helm-lint.yml

name: 'Helm Lint'

# Lints a Helm chart (optionally against multiple values files), builds OCI/file
# dependencies, renders the templates, and validates the rendered manifests
# against the Kubernetes schema with kubeconform.

on:
  workflow_call:
    inputs:
      chart-path:
        description: 'Path to the Helm chart directory'
        required: true
        type: string
      values-files:
        description: 'Newline-separated values files (relative to chart-path) to lint/render; empty = chart defaults only'
        required: false
        type: string
        default: ''
      helm-version:
        description: 'Helm version to install'
        required: false
        type: string
        default: 'v3.16.3'
      lint-strict:
        description: 'Pass --strict to helm lint'
        required: false
        type: boolean
        default: true
      build-dependencies:
        description: 'Run `helm dependency build` before linting'
        required: false
        type: boolean
        default: true
      oci-registry:
        description: 'OCI registry to log in to for chart dependencies'
        required: false
        type: string
        default: 'ghcr.io'
      kubeconform:
        description: 'Validate rendered manifests with kubeconform'
        required: false
        type: boolean
        default: true
      kubernetes-version:
        description: 'Kubernetes version for kubeconform schema validation'
        required: false
        type: string
        default: 'master'
      runs-on:
        description: 'Runner label to execute the job on'
        required: false
        type: string
        default: 'ubuntu-latest'
    secrets:
      registry-username:
        description: 'OCI registry username (for private chart dependencies)'
        required: false
      registry-password:
        description: 'OCI registry password/token (for private chart dependencies)'
        required: false
    outputs:
      result:
        description: 'Lint result (success|failure)'
        value: ${{ jobs.lint.outputs.result }}

permissions:
  contents: read
  packages: read

jobs:
  lint:
    name: Helm Lint
    runs-on: ${{ inputs.runs-on }}
    timeout-minutes: 15
    defaults:
      run:
        working-directory: ${{ inputs.chart-path }}
    env:
      REGISTRY_USERNAME: ${{ secrets.registry-username || github.actor }}
      REGISTRY_PASSWORD: ${{ secrets.registry-password || github.token }}
      VALUES_FILES: ${{ inputs.values-files }}
      LINT_STRICT: ${{ inputs.lint-strict }}
    outputs:
      result: ${{ steps.done.outputs.result }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up Helm
        uses: azure/setup-helm@v4 # Renovate pins to SHA
        with:
          version: ${{ inputs.helm-version }}

      - name: Log in to OCI registry
        if: env.REGISTRY_PASSWORD != ''
        run: |
          set -euo pipefail
          echo "$REGISTRY_PASSWORD" | helm registry login "${{ inputs.oci-registry }}" \
            --username "$REGISTRY_USERNAME" --password-stdin

      - name: Build chart dependencies
        if: inputs.build-dependencies
        run: helm dependency build

      - name: Helm lint
        run: |
          set -euo pipefail
          flags=()
          if [ "$LINT_STRICT" = "true" ]; then
            flags+=(--strict)
          fi
          files=()
          while IFS= read -r f; do
            if [ -n "$f" ]; then files+=("$f"); fi
          done <<< "$VALUES_FILES"
          if [ "${#files[@]}" -eq 0 ]; then
            helm lint . "${flags[@]}"
          else
            for f in "${files[@]}"; do
              echo "Linting with values: $f"
              helm lint . "${flags[@]}" --values "$f"
            done
          fi

      - name: Install kubeconform
        if: inputs.kubeconform
        run: |
          set -euo pipefail
          ver="v0.6.7"
          curl -fsSL "https://github.com/yannh/kubeconform/releases/download/${ver}/kubeconform-linux-amd64.tar.gz" \
            | sudo tar -xz -C /usr/local/bin kubeconform
          kubeconform -v

      - name: Render and validate manifests
        if: inputs.kubeconform
        env:
          K8S_VERSION: ${{ inputs.kubernetes-version }}
        run: |
          set -euo pipefail
          validate() {
            local label="$1"; shift
            echo "::group::kubeconform ($label)"
            helm template . "$@" \
              | kubeconform -strict -ignore-missing-schemas -summary -kubernetes-version "$K8S_VERSION"
            echo "::endgroup::"
          }
          files=()
          while IFS= read -r f; do
            if [ -n "$f" ]; then files+=("$f"); fi
          done <<< "$VALUES_FILES"
          if [ "${#files[@]}" -eq 0 ]; then
            validate "defaults"
          else
            for f in "${files[@]}"; do
              validate "$f" --values "$f"
            done
          fi

      - name: Record result
        id: done
        if: always()
        run: echo "result=${{ job.status }}" >> "$GITHUB_OUTPUT"

      - name: Summary
        if: always()
        run: |
          {
            echo "## ⎈ Helm Lint"
            echo ""
            echo "**Chart:** \`${{ inputs.chart-path }}\`"
            echo "**Values files:** \`${{ inputs.values-files || 'defaults' }}\`"
            echo "**Result:** \`${{ job.status }}\`"
          } >> "$GITHUB_STEP_SUMMARY"