Skip to content

feat: lint/format reusable workflows — Helm/Kustomize kubeconform gate (#11)#49

Open
ms280690 wants to merge 2 commits into
mainfrom
issue-11-lint-helm
Open

feat: lint/format reusable workflows — Helm/Kustomize kubeconform gate (#11)#49
ms280690 wants to merge 2 commits into
mainfrom
issue-11-lint-helm

Conversation

@ms280690

Copy link
Copy Markdown
Collaborator

Closes #11. Helm/Kustomize lint stage of parent #12 — completes the lint/format trio (#9 IaC, #10 app, #11 Helm).

What

File Purpose
.github/actions/kubeconform/action.yml Composite — checksum-verified kubeconform v0.8.0. Per chart: helm lint then helm template | kubeconform. Per overlay: kustomize build | kubeconform. Vendored subcharts pruned.
.github/workflows/lint-helm.yml Reusable gate. Inputs: charts-dir, kustomize-dir, kubernetes-version, ignore-missing-schemas, actions-ref.
.github/workflows/ci.yml kubeconform dogfood (smoke test — no charts here).
examples/helm.pre-commit-config.yaml Reference local config (helm lint, SHA-pinned).
README.md, docs/approved-actions.md Usage, CRD ignore-missing-schemas note, tooling tracking.

Acceptance criteria (#11)

  • Per chart under charts-dir: helm lint then helm template | kubeconform
  • Per overlay under kustomize-dir: kustomize build | kubeconform
  • charts-dir, kustomize-dir, kubernetes-version inputs
  • Blocks on any schema validation error
  • README documents ignore-missing-schemas for CRDs
  • Tested against prescient-platform-applications/charts/needs a real run (see below)

Design notes

  • Checksum-verified binary, consistent with gitleaks/trufflehog/megalinter/tflint. No new org-allowlist publisher. helm/kustomize are preinstalled on runners.
  • Vendored subcharts pruned (find -mindepth 1 -type d -name charts -prune) — they're rendered by the parent helm template, not standalone.
  • Job-level error annotations (not inline) — rendered manifests have no source-line mapping.
  • Reusable workflow omits harden-runner; immutable actions-ref self-reference pattern.

Verified

Locally on a helm create demo chart: checksum verify, helm lint, render, kubeconform validate (valid→0, invalid→1, -ignore-missing-schemas works), and the subchart prune. Not yet run against real charts — recommend validating against prescient-platform-applications/charts/ before merge.

🤖 Generated with Claude Code

…e (issue #11)

Helm/Kustomize lint stage of parent #12. Completes the lint/format trio
(#9 IaC, #10 app, #11 Helm).

- .github/actions/kubeconform: composite that installs a pinned,
  checksum-verified kubeconform v0.8.0 binary. For each chart under charts-dir
  it runs `helm lint` then `helm template | kubeconform`; for each overlay
  under kustomize-dir it runs `kustomize build | kubeconform`. Vendored
  subcharts (<chart>/charts/*) are pruned so they aren't rendered standalone.
  helm/kustomize are preinstalled on GitHub runners. Failures are job-level
  error annotations (rendered output has no source-line mapping).
- .github/workflows/lint-helm.yml: reusable gate; inputs charts-dir,
  kustomize-dir, kubernetes-version, ignore-missing-schemas (for CRDs),
  actions-ref. Immutable self-reference pattern; no harden-runner.
- ci.yml: kubeconform dogfood (smoke test — no charts in this repo).
- examples/helm.pre-commit-config.yaml: reference local config (helm lint).
- README + approved-actions: usage, CRD note, tooling tracking.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

🤖 Hi @ms280690, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

@github-actions

Copy link
Copy Markdown

🤖 I'm sorry @ms280690, but I was unable to process your request. Please see the logs for more details.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a reusable Helm/Kustomize lint gate to this repo’s “lint/format” workflow suite by introducing a checksum-verified kubeconform composite action and a lint-helm.yml reusable workflow that renders manifests and validates them against Kubernetes schemas.

Changes:

  • Introduces .github/actions/kubeconform (downloads + verifies kubeconform, runs helm lint/helm template and kustomize build piped into kubeconform).
  • Adds reusable workflow .github/workflows/lint-helm.yml (workflow_call) plus CI dogfooding in .github/workflows/ci.yml.
  • Documents usage in README.md, adds an approved-actions entry, and provides an example Helm pre-commit config.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file
File Description
README.md Documents the new lint-helm.yml workflow and kubeconform composite usage/inputs.
examples/helm.pre-commit-config.yaml Adds a reference pre-commit config for Helm repos.
docs/approved-actions.md Adds kubeconform to the approved tooling list with version + verification note.
.github/workflows/lint-helm.yml New reusable workflow that checks out and runs the kubeconform composite at a caller-specified ref.
.github/workflows/ci.yml Adds a smoke-test job to dogfood the kubeconform composite.
.github/actions/kubeconform/action.yml New composite action implementing the Helm/Kustomize render + kubeconform validation gate.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread README.md Outdated
Comment thread .github/actions/kubeconform/action.yml Outdated
Comment thread .github/actions/kubeconform/action.yml Outdated
Comment thread .github/actions/kubeconform/action.yml
Comment thread .github/actions/kubeconform/action.yml Outdated
- README: document the helm lint step and the distinct failure annotations
  (helm lint / render / schema), which the composite already emits.
- Detect chart dependencies with leading whitespace tolerated
  (^[[:space:]]*dependencies:), not only column 1.
- Render to a temp file and validate separately so a helm template /
  kustomize build failure is reported as a render error, not a kubeconform
  schema failure (pipefail previously conflated them).
- Discover Kustomize overlays by all three recognised filenames:
  kustomization.yaml, kustomization.yml, Kustomization.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@ms280690 ms280690 requested a review from michaelconnor00 June 23, 2026 21:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat: linting and formatting — Helm charts and Kustomize

2 participants