kubeconform
        run: |
          curl -fsSL \
            "https://github.com/yannh/kubeconform/releases/download/v${KUBECONFORM_VERSION}/kubeconform-linux-amd64.tar.gz" \
            | tar -xz -C /usr/local/bin kubeconform
          kubeconform -v

      - name: Render and schema-validate
        run: |
          # Standalone: the chart must render and install with zero required config.
          echo "::group::standalone defaults (no values)"
          helm template coderag "$CHART" | kubeconform -strict -summary -kubernetes-version 1.29.0
          echo "::endgroup::"
          for values in default full; do
            for kube in 1.27.0 1.29.0 1.31.0; do
              echo "::group::$values values @ k8s $kube"
              helm template coderag "$CHART" -f "$CHART/ci/${values}-values.yaml" \
                | kubeconform -strict -summary -kubernetes-version "$kube"
              echo "::endgroup::"
            done
          done