feat: lint/format reusable workflows — Helm/Kustomize kubeconform gate (#11)#49
Open
ms280690 wants to merge 2 commits into
Open
feat: lint/format reusable workflows — Helm/Kustomize kubeconform gate (#11)#49ms280690 wants to merge 2 commits into
ms280690 wants to merge 2 commits into
Conversation
…e (issue #11) Helm/Kustomize lint stage of parent #12. Completes the lint/format trio (#9 IaC, #10 app, #11 Helm). - .github/actions/kubeconform: composite that installs a pinned, checksum-verified kubeconform v0.8.0 binary. For each chart under charts-dir it runs `helm lint` then `helm template | kubeconform`; for each overlay under kustomize-dir it runs `kustomize build | kubeconform`. Vendored subcharts (<chart>/charts/*) are pruned so they aren't rendered standalone. helm/kustomize are preinstalled on GitHub runners. Failures are job-level error annotations (rendered output has no source-line mapping). - .github/workflows/lint-helm.yml: reusable gate; inputs charts-dir, kustomize-dir, kubernetes-version, ignore-missing-schemas (for CRDs), actions-ref. Immutable self-reference pattern; no harden-runner. - ci.yml: kubeconform dogfood (smoke test — no charts in this repo). - examples/helm.pre-commit-config.yaml: reference local config (helm lint). - README + approved-actions: usage, CRD note, tooling tracking. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
🤖 Hi @ms280690, I've received your request, and I'm working on it now! You can track my progress in the logs for more details. |
|
🤖 I'm sorry @ms280690, but I was unable to process your request. Please see the logs for more details. |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a reusable Helm/Kustomize lint gate to this repo’s “lint/format” workflow suite by introducing a checksum-verified kubeconform composite action and a lint-helm.yml reusable workflow that renders manifests and validates them against Kubernetes schemas.
Changes:
- Introduces
.github/actions/kubeconform(downloads + verifies kubeconform, runshelm lint/helm templateandkustomize buildpiped into kubeconform). - Adds reusable workflow
.github/workflows/lint-helm.yml(workflow_call) plus CI dogfooding in.github/workflows/ci.yml. - Documents usage in
README.md, adds an approved-actions entry, and provides an example Helm pre-commit config.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
README.md |
Documents the new lint-helm.yml workflow and kubeconform composite usage/inputs. |
examples/helm.pre-commit-config.yaml |
Adds a reference pre-commit config for Helm repos. |
docs/approved-actions.md |
Adds kubeconform to the approved tooling list with version + verification note. |
.github/workflows/lint-helm.yml |
New reusable workflow that checks out and runs the kubeconform composite at a caller-specified ref. |
.github/workflows/ci.yml |
Adds a smoke-test job to dogfood the kubeconform composite. |
.github/actions/kubeconform/action.yml |
New composite action implementing the Helm/Kustomize render + kubeconform validation gate. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- README: document the helm lint step and the distinct failure annotations (helm lint / render / schema), which the composite already emits. - Detect chart dependencies with leading whitespace tolerated (^[[:space:]]*dependencies:), not only column 1. - Render to a temp file and validate separately so a helm template / kustomize build failure is reported as a render error, not a kubeconform schema failure (pipefail previously conflated them). - Discover Kustomize overlays by all three recognised filenames: kustomization.yaml, kustomization.yml, Kustomization. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #11. Helm/Kustomize lint stage of parent #12 — completes the lint/format trio (#9 IaC, #10 app, #11 Helm).
What
.github/actions/kubeconform/action.ymlhelm lintthenhelm template | kubeconform. Per overlay:kustomize build | kubeconform. Vendored subcharts pruned..github/workflows/lint-helm.ymlcharts-dir,kustomize-dir,kubernetes-version,ignore-missing-schemas,actions-ref..github/workflows/ci.ymlexamples/helm.pre-commit-config.yamlhelm lint, SHA-pinned).README.md,docs/approved-actions.mdignore-missing-schemasnote, tooling tracking.Acceptance criteria (#11)
charts-dir:helm lintthenhelm template | kubeconformkustomize-dir:kustomize build | kubeconformcharts-dir,kustomize-dir,kubernetes-versioninputsignore-missing-schemasfor CRDsprescient-platform-applications/charts/— needs a real run (see below)Design notes
find -mindepth 1 -type d -name charts -prune) — they're rendered by the parenthelm template, not standalone.harden-runner; immutableactions-refself-reference pattern.Verified
Locally on a
helm createdemo chart: checksum verify,helm lint, render, kubeconform validate (valid→0, invalid→1,-ignore-missing-schemasworks), and the subchart prune. Not yet run against real charts — recommend validating againstprescient-platform-applications/charts/before merge.🤖 Generated with Claude Code