mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-13 15:51:39 +00:00
pulse-triage[bot]
85 lines
2.9 KiB
YAML
85 lines
2.9 KiB
YAML
name: Helm CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "deploy/helm/**"
|
|
- ".github/workflows/helm-ci.yml"
|
|
- "docs/KUBERNETES.md"
|
|
- "README.md"
|
|
pull_request:
|
|
paths:
|
|
- "deploy/helm/**"
|
|
- ".github/workflows/helm-ci.yml"
|
|
- "docs/KUBERNETES.md"
|
|
- "README.md"
|
|
workflow_dispatch: {}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint:
|
|
name: Lint and Render Chart
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up Helm
|
|
uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
|
|
with:
|
|
version: v3.15.2
|
|
|
|
- name: Helm lint (strict)
|
|
run: helm lint deploy/helm/pulse --strict
|
|
|
|
- name: Render default manifests
|
|
run: helm template pulse deploy/helm/pulse > /tmp/pulse-rendered.yaml
|
|
|
|
- name: Render agent-enabled manifests
|
|
run: |
|
|
helm template pulse deploy/helm/pulse \
|
|
--set agent.enabled=true \
|
|
--set agent.kind=Deployment \
|
|
--set agent.secretEnv.create=true \
|
|
--set agent.secretEnv.data.PULSE_TOKEN=dummy-token \
|
|
--set server.secretEnv.create=true \
|
|
--set server.secretEnv.data.API_TOKENS=dummy-token \
|
|
--set persistence.enabled=false \
|
|
> /tmp/pulse-agent-rendered.yaml
|
|
|
|
- name: Render and verify the OpenShift profile
|
|
run: |
|
|
helm template pulse deploy/helm/pulse \
|
|
--namespace pulse \
|
|
--set openShift.enabled=true \
|
|
--set openShift.kubernetesAgent.enabled=true \
|
|
--set agent.secretEnv.create=true \
|
|
--set agent.secretEnv.data.PULSE_TOKEN=dummy-token \
|
|
--set persistence.enabled=false \
|
|
--show-only templates/deployment.yaml \
|
|
--show-only templates/agent.yaml \
|
|
--show-only templates/agent-serviceaccount.yaml \
|
|
--show-only templates/agent-rbac.yaml \
|
|
> /tmp/pulse-openshift-rendered.yaml
|
|
|
|
grep -q -- "--enable-kubernetes" /tmp/pulse-openshift-rendered.yaml
|
|
grep -q "PULSE_AGENT_ID" /tmp/pulse-openshift-rendered.yaml
|
|
grep -q "kind: ClusterRole" /tmp/pulse-openshift-rendered.yaml
|
|
grep -q "kind: ClusterRoleBinding" /tmp/pulse-openshift-rendered.yaml
|
|
grep -q "runAsNonRoot: true" /tmp/pulse-openshift-rendered.yaml
|
|
|
|
if grep -q "/var/run/docker.sock" /tmp/pulse-openshift-rendered.yaml; then
|
|
echo "OpenShift profile must not mount the Docker socket" >&2
|
|
exit 1
|
|
fi
|
|
if grep -Eq "runAs(User|Group):|fsGroup:" /tmp/pulse-openshift-rendered.yaml; then
|
|
echo "OpenShift profile must let the SCC assign UID/GID/fsGroup" >&2
|
|
exit 1
|
|
fi
|