From 253a8b14efe854615af1347c42e867b0d0ea2e15 Mon Sep 17 00:00:00 2001 From: Fabio Bonelli Date: Thu, 3 Sep 2026 06:59:14 +0200 Subject: [PATCH] fix(helm): modernize chart and add CI validation --- .github/workflows/helm.yml | 57 +++++++++++++++++++ .../publish-staging-docker-image.yml | 2 +- .github/workflows/release-chart.yml | 2 +- .github/workflows/supply-chain.yml | 15 +++++ .github/workflows/tests-added.yml | 2 + CHANGELOG.md | 4 ++ charts/open-catalog-api/Chart.yaml | 7 ++- charts/open-catalog-api/README.md | 2 +- .../templates/deployment.yaml | 4 +- charts/open-catalog-api/templates/hpa.yaml | 10 +++- 10 files changed, 95 insertions(+), 10 deletions(-) create mode 100644 .github/workflows/helm.yml diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml new file mode 100644 index 0000000..f90280f --- /dev/null +++ b/.github/workflows/helm.yml @@ -0,0 +1,57 @@ +on: + push: + branches: [main] + paths: + - 'charts/open-catalog-api/**' + - '.github/workflows/helm.yml' + - 'go.mod' + pull_request: + branches: [main] + paths: + - 'charts/open-catalog-api/**' + - '.github/workflows/helm.yml' + - 'go.mod' + +permissions: {} + +jobs: + lint: + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 + with: + version: v3.21.4 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + with: + go-version-file: go.mod + cache: false + - name: Lint the chart + run: | + helm lint --strict charts/open-catalog-api \ + --set autoscaling.enabled=true \ + --set autoscaling.targetMemoryUtilizationPercentage=75 \ + --set ingress.enabled=true \ + --set maxRequests=100 + - name: Render and validate the Kubernetes resources + run: | + kubernetes_versions=(1.23.0 1.34.0) + for kubernetes_version in "${kubernetes_versions[@]}"; do + manifest="$RUNNER_TEMP/open-catalog-api-$kubernetes_version.yaml" + helm template ci charts/open-catalog-api \ + --kube-version "$kubernetes_version" \ + --set autoscaling.enabled=true \ + --set autoscaling.targetMemoryUtilizationPercentage=75 \ + --set ingress.enabled=true \ + --set maxRequests=100 \ + > "$manifest" + go run github.com/yannh/kubeconform/cmd/kubeconform@v0.8.0 \ + -kubernetes-version "$kubernetes_version" \ + -strict \ + -summary \ + "$manifest" + done diff --git a/.github/workflows/publish-staging-docker-image.yml b/.github/workflows/publish-staging-docker-image.yml index 7af5ba4..ce7704a 100644 --- a/.github/workflows/publish-staging-docker-image.yml +++ b/.github/workflows/publish-staging-docker-image.yml @@ -50,7 +50,7 @@ jobs: run: docker buildx create --name "$BUILDX_BUILDER" - # Tag with a temporary valid semantic version. This is required by goreleaser. - run: git tag v0-main-$(git rev-parse --short HEAD) + run: git tag "v0-main-$(git rev-parse --short HEAD)" - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7 with: diff --git a/.github/workflows/release-chart.yml b/.github/workflows/release-chart.yml index 74c7618..7682fba 100644 --- a/.github/workflows/release-chart.yml +++ b/.github/workflows/release-chart.yml @@ -19,7 +19,7 @@ jobs: persist-credentials: false - name: Get version id: get_version - run: echo "::set-output name=version::${GITHUB_REF_NAME#helm/}" + run: echo "version=${GITHUB_REF_NAME#helm/}" >> "$GITHUB_OUTPUT" - name: Push chart to GitHub Container Registry uses: appany/helm-oci-chart-releaser@d94988c92bed2e09c6113981f15f8bb495d10943 # v0.5.0 with: diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index 2ef6c15..ec2304b 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -7,6 +7,21 @@ on: permissions: {} jobs: + actionlint: + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + with: + go-version-file: go.mod + cache: false + - name: Lint GitHub Actions workflows + run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 -no-color + pin-lint: runs-on: ubuntu-latest permissions: diff --git a/.github/workflows/tests-added.yml b/.github/workflows/tests-added.yml index caa0aa4..46e35f1 100644 --- a/.github/workflows/tests-added.yml +++ b/.github/workflows/tests-added.yml @@ -35,6 +35,8 @@ jobs: echo echo "This pull request changes Go code without touching any \`*_test.go\` file:" echo + # The dollar sign is a sed end-of-line anchor, not shell expansion. + # shellcheck disable=SC2016 printf '%s\n' "$code" | sed 's/^/- \`/;s/$/\`/' echo echo "Add a test, or set the \`no-test-needed\` label when the change" diff --git a/CHANGELOG.md b/CHANGELOG.md index a43f79a..dae34fd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - A security policy, `SECURITY.md`, saying how to report a vulnerability privately and which versions get fixes. +- CI checks for the Helm chart with `helm lint` and `kubeconform`, and for + GitHub Actions workflows with `actionlint`. ### Changed @@ -20,6 +22,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed +- The Helm chart now renders a valid `autoscaling/v2` HPA and quotes the + numeric `MAX_REQUESTS` environment value. - A JSON Patch replacing the `id` of a software answered `200` but did not save the software. - A JSON Patch could store a malformed URL or email. The patched entity diff --git a/charts/open-catalog-api/Chart.yaml b/charts/open-catalog-api/Chart.yaml index ee67e58..05f7711 100644 --- a/charts/open-catalog-api/Chart.yaml +++ b/charts/open-catalog-api/Chart.yaml @@ -12,15 +12,18 @@ description: RESTful API for public administration Open Source catalogs # pipeline. Library charts do not define any templates and therefore cannot be deployed. type: application +# autoscaling/v2, used by this chart, is available from Kubernetes 1.23. +kubeVersion: ">=1.23.0-0" + # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: v0.6.0 +version: 0.7.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "v1.3.0" +appVersion: "v1.4.0" icon: https://avatars.githubusercontent.com/u/53046106?s=96&v=4 diff --git a/charts/open-catalog-api/README.md b/charts/open-catalog-api/README.md index 2d514f8..08d0595 100644 --- a/charts/open-catalog-api/README.md +++ b/charts/open-catalog-api/README.md @@ -1,6 +1,6 @@ # open-catalog-api -![Version: v0.4.0](https://img.shields.io/badge/Version-v0.4.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.1.0](https://img.shields.io/badge/AppVersion-v1.1.0-informational?style=flat-square) +![Version: 0.7.0](https://img.shields.io/badge/Version-0.7.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.4.0](https://img.shields.io/badge/AppVersion-v1.4.0-informational?style=flat-square) RESTful API for public administration Open Source catalogs diff --git a/charts/open-catalog-api/templates/deployment.yaml b/charts/open-catalog-api/templates/deployment.yaml index 00b528b..34f81df 100644 --- a/charts/open-catalog-api/templates/deployment.yaml +++ b/charts/open-catalog-api/templates/deployment.yaml @@ -51,7 +51,7 @@ spec: key: databaseDSN {{- if .Values.maxRequests }} - name: MAX_REQUESTS - value: {{ .Values.maxRequests }} + value: {{ .Values.maxRequests | quote }} {{- end }} - name: PASETO_KEY valueFrom: @@ -87,4 +87,4 @@ spec: {{- if .Values.extraVolumes }} volumes: {{- toYaml .Values.extraVolumes | nindent 8 }} - {{- end }} \ No newline at end of file + {{- end }} diff --git a/charts/open-catalog-api/templates/hpa.yaml b/charts/open-catalog-api/templates/hpa.yaml index d75fe2e..bd269f0 100644 --- a/charts/open-catalog-api/templates/hpa.yaml +++ b/charts/open-catalog-api/templates/hpa.yaml @@ -1,5 +1,5 @@ {{- if .Values.autoscaling.enabled }} -apiVersion: autoscaling/v2beta1 +apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: {{ include "open-catalog-api.fullname" . }} @@ -17,12 +17,16 @@ spec: - type: Resource resource: name: cpu - targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + target: + type: Utilization + averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} {{- end }} {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} - type: Resource resource: name: memory - targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + target: + type: Utilization + averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} {{- end }} {{- end }}