Escape sed metacharacters in secret substitution (fixes #343) #421
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'Lint' | |
| on: | |
| pull_request: | |
| jobs: | |
| lint-shell: | |
| runs-on: 'ubuntu-latest' | |
| steps: | |
| - uses: 'actions/checkout@v4' | |
| - name: 'Run ShellCheck' | |
| uses: 'ludeeus/action-shellcheck@master' | |
| schema-validation: | |
| runs-on: 'ubuntu-latest' | |
| steps: | |
| - uses: 'actions/checkout@v4' | |
| - uses: 'actions/setup-python@v5' | |
| with: | |
| python-version: '3.12' | |
| - name: 'Install check-jsonschema' | |
| run: 'pip install check-jsonschema' | |
| - name: 'Set up Helm' | |
| uses: 'azure/setup-helm@v3.5' | |
| with: | |
| version: 'v3.12.0' | |
| # Validate every YAML file listed in the schemas config against its | |
| # declared schema. To add or remove a check, edit that file — no changes | |
| # here needed. | |
| - name: 'Validate YAML files against declared schemas' | |
| run: | | |
| set -euo pipefail | |
| yq eval -o=json -I=0 '.[]' .github/workflows/assets/schemas.yaml | while read -r entry; do | |
| files=$(echo "$entry" | jq -r '.files') | |
| schema=$(echo "$entry" | jq -r '.schema // ""') | |
| builtin=$(echo "$entry" | jq -r '.builtin // ""') | |
| echo "::group::$files" | |
| if [[ -n "$schema" ]]; then | |
| check-jsonschema --schemafile "$schema" $files | |
| else | |
| check-jsonschema --builtin-schema "$builtin" $files | |
| fi | |
| echo "::endgroup::" | |
| done | |
| # Render radarr under each scenario to a file so kubeconform can validate | |
| # them all in one pass. Radarr acts as the representative consumer — the | |
| # templates come from the shared media-servarr-base chart, so if radarr | |
| # renders valid manifests across scenarios, the base is sound. | |
| - name: 'Render manifests for each scenario' | |
| run: | | |
| set -euo pipefail | |
| helm dependency update ./charts/radarr | |
| mkdir -p .rendered | |
| for values_file in ./.github/workflows/assets/schema-validation/radarr/*.yaml; do | |
| name=$(basename "$values_file" .yaml) | |
| helm template test-release ./charts/radarr -f "$values_file" > ".rendered/${name}.yaml" | |
| done | |
| # Validate the rendered manifests via the official kubeconform container. | |
| # Uses the maintainer's own image, no third-party installer action. CRDs | |
| # (currently ServiceMonitor) are resolved from datreeio's catalog. | |
| - name: 'Validate rendered manifests with kubeconform' | |
| uses: 'docker://ghcr.io/yannh/kubeconform:v0.8.0' | |
| with: | |
| entrypoint: '/kubeconform' | |
| args: >- | |
| -summary | |
| -strict | |
| -kubernetes-version 1.29.0 | |
| -schema-location default | |
| -schema-location https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json | |
| .rendered/ | |
| lint-helm: | |
| runs-on: 'ubuntu-latest' | |
| steps: | |
| - uses: 'actions/checkout@v4' | |
| - name: 'Set up Helm' | |
| uses: 'azure/setup-helm@v3.5' | |
| with: | |
| version: 'v3.12.0' | |
| - name: 'Identify changed charts' | |
| id: changed-charts | |
| run: | | |
| #!/bin/bash | |
| BASE_BRANCH=${{ github.base_ref }} | |
| BASE_BRANCH=${BASE_BRANCH:-'main'} # default to main if not set | |
| git fetch origin "$BASE_BRANCH" --depth=1 # Fetch base branch | |
| git diff --name-only ${{ github.sha }} FETCH_HEAD | |
| CHANGED_FILES=$(git diff --name-only ${{ github.sha }} FETCH_HEAD | grep '^charts/' | awk -F/ '{print $2}' | uniq) | |
| CHANGED_CHARTS="" | |
| for chart in $CHANGED_FILES; do | |
| if [[ -d "./charts/$chart" ]]; then | |
| CHANGED_CHARTS="$CHANGED_CHARTS $chart" | |
| fi | |
| done | |
| echo "CHANGED_CHARTS=${CHANGED_CHARTS}" >> $GITHUB_ENV | |
| - name: 'Update dependencies for changed charts' | |
| if: env.CHANGED_CHARTS != '' | |
| run: | | |
| #!/bin/bash | |
| IFS=' ' read -r -a CHARTS <<< "$CHANGED_CHARTS" | |
| for chart in "${CHARTS[@]}"; do | |
| echo "Updating dependencies for $chart" | |
| helm dependency update "./charts/${chart}" | |
| done | |
| # Lint Helm charts | |
| - name: 'Lint Helm charts' | |
| if: env.CHANGED_CHARTS != '' | |
| run: 'make lint CHARTS="$CHANGED_CHARTS"' |