linter.yaml

name: Lint Helm Charts

on:
  pull_request:
    paths:
      - charts/**
  merge_group:
    types:
      - checks_requested

jobs:
  getChangedCharts:
    uses: ./.github/workflows/get-changed-charts.yaml
    with:
      pr_number: ${{ github.event.pull_request.number }}
  lint-helm-chart:
    name: prepare helm chart
    runs-on: ubuntu-latest
    needs: getChangedCharts
    strategy:
      matrix:
        chart: ${{ fromJson(needs.getChangedCharts.outputs.charts) }}
    env:
      CT_TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}
      CHART: ${{ matrix.chart }}
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          fetch-depth: 0

      - run: pip install yq
      - name: Install sponge
        run: sudo apt-get -yq install moreutils
      - name: Extract helm repos
        id: helm-repos
        run: |
          (
            echo -n "repos="
            yq -r '.dependencies[] | .repository' "charts/$CHART/Chart.yaml" | sort -u | grep https:// | awk '{printf (NR>1 ? "," : "") NR "=" $1}'
            echo
          ) | tee -a "$GITHUB_OUTPUT"

      - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5
        with:
          python-version: 3.7

      - run: ./.github/scripts/prepare-values.sh "charts/$CHART"
      - uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1

      - name: Lint chart
        run: |
          if ! [[ -f "charts/$CHART/values.yaml" ]]; then
            echo "No values.yaml found for $CHART, skipping 'ct lint'" >&2
            helm lint "charts/$CHART"
          else
            ct lint --check-version-increment=false
          fi
        env:
          CT_CHART_REPOS: ${{ steps.helm-repos.outputs.repos }}
          CT_CHARTS: charts/${{ matrix.chart }}

      - run: ./.github/scripts/templateHelmChartRecursivelyToFolder.sh "charts/$CHART" /tmp/templated
        id: templateChart
      - run: ./.github/scripts/extract-artifacthub-images.sh "charts/$CHART" /tmp/templated
        if: ${{ steps.templateChart.outputs.skipped == 'false' }}
      - run: ./.github/scripts/enforce-trusted-registries.sh "charts/$CHART"
        if: ${{ steps.templateChart.outputs.skipped == 'false' }}
      - name: Download Pluto
        uses: FairwindsOps/pluto/github-action@master
        if: ${{ steps.templateChart.outputs.skipped == 'false' }}
      - run: pluto detect-files -d /tmp/templated -o custom --columns 'FILEPATH,NAME,KIND,VERSION,REPLACEMENT,REMOVED,DEPRECATED,REPL AVAIL'
        if: ${{ steps.templateChart.outputs.skipped == 'false' }}