ci: add helm lint and validate workflow#54
Open
Ri-go wants to merge 2 commits into
Open
Conversation
Runs on PRs and pushes to master when helm/ files change. Automatically discovers all values.*.yaml files and validates against each one.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughAdds a new GitHub Actions workflow Changes
Sequence Diagram(s)sequenceDiagram
participant GH as "GitHub Actions\n(runner)"
participant Repo as "Repository\n(helm/**)"
participant Helm as "Helm v3.17.3"
participant K8s as "kubectl (dry-run)"
GH->>Repo: checkout
GH->>Helm: install Helm
GH->>Helm: helm lint ./helm
GH->>Repo: find values.*.yaml / .yml
loop for each values file
GH->>Helm: helm template price-oracle ./helm -f <values-file>
Helm->>GH: rendered manifests (stdout)
GH->>K8s: kubectl apply --dry-run=client -f -
K8s-->>GH: validation result
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment Tip You can customize the high-level summary generated by CodeRabbit.Configure the |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/helm-lint.yaml (2)
3-10: Consider triggering on workflow-file changes as well.With current path filters, edits to Line 1–Line 48 alone won’t execute this workflow. Add
.github/workflows/helm-lint.yamltopathsso CI validates workflow changes too.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/helm-lint.yaml around lines 3 - 10, The workflow path filters currently only include "helm/**" so changes to this workflow file itself won't trigger the job; update the paths list in .github/workflows/helm-lint.yaml (the pull_request and push "paths" arrays) to also include ".github/workflows/helm-lint.yaml" so edits to the workflow file run the CI; modify both pull_request.paths and push.paths entries to add the workflow filepath alongside "helm/**".
42-48: Pin/installkubectlexplicitly for reproducible CI behavior.Validation currently depends on whatever
kubectlversionubuntu-latestprovides. That drift can cause non-deterministic failures; set up a fixed kubectl version in this workflow before Line 42.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/helm-lint.yaml around lines 42 - 48, The workflow step "Validate rendered manifests" currently relies on the runner's implicit kubectl; add an explicit installation step before that step to pin a kubectl version (e.g., use actions/setup-kubectl or azure/setup-kubectl with kubectl-version: '1.26.0' or another chosen semver) so the subsequent helm template | kubectl apply --dry-run=client command uses a known kubectl; implement the new step immediately before the "Validate rendered manifests" step and reference the same job context so the "kubectl apply --dry-run=client" invocation runs against the pinned kubectl binary.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/helm-lint.yaml:
- Around line 26-33: The "Find values files" step (id: values) currently writes
whatever find returns to GITHUB_OUTPUT but doesn't fail if none are found; after
capturing files into the variable named files, add an explicit non-empty check
(e.g., test if "$files" is empty) and if empty call exit 1 or use gh action
failure to stop the job, logging a clear message to indicate no
values.*.yaml/yml files were discovered so downstream template/validate loops
don't silently become no-ops.
- Around line 42-48: Add strict shell options to the validation step so failures
in helm template are not masked: at the start of the run block containing the
loop that echoes and runs "helm template price-oracle ./helm -f \"$f\" | kubectl
apply --dry-run=client -f -", add "set -euo pipefail" (or equivalent POSIX-safe
options) so any command error or undefined variable causes the step to fail;
ensure this is applied before the while IFS= read -r f; do ... done <<< "${{
steps.values.outputs.files }}" loop so helm template failures are preserved.
---
Nitpick comments:
In @.github/workflows/helm-lint.yaml:
- Around line 3-10: The workflow path filters currently only include "helm/**"
so changes to this workflow file itself won't trigger the job; update the paths
list in .github/workflows/helm-lint.yaml (the pull_request and push "paths"
arrays) to also include ".github/workflows/helm-lint.yaml" so edits to the
workflow file run the CI; modify both pull_request.paths and push.paths entries
to add the workflow filepath alongside "helm/**".
- Around line 42-48: The workflow step "Validate rendered manifests" currently
relies on the runner's implicit kubectl; add an explicit installation step
before that step to pin a kubectl version (e.g., use actions/setup-kubectl or
azure/setup-kubectl with kubectl-version: '1.26.0' or another chosen semver) so
the subsequent helm template | kubectl apply --dry-run=client command uses a
known kubectl; implement the new step immediately before the "Validate rendered
manifests" step and reference the same job context so the "kubectl apply
--dry-run=client" invocation runs against the pinned kubectl binary.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: cc4e91f9-7563-4e14-ba38-0950c1a09998
📒 Files selected for processing (1)
.github/workflows/helm-lint.yaml
Comment on lines
+26
to
+33
| - name: Find values files | ||
| id: values | ||
| run: | | ||
| files=$(find ./helm -name 'values.*.yaml' -o -name 'values.*.yml' | sort) | ||
| echo "files<<EOF" >> "$GITHUB_OUTPUT" | ||
| echo "$files" >> "$GITHUB_OUTPUT" | ||
| echo "EOF" >> "$GITHUB_OUTPUT" | ||
|
|
There was a problem hiding this comment.
Fail fast when no values files are discovered.
If find returns nothing, template/validate loops become no-ops and the job still passes. Add an explicit non-empty check after Line 29.
Suggested patch
- name: Find values files
id: values
run: |
files=$(find ./helm -name 'values.*.yaml' -o -name 'values.*.yml' | sort)
+ if [ -z "$files" ]; then
+ echo "No values.*.yaml or values.*.yml files found under ./helm" >&2
+ exit 1
+ fi
echo "files<<EOF" >> "$GITHUB_OUTPUT"
echo "$files" >> "$GITHUB_OUTPUT"
echo "EOF" >> "$GITHUB_OUTPUT"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/helm-lint.yaml around lines 26 - 33, The "Find values
files" step (id: values) currently writes whatever find returns to GITHUB_OUTPUT
but doesn't fail if none are found; after capturing files into the variable
named files, add an explicit non-empty check (e.g., test if "$files" is empty)
and if empty call exit 1 or use gh action failure to stop the job, logging a
clear message to indicate no values.*.yaml/yml files were discovered so
downstream template/validate loops don't silently become no-ops.
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
masterwhenhelm/**files changevalues.*.yamlfiles so future environments are covered without workflow changeskubectl apply --dry-run=clientto validate rendered manifestsTest plan
values.testnet.yamlSummary by CodeRabbit