ci: clean up GitHub Actions warnings #57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Helm Chart Tests | |
| on: | |
| pull_request: | |
| branches: [ master ] | |
| paths: | |
| - 'chart/**' | |
| - '.github/workflows/helm-tests.yml' | |
| push: | |
| branches: [ master ] | |
| paths: | |
| - 'chart/**' | |
| - '.github/workflows/helm-tests.yml' | |
| permissions: | |
| contents: read | |
| jobs: | |
| unittest: | |
| runs-on: ubuntu-latest | |
| name: Unit Tests | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v4 | |
| with: | |
| version: 'v3.19.4' | |
| - name: Run helm unit tests | |
| run: make helm-unittest-install | |
| lint-and-validate: | |
| runs-on: ubuntu-latest | |
| name: Lint and Validate Chart | |
| needs: unittest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v4 | |
| with: | |
| version: 'v3.19.4' | |
| - name: Set up chart-testing | |
| uses: helm/chart-testing-action@v2.6.1 | |
| - name: Run chart-testing (lint) | |
| run: ct lint --config .github/ct.yaml --charts chart/ | |
| - name: Helm lint | |
| run: helm lint ./chart | |
| - name: Helm template (default values) | |
| run: helm template test-release ./chart --debug | |
| - name: Helm template (with ingress) | |
| run: | | |
| helm template test-release ./chart \ | |
| --set ingress.enabled=true \ | |
| --set ingress.className=nginx \ | |
| --debug | |
| - name: Helm template (with autoscaling) | |
| run: | | |
| helm template test-release ./chart \ | |
| --set autoscaling.enabled=true \ | |
| --set autoscaling.minReplicas=2 \ | |
| --set autoscaling.maxReplicas=5 \ | |
| --debug | |
| - name: Helm template (with monitoring) | |
| run: | | |
| helm template test-release ./chart \ | |
| --set serviceMonitor.enabled=true \ | |
| --set podDisruptionBudget.enabled=true \ | |
| --debug | |
| security-scan: | |
| runs-on: ubuntu-latest | |
| name: Security Scan Chart | |
| needs: [unittest, lint-and-validate] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v4 | |
| with: | |
| version: 'v3.13.0' | |
| - name: Install Checkov | |
| run: pip install checkov | |
| - name: Template chart for scanning | |
| run: | | |
| mkdir -p /tmp/helm-manifests | |
| helm template spectre ./chart > /tmp/helm-manifests/manifests.yaml | |
| - name: Run Checkov security scan | |
| run: | | |
| checkov -f /tmp/helm-manifests/manifests.yaml \ | |
| --framework kubernetes \ | |
| --soft-fail || true | |
| - name: Check for security context | |
| run: | | |
| helm template spectre ./chart | grep -A 5 "securityContext" || \ | |
| (echo "Security context not found!" && exit 1) | |
| - name: Verify non-root user | |
| run: | | |
| helm template spectre ./chart | grep "runAsNonRoot: true" || \ | |
| (echo "Container not running as non-root!" && exit 1) | |
| - name: Verify capabilities dropped | |
| run: | | |
| helm template spectre ./chart | grep -A 2 "capabilities:" | grep "ALL" || \ | |
| (echo "Capabilities not properly dropped!" && exit 1) |