fix(helm): modernize chart and add CI validation

.github/workflows/helm.yml

@@ -0,0 +1,57 @@
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'charts/open-catalog-api/**'
+      - '.github/workflows/helm.yml'
+      - 'go.mod'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'charts/open-catalog-api/**'
+      - '.github/workflows/helm.yml'
+      - 'go.mod'
+
+permissions: {}
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+        with:
+          version: v3.21.4
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: false
+      - name: Lint the chart
+        run: |
+          helm lint --strict charts/open-catalog-api \
+            --set autoscaling.enabled=true \
+            --set autoscaling.targetMemoryUtilizationPercentage=75 \
+            --set ingress.enabled=true \
+            --set maxRequests=100
+      - name: Render and validate the Kubernetes resources
+        run: |
+          kubernetes_versions=(1.23.0 1.34.0)
+          for kubernetes_version in "${kubernetes_versions[@]}"; do
+            manifest="$RUNNER_TEMP/open-catalog-api-$kubernetes_version.yaml"
+            helm template ci charts/open-catalog-api \
+              --kube-version "$kubernetes_version" \
+              --set autoscaling.enabled=true \
+              --set autoscaling.targetMemoryUtilizationPercentage=75 \
+              --set ingress.enabled=true \
+              --set maxRequests=100 \
+              > "$manifest"
+            go run github.com/yannh/kubeconform/cmd/kubeconform@v0.8.0 \
+              -kubernetes-version "$kubernetes_version" \
+              -strict \
+              -summary \
+              "$manifest"
+          done

.github/workflows/publish-staging-docker-image.yml

@@ -50,7 +50,7 @@ jobs:
         run: docker buildx create --name "$BUILDX_BUILDER"
 
       - # Tag with a temporary valid semantic version. This is required by goreleaser.
-        run: git tag v0-main-$(git rev-parse --short HEAD)
+        run: git tag "v0-main-$(git rev-parse --short HEAD)"
 
       - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:

.github/workflows/release-chart.yml

@@ -19,7 +19,7 @@ jobs:
           persist-credentials: false
       - name: Get version
         id: get_version
-        run: echo "::set-output name=version::${GITHUB_REF_NAME#helm/}"
+        run: echo "version=${GITHUB_REF_NAME#helm/}" >> "$GITHUB_OUTPUT"
       - name: Push chart to GitHub Container Registry
         uses: appany/helm-oci-chart-releaser@d94988c92bed2e09c6113981f15f8bb495d10943 # v0.5.0
         with:

.github/workflows/supply-chain.yml

@@ -7,6 +7,21 @@ on:
 permissions: {}
 
 jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: false
+      - name: Lint GitHub Actions workflows
+        run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 -no-color
+
   pin-lint:
     runs-on: ubuntu-latest
     permissions:

.github/workflows/tests-added.yml

@@ -35,6 +35,8 @@ jobs:
             echo
             echo "This pull request changes Go code without touching any \`*_test.go\` file:"
             echo
+            # The dollar sign is a sed end-of-line anchor, not shell expansion.
+            # shellcheck disable=SC2016
             printf '%s\n' "$code" | sed 's/^/- \`/;s/$/\`/'
             echo
             echo "Add a test, or set the \`no-test-needed\` label when the change"

CHANGELOG.md

@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - A security policy, `SECURITY.md`, saying how to report a vulnerability
   privately and which versions get fixes.
+- CI checks for the Helm chart with `helm lint` and `kubeconform`, and for
+  GitHub Actions workflows with `actionlint`.
 
 ### Changed
 
@@ -20,6 +22,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- The Helm chart now renders a valid `autoscaling/v2` HPA and quotes the
+  numeric `MAX_REQUESTS` environment value.
 - A JSON Patch replacing the `id` of a software answered `200` but did
   not save the software.
 - A JSON Patch could store a malformed URL or email. The patched entity

charts/open-catalog-api/Chart.yaml

@@ -12,15 +12,18 @@ description: RESTful API for public administration Open Source catalogs
 # pipeline. Library charts do not define any templates and therefore cannot be deployed.
 type: application
 
+# autoscaling/v2, used by this chart, is available from Kubernetes 1.23.
+kubeVersion: ">=1.23.0-0"
+
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v0.6.0
+version: 0.7.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v1.3.0"
+appVersion: "v1.4.0"
 
 icon: https://avatars.githubusercontent.com/u/53046106?s=96&v=4

charts/open-catalog-api/README.md

@@ -1,6 +1,6 @@
 # open-catalog-api
 
-![Version: v0.4.0](https://img.shields.io/badge/Version-v0.4.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.1.0](https://img.shields.io/badge/AppVersion-v1.1.0-informational?style=flat-square)
+![Version: 0.7.0](https://img.shields.io/badge/Version-0.7.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.4.0](https://img.shields.io/badge/AppVersion-v1.4.0-informational?style=flat-square)
 
 RESTful API for public administration Open Source catalogs
 

charts/open-catalog-api/templates/deployment.yaml

@@ -51,7 +51,7 @@ spec:
                   key: databaseDSN
             {{- if .Values.maxRequests }}
             - name: MAX_REQUESTS
-              value: {{ .Values.maxRequests }}
+              value: {{ .Values.maxRequests | quote }}
             {{- end }}
             - name: PASETO_KEY
               valueFrom:
@@ -87,4 +87,4 @@ spec:
       {{- if .Values.extraVolumes }}
       volumes:
         {{- toYaml .Values.extraVolumes | nindent 8 }}
-      {{- end }}
+      {{- end }}

charts/open-catalog-api/templates/hpa.yaml

@@ -1,5 +1,5 @@
 {{- if .Values.autoscaling.enabled }}
-apiVersion: autoscaling/v2beta1
+apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   name: {{ include "open-catalog-api.fullname" . }}
@@ -17,12 +17,16 @@ spec:
     - type: Resource
       resource:
         name: cpu
-        targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
     {{- end }}
     {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
     - type: Resource
       resource:
         name: memory
-        targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
     {{- end }}
 {{- end }}