feat: lint/format reusable workflows — Helm/Kustomize kubeconform gate (#11)#49
Conversation
…e (issue #11) Helm/Kustomize lint stage of parent #12. Completes the lint/format trio (#9 IaC, #10 app, #11 Helm). - .github/actions/kubeconform: composite that installs a pinned, checksum-verified kubeconform v0.8.0 binary. For each chart under charts-dir it runs `helm lint` then `helm template | kubeconform`; for each overlay under kustomize-dir it runs `kustomize build | kubeconform`. Vendored subcharts (<chart>/charts/*) are pruned so they aren't rendered standalone. helm/kustomize are preinstalled on GitHub runners. Failures are job-level error annotations (rendered output has no source-line mapping). - .github/workflows/lint-helm.yml: reusable gate; inputs charts-dir, kustomize-dir, kubernetes-version, ignore-missing-schemas (for CRDs), actions-ref. Immutable self-reference pattern; no harden-runner. - ci.yml: kubeconform dogfood (smoke test — no charts in this repo). - examples/helm.pre-commit-config.yaml: reference local config (helm lint). - README + approved-actions: usage, CRD note, tooling tracking. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
🤖 Hi @ms280690, I've received your request, and I'm working on it now! You can track my progress in the logs for more details. |
|
🤖 I'm sorry @ms280690, but I was unable to process your request. Please see the logs for more details. |
There was a problem hiding this comment.
Pull request overview
Adds a reusable Helm/Kustomize lint gate to this repo’s “lint/format” workflow suite by introducing a checksum-verified kubeconform composite action and a lint-helm.yml reusable workflow that renders manifests and validates them against Kubernetes schemas.
Changes:
- Introduces
.github/actions/kubeconform(downloads + verifies kubeconform, runshelm lint/helm templateandkustomize buildpiped into kubeconform). - Adds reusable workflow
.github/workflows/lint-helm.yml(workflow_call) plus CI dogfooding in.github/workflows/ci.yml. - Documents usage in
README.md, adds an approved-actions entry, and provides an example Helm pre-commit config.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
README.md |
Documents the new lint-helm.yml workflow and kubeconform composite usage/inputs. |
examples/helm.pre-commit-config.yaml |
Adds a reference pre-commit config for Helm repos. |
docs/approved-actions.md |
Adds kubeconform to the approved tooling list with version + verification note. |
.github/workflows/lint-helm.yml |
New reusable workflow that checks out and runs the kubeconform composite at a caller-specified ref. |
.github/workflows/ci.yml |
Adds a smoke-test job to dogfood the kubeconform composite. |
.github/actions/kubeconform/action.yml |
New composite action implementing the Helm/Kustomize render + kubeconform validation gate. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- README: document the helm lint step and the distinct failure annotations (helm lint / render / schema), which the composite already emits. - Detect chart dependencies with leading whitespace tolerated (^[[:space:]]*dependencies:), not only column 1. - Render to a temp file and validate separately so a helm template / kustomize build failure is reported as a render error, not a kubeconform schema failure (pipefail previously conflated them). - Discover Kustomize overlays by all three recognised filenames: kustomization.yaml, kustomization.yml, Kustomization. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
michaelconnor00
left a comment
michaelconnor00
left a comment
There was a problem hiding this comment.
Looks good. I made some comments, but you can push those to a new issue instead of doing it here.
| # Installed to RUNNER_TEMP and invoked by absolute path; avoids GITHUB_PATH. | ||
| install "${TMP}/kubeconform" "${RUNNER_TEMP}/kubeconform" | ||
|
|
||
| - name: Validate charts and overlays |
There was a problem hiding this comment.
This step is doing a lot. I would consider splitting it into chart-dir-list, chart-validate, kust-dir-list, kust-validate. But it would only be for readability.
| shell: bash | ||
| env: | ||
| CHARTS_DIR: ${{ inputs.charts-dir }} | ||
| KUSTOMIZE_DIR: ${{ inputs.kustomize-dir }} |
There was a problem hiding this comment.
Kustomize use filesystem hiearchy, which means you can have nested subdirectories. If you want this to be more usable, maybe allow a list of directories.
| - name: Validate charts and overlays | ||
| shell: bash | ||
| env: | ||
| CHARTS_DIR: ${{ inputs.charts-dir }} |
There was a problem hiding this comment.
Similar to the kustomize, would be more flexible if this could be a list of locations.
Closes #11. Helm/Kustomize lint stage of parent #12 — completes the lint/format trio (#9 IaC, #10 app, #11 Helm).
What
.github/actions/kubeconform/action.ymlhelm lintthenhelm template | kubeconform. Per overlay:kustomize build | kubeconform. Vendored subcharts pruned..github/workflows/lint-helm.ymlcharts-dir,kustomize-dir,kubernetes-version,ignore-missing-schemas,actions-ref..github/workflows/ci.ymlexamples/helm.pre-commit-config.yamlhelm lint, SHA-pinned).README.md,docs/approved-actions.mdignore-missing-schemasnote, tooling tracking.Acceptance criteria (#11)
charts-dir:helm lintthenhelm template | kubeconformkustomize-dir:kustomize build | kubeconformcharts-dir,kustomize-dir,kubernetes-versioninputsignore-missing-schemasfor CRDsprescient-platform-applications/charts/— needs a real run (see below)Design notes
find -mindepth 1 -type d -name charts -prune) — they're rendered by the parenthelm template, not standalone.harden-runner; immutableactions-refself-reference pattern.Verified
Locally on a
helm createdemo chart: checksum verify,helm lint, render, kubeconform validate (valid→0, invalid→1,-ignore-missing-schemasworks), and the subchart prune. Not yet run against real charts — recommend validating againstprescient-platform-applications/charts/before merge.🤖 Generated with Claude Code