From 87cb05a09627f6fdcd67835df3edb01c239e755b Mon Sep 17 00:00:00 2001
From: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Date: Wed, 29 Jul 2026 15:22:36 +0800
Subject: [PATCH] test(ci): cover Helm workflows in security checks

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
---
 .github/workflows/pr-scripts.yml        | 2 ++
 scripts/tests/workflow-security-test.sh | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/.github/workflows/pr-scripts.yml b/.github/workflows/pr-scripts.yml
index 082ce102..6b46fde7 100644
--- a/.github/workflows/pr-scripts.yml
+++ b/.github/workflows/pr-scripts.yml
@@ -12,7 +12,9 @@ on:
       - 'web/nginx.conf.template'
       - '.github/workflows/pr-cli.yml'
       - '.github/workflows/pr-e2e.yml'
+      - '.github/workflows/pr-helm-chart.yml'
       - '.github/workflows/pr-tests.yml'
+      - '.github/workflows/publish-chart.yml'
       - '.github/workflows/security.yml'
       - '.github/workflows/pr-scripts.yml'
       - '**/*.py'
diff --git a/scripts/tests/workflow-security-test.sh b/scripts/tests/workflow-security-test.sh
index ec1f70ce..a13c7c62 100755
--- a/scripts/tests/workflow-security-test.sh
+++ b/scripts/tests/workflow-security-test.sh
@@ -24,6 +24,7 @@ assert_pr_workflow_hardened() {
 
 assert_pr_workflow_hardened "$REPO_ROOT/.github/workflows/pr-cli.yml"
 assert_pr_workflow_hardened "$REPO_ROOT/.github/workflows/pr-e2e.yml"
+assert_pr_workflow_hardened "$REPO_ROOT/.github/workflows/pr-helm-chart.yml"
 assert_pr_workflow_hardened "$REPO_ROOT/.github/workflows/pr-tests.yml"
 assert_pr_workflow_hardened "$PR_SCRIPTS_WORKFLOW"
 assert_pr_workflow_hardened "$SECURITY_WORKFLOW"
@@ -54,8 +55,12 @@ grep -Fq '.github/workflows/pr-cli.yml' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run when PR CLI workflow changes"
 grep -Fq '.github/workflows/pr-e2e.yml' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run when PR E2E workflow changes"
+grep -Fq '.github/workflows/pr-helm-chart.yml' "$PR_SCRIPTS_WORKFLOW" \
+  || fail "pr-scripts must run when PR Helm Chart workflow changes"
 grep -Fq '.github/workflows/pr-tests.yml' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run when PR Tests workflow changes"
+grep -Fq '.github/workflows/publish-chart.yml' "$PR_SCRIPTS_WORKFLOW" \
+  || fail "pr-scripts must run when Chart publish workflow changes"
 grep -Fq "'**/*.py'" "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run when Python source changes"
 grep -Fq '.env.release.example' "$PR_SCRIPTS_WORKFLOW" \