mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 02:25:56 +00:00
pulse-triage[bot]
ad1cfd33c3
The grouped action upgrade leaves signing, network and publication consumer assertions on superseded pins. Align those contracts and check every consumer against reviewed immutable upstream manifests, retaining exact dispatch and release trust boundaries without claiming hosted execution. Change-source: pulse-maintainer
85 lines
2.9 KiB
YAML
85 lines
2.9 KiB
YAML
name: Helm CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "deploy/helm/**"
|
|
- ".github/workflows/helm-ci.yml"
|
|
- "docs/KUBERNETES.md"
|
|
- "README.md"
|
|
pull_request:
|
|
paths:
|
|
- "deploy/helm/**"
|
|
- ".github/workflows/helm-ci.yml"
|
|
- "docs/KUBERNETES.md"
|
|
- "README.md"
|
|
workflow_dispatch: {}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint:
|
|
name: Lint and Render Chart
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up Helm
|
|
uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
|
|
with:
|
|
version: v3.15.2
|
|
|
|
- name: Helm lint (strict)
|
|
run: helm lint deploy/helm/pulse --strict
|
|
|
|
- name: Render default manifests
|
|
run: helm template pulse deploy/helm/pulse > /tmp/pulse-rendered.yaml
|
|
|
|
- name: Render agent-enabled manifests
|
|
run: |
|
|
helm template pulse deploy/helm/pulse \
|
|
--set agent.enabled=true \
|
|
--set agent.kind=Deployment \
|
|
--set agent.secretEnv.create=true \
|
|
--set agent.secretEnv.data.PULSE_TOKEN=dummy-token \
|
|
--set server.secretEnv.create=true \
|
|
--set server.secretEnv.data.API_TOKENS=dummy-token \
|
|
--set persistence.enabled=false \
|
|
> /tmp/pulse-agent-rendered.yaml
|
|
|
|
- name: Render and verify the OpenShift profile
|
|
run: |
|
|
helm template pulse deploy/helm/pulse \
|
|
--namespace pulse \
|
|
--set openShift.enabled=true \
|
|
--set openShift.kubernetesAgent.enabled=true \
|
|
--set agent.secretEnv.create=true \
|
|
--set agent.secretEnv.data.PULSE_TOKEN=dummy-token \
|
|
--set persistence.enabled=false \
|
|
--show-only templates/deployment.yaml \
|
|
--show-only templates/agent.yaml \
|
|
--show-only templates/agent-serviceaccount.yaml \
|
|
--show-only templates/agent-rbac.yaml \
|
|
> /tmp/pulse-openshift-rendered.yaml
|
|
|
|
grep -q -- "--enable-kubernetes" /tmp/pulse-openshift-rendered.yaml
|
|
grep -q "PULSE_AGENT_ID" /tmp/pulse-openshift-rendered.yaml
|
|
grep -q "kind: ClusterRole" /tmp/pulse-openshift-rendered.yaml
|
|
grep -q "kind: ClusterRoleBinding" /tmp/pulse-openshift-rendered.yaml
|
|
grep -q "runAsNonRoot: true" /tmp/pulse-openshift-rendered.yaml
|
|
|
|
if grep -q "/var/run/docker.sock" /tmp/pulse-openshift-rendered.yaml; then
|
|
echo "OpenShift profile must not mount the Docker socket" >&2
|
|
exit 1
|
|
fi
|
|
if grep -Eq "runAs(User|Group):|fsGroup:" /tmp/pulse-openshift-rendered.yaml; then
|
|
echo "OpenShift profile must let the SCC assign UID/GID/fsGroup" >&2
|
|
exit 1
|
|
fi
|