jklein
5be10251f4
Validate Helm Charts / Detect changed charts (pull_request) Successful in 3s
Validate Helm Charts / Resource quantities (pull_request) Successful in 7s
Validate Helm Charts / Build ${{ fromJSON(needs.detect-changed-charts.outputs.charts) }} (pull_request) Successful in 3s
Validate Helm Charts / Trivy config ${{ fromJSON(needs.detect-changed-charts.outputs.scan-charts) }} (pull_request) Successful in 10s
Install-test / Install-test ${{ fromJSON(inputs.charts) }} (pull_request) Successful in 2m35s
Validate Helm Charts / Install-test (pull_request) Successful in 2m35s
ConvertX is a self-hosted file converter with a web UI. StatefulSet with one replica, a PVC at /app/data holding the SQLite database, the uploads and the converted output, a ClusterIP Service and the standard Ingress. No external database, cache or object storage. The chart runs non-root as uid/gid 1000 and bypasses the image entrypoint. The image carries no USER, so it starts as root, and /entrypoint.sh exists only to drop to uid 1000 with gosu. Overriding command with the image's own CMD lets Kubernetes do that work instead - runAsUser/runAsGroup 1000 and fsGroup in place of the entrypoint's recursive chown - so the repo's hardening baseline stays intact rather than being relaxed for this image. What that costs is named at the command: line in the StatefulSet: if upstream ever moves real work into the entrypoint, this chart skips it silently, with no error and no failed probe. The entrypoint of v0.19.0 does nothing but uid/gid plumbing (and with PUID unset its first branch is already a plain exec "$@"), and ConvertX migrates its SQLite schema in-process at import, so the bypass is safe today. It is to be re-read at every app-version update. The one line the bypass does lose is "export HOME=/home/convertx", so the chart sets HOME itself instead of relying on the runtime's passwd lookup, and mounts an emptyDir there: LibreOffice, Calibre, Inkscape and fontconfig build their profiles under HOME on the first conversion, and it sits on the read-only root filesystem. /tmp is the second emptyDir, for the toolchain's scratch files. Both count against the container's ephemeral-storage limit, which is why that request is sized for them. uid 1000 rather than the repo's arbitrary 20000, deliberately: the image owns /home/convertx with it, and the uid owns data on a PersistentVolume, so the number is not free to tidy later. The fallback defaults in _helpers.tpl reproduce the deviation rather than the repo standard. All three probes use /healthcheck, a static 200 that the application exempts from authentication. "/" is never a 200 with this chart's defaults: it answers 302 to /setup while no account exists and to /login afterwards, so a probe against it would pass on a redirect whose meaning changes on day two. The startup budget is 300s because ConvertX shells out to ~20 converter binaries at import just to log their versions. Values: - secrets.jwtSecretRef, required, field "jwt-secret". Without JWT_SECRET the application mints a random one per process, so every restart invalidates every session - silently. - accountRegistration, allowUnauthenticated and httpAllowed, all false. Upstream warns explicitly against the first two on an internet-facing instance; the warning is carried into values.yaml and NOTES.txt. They go through a helper that renders the literal "true"/"false" the application's strict comparison needs and aborts the render on anything else - "yes" would otherwise be filed under "off" without a word. - autoDeleteEveryNHours, default 24, 0 disables. It governs retention on the PVC. The 0 is honoured through an explicit nil check; Helm's "default" would swallow it and restore 24-hour deletion on the install that asked for none. - ingress.maxUploadFileSize, default 1024m. ConvertX enforces no size limit of its own (maxRequestBodySize is MAX_SAFE_INTEGER), so unlike outline there is exactly one ceiling here and this is it. Switching the Ingress off frees BOTH domain and clusterIssuer, checked in both directions: ConvertX has no base-URL, public-URL or redirect-URI variable, so nothing outside the Ingress reads the domain. WEBROOT is deliberately not a value. It shifts every route including /healthcheck, which would break all three probes while the application stayed healthy, and this chart's Ingress still maps "/". PUID/PGID/UMASK are not values either - they configure the bypassed entrypoint and nothing else. Wiring: publish-convertx.yml, the change-app-version.yml choice list, ci/convertx/ (test-values, the JWT Secret fixture the stub OnePasswordItem CRD cannot materialize, and INSTALL_TIMEOUT=900 for a ~1.4 GiB image), a renovate.json5 block anchored on the v prefix so the moving latest, main and pr-<n> tags cannot be selected, and the README chart row. Verified locally: helm lint --strict clean, render against the CI fixtures, the null-safe fallbacks for every erased block, the resource-quantity render test, and NOTES.txt through the define/ConfigMap trick since helm template does not render it. Runtime behaviour is unverified here - this workspace has no Docker daemon and no k3d, so the PR install-test is the only runtime proof.
108 lines
3.9 KiB
YAML
108 lines
3.9 KiB
YAML
name: Change App-Version
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
app-version:
|
|
required: true
|
|
type: string
|
|
description: "change the version of the underlying application"
|
|
chart-location:
|
|
required: false
|
|
type: string
|
|
default: "."
|
|
description: "location of the helm chart"
|
|
chart-name:
|
|
required: true
|
|
type: choice
|
|
description: "helm chart to be updated"
|
|
options:
|
|
- zipline
|
|
- calibre-web-automated
|
|
- samba
|
|
- teamspeak-server
|
|
- urlaubsverwaltung
|
|
- apache-tika
|
|
- gotenberg
|
|
- homeassistant
|
|
- satisfactory
|
|
- cyberchef
|
|
- matrix-synapse
|
|
- outline
|
|
- paperless-ngx
|
|
- patchmon
|
|
- rallly
|
|
- voucher-vault
|
|
- minecraft-router
|
|
- minecraft-server
|
|
- rss-bridge
|
|
- searxng
|
|
- bentopdf
|
|
- ytdlp-web-player
|
|
- sure
|
|
- valkey
|
|
- convertx
|
|
# freesailarr is deliberately absent: none of its ten images takes
|
|
# its tag from appVersion (they are all pinned in its values.yaml),
|
|
# so this workflow would rewrite appVersion and republish the chart
|
|
# without changing a single deployed image. Update its images through
|
|
# a Renovate PR, and its appVersion by hand.
|
|
workflow_call:
|
|
inputs:
|
|
app-version:
|
|
required: true
|
|
type: string
|
|
description: "change the version of the underlying application"
|
|
chart-location:
|
|
required: false
|
|
type: string
|
|
default: "."
|
|
description: "location of the helm chart"
|
|
chart-name:
|
|
required: true
|
|
type: string
|
|
description: "name of the helm chart"
|
|
|
|
jobs:
|
|
change-app-version:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: "Configure OP-Connect"
|
|
uses: 1password/load-secrets-action/configure@v5
|
|
with:
|
|
connect-host: https://op-connect.jk-dev.de
|
|
- name: "Load GitHub Credentials"
|
|
id: load-jk-cluster-bot-creds
|
|
uses: 1password/load-secrets-action@v5
|
|
env:
|
|
OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
|
|
JK_CLUSTER_BOT_TOKEN: op://GitHub-Actions/github-helm-charts-push-token/credential
|
|
JK_CLUSTER_USERNAME: op://GitHub-Actions/github-helm-charts-push-token/username
|
|
JK_CLUSTER_EMAIL: op://GitHub-Actions/github-helm-charts-push-token/email
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
token: ${{ env.JK_CLUSTER_BOT_TOKEN }}
|
|
- name: "Get Chart Version"
|
|
run: |
|
|
CHART_VERSION=$(grep '^version:' ${{ inputs.chart-name }}/Chart.yaml | awk '{print $2}')
|
|
CHART_PART=$(echo $CHART_VERSION | cut -d'+' -f1)
|
|
echo "CHART_VERSION=$CHART_PART" >> $GITHUB_ENV
|
|
working-directory: ${{ inputs.chart-location }}
|
|
- name: "Get new Chart Version"
|
|
run: |
|
|
APP_VERSION_NORMALIZED=$(echo "${{ inputs.app-version }}" | tr '-' '.')
|
|
NEW_VERSION="${CHART_VERSION}+up${APP_VERSION_NORMALIZED}"
|
|
sed -i "s/^version:.*/version: $NEW_VERSION/" ${{ inputs.chart-name }}/Chart.yaml
|
|
sed -i "s/^appVersion:.*/appVersion: ${{ inputs.app-version }}/" ${{ inputs.chart-name }}/Chart.yaml
|
|
working-directory: ${{ inputs.chart-location }}
|
|
- name: "View chart-directory contents"
|
|
run: ls -al
|
|
working-directory: ${{ inputs.chart-location }}
|
|
- name: "View helm-chart.yaml"
|
|
run: cat Chart.yaml
|
|
working-directory: ${{ inputs.chart-location }}/${{ inputs.chart-name }}
|
|
- name: Commit and Push Changes
|
|
run: |
|
|
git config --global user.name '${{ env.JK_CLUSTER_USERNAME }}'
|
|
git config --global user.email '${{ env.JK_CLUSTER_EMAIL }}'
|
|
git commit -am "Updated ${{ inputs.chart-name }} application version to ${{ inputs.app-version }}"
|
|
git push |