From 79f9260f5638d2e60c94bb7baafa020834e23e92 Mon Sep 17 00:00:00 2001 From: jklein Date: Fri, 21 Aug 2026 16:55:47 +0200 Subject: [PATCH 1/4] Add PR pipeline validating changed helm charts On every pull request, detect which chart directories were touched and run helm lint --strict, helm package, and a chart-version bump check for exactly those charts. PRs without chart changes skip the build. Fixes #5 --- .github/workflows/validate-charts.yml | 69 +++++++++++++++++++++++++++ 1 file changed, 69 insertions(+) create mode 100644 .github/workflows/validate-charts.yml diff --git a/.github/workflows/validate-charts.yml b/.github/workflows/validate-charts.yml new file mode 100644 index 0000000..a8f85a5 --- /dev/null +++ b/.github/workflows/validate-charts.yml @@ -0,0 +1,69 @@ +name: Validate Helm Charts +on: + pull_request: + +jobs: + detect-changed-charts: + name: Detect changed charts + runs-on: ubuntu-latest + outputs: + charts: ${{ steps.detect.outputs.charts }} + any: ${{ steps.detect.outputs.any }} + steps: + - name: "Checkout Repository" + uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: "Detect changed charts" + id: detect + run: | + CHARTS="[]" + CHANGED_DIRS=$(git diff --name-only "origin/${{ github.base_ref }}...HEAD" | cut -d/ -f1 | sort -u) + for DIR in $CHANGED_DIRS; do + if [ -f "$DIR/Chart.yaml" ]; then + CHARTS=$(echo "$CHARTS" | jq -c --arg dir "$DIR" '. + [$dir]') + fi + done + echo "charts=$CHARTS" >> "$GITHUB_OUTPUT" + if [ "$CHARTS" = "[]" ]; then + echo "any=false" >> "$GITHUB_OUTPUT" + echo "No chart directories changed - nothing to build." + else + echo "any=true" >> "$GITHUB_OUTPUT" + echo "Changed charts: $CHARTS" + fi + + build-chart: + name: "Build ${{ matrix.chart }}" + needs: detect-changed-charts + if: needs.detect-changed-charts.outputs.any == 'true' + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + chart: ${{ fromJSON(needs.detect-changed-charts.outputs.charts) }} + steps: + - name: "Checkout Repository" + uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: "Install Helm" + uses: azure/setup-helm@v4 + - name: "Lint Helm Chart" + run: helm lint --strict "${{ matrix.chart }}" + - name: "Package Helm Chart" + run: helm package "${{ matrix.chart }}" + - name: "Check Chart Version was bumped" + # template-chart is a scaffold and never published, its version is meaningless + if: matrix.chart != 'template-chart' + run: | + BASE_VERSION=$(git show "origin/${{ github.base_ref }}:${{ matrix.chart }}/Chart.yaml" 2>/dev/null | grep '^version:' | awk '{print $2}' || true) + NEW_VERSION=$(grep '^version:' "${{ matrix.chart }}/Chart.yaml" | awk '{print $2}') + if [ -z "$BASE_VERSION" ]; then + echo "New chart (does not exist on ${{ github.base_ref }}), version: $NEW_VERSION" + elif [ "$BASE_VERSION" = "$NEW_VERSION" ]; then + echo "::error file=${{ matrix.chart }}/Chart.yaml::Chart '${{ matrix.chart }}' was modified but its version was not bumped (still $BASE_VERSION). Bump 'version:' in Chart.yaml, otherwise the publish on main will collide with the already published version." + exit 1 + else + echo "Version bump OK: $BASE_VERSION -> $NEW_VERSION" + fi From 4f40aad6c25fdb6ea01681fe3bdc88e13a234501 Mon Sep 17 00:00:00 2001 From: jklein Date: Fri, 21 Aug 2026 16:56:46 +0200 Subject: [PATCH 2/4] TEMP: touch cyberchef chart to demo validate pipeline (will be reverted) --- cyberchef/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cyberchef/Chart.yaml b/cyberchef/Chart.yaml index d1ea12c..538a647 100644 --- a/cyberchef/Chart.yaml +++ b/cyberchef/Chart.yaml @@ -4,7 +4,7 @@ description: A Helm chart to deploy Cyberchef on Kubernetes type: application -version: 1.0.0+up10.22.1 +version: 1.0.1+up10.22.1 appVersion: "10.22.1" maintainers: From 5a5c45fa4170f8b0f0b234a360b9e30d920044c1 Mon Sep 17 00:00:00 2001 From: jklein Date: Fri, 21 Aug 2026 16:57:28 +0200 Subject: [PATCH 3/4] Revert "TEMP: touch cyberchef chart to demo validate pipeline (will be reverted)" This reverts commit 4f40aad6c25fdb6ea01681fe3bdc88e13a234501. --- cyberchef/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cyberchef/Chart.yaml b/cyberchef/Chart.yaml index 538a647..d1ea12c 100644 --- a/cyberchef/Chart.yaml +++ b/cyberchef/Chart.yaml @@ -4,7 +4,7 @@ description: A Helm chart to deploy Cyberchef on Kubernetes type: application -version: 1.0.1+up10.22.1 +version: 1.0.0+up10.22.1 appVersion: "10.22.1" maintainers: From ded2f5902016a66179b3f8e71988bfa18692d3ed Mon Sep 17 00:00:00 2001 From: jklein Date: Fri, 21 Aug 2026 17:03:22 +0200 Subject: [PATCH 4/4] Rename detect job output to any-chart-changed for clarity --- .github/workflows/validate-charts.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/validate-charts.yml b/.github/workflows/validate-charts.yml index a8f85a5..d087452 100644 --- a/.github/workflows/validate-charts.yml +++ b/.github/workflows/validate-charts.yml @@ -8,7 +8,7 @@ jobs: runs-on: ubuntu-latest outputs: charts: ${{ steps.detect.outputs.charts }} - any: ${{ steps.detect.outputs.any }} + any-chart-changed: ${{ steps.detect.outputs.any-chart-changed }} steps: - name: "Checkout Repository" uses: actions/checkout@v4 @@ -26,17 +26,17 @@ jobs: done echo "charts=$CHARTS" >> "$GITHUB_OUTPUT" if [ "$CHARTS" = "[]" ]; then - echo "any=false" >> "$GITHUB_OUTPUT" + echo "any-chart-changed=false" >> "$GITHUB_OUTPUT" echo "No chart directories changed - nothing to build." else - echo "any=true" >> "$GITHUB_OUTPUT" + echo "any-chart-changed=true" >> "$GITHUB_OUTPUT" echo "Changed charts: $CHARTS" fi build-chart: name: "Build ${{ matrix.chart }}" needs: detect-changed-charts - if: needs.detect-changed-charts.outputs.any == 'true' + if: needs.detect-changed-charts.outputs.any-chart-changed == 'true' runs-on: ubuntu-latest strategy: fail-fast: false