skillhub/.github/workflows/pr-helm-chart.yml

name: PR Helm Chart

on:
  pull_request:
    paths:
      - charts/skillhub/**
    types:
      - opened
      - synchronize
      - reopened
      - ready_for_review
  workflow_dispatch:

concurrency:
  group: pr-helm-chart-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  lint:
    name: Lint Chart
    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: charts/skillhub

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          version: latest

      - name: Build dependencies
        run: helm dependency build .

      - name: Lint chart
        run: helm lint .

      - name: Validate chart metadata
        run: |
          CHART_VERSION=$(helm show chart . | grep '^version:' | awk '{print $2}')
          APP_VERSION=$(helm show chart . | grep '^appVersion:' | awk '{print $2}')
          echo "Chart version: $CHART_VERSION"
          echo "App version: $APP_VERSION"
          if [ -z "$CHART_VERSION" ]; then
            echo "ERROR: Chart version is empty"
            exit 1
          fi

  template:
    name: Template Validation
    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: charts/skillhub

    strategy:
      fail-fast: false
      matrix:
        scenario:
          - name: bitnami-default
            description: Bitnami 默认配置
            args: ""
          - name: external-db-redis
            description: 外部 PostgreSQL + Redis
            args: >-
              --set postgresql.enabled=false
              --set redis.enabled=false
              --set externalDatabase.host=postgres.example.com
              --set externalDatabase.password=secret
              --set externalRedis.host=redis.example.com
              --set externalRedis.password=secret
          - name: postgresql-replication
            description: PostgreSQL 主从 + Redis 主从
            args: >-
              --set postgresql.architecture=replication
              --set redis.architecture=replication
          - name: redis-sentinel
            description: Redis 哨兵模式
            args: >-
              --set redis.architecture=replication
              --set redis.sentinel.enabled=true
          - name: ingress-tls-certmanager
            description: Ingress + TLS + cert-manager
            args: >-
              --set ingress.enabled=true
              --set ingress.tls.enabled=true
              --set ingress.certManager.enabled=true
          - name: s3-storage
            description: S3 存储
            args: >-
              --set s3.enabled=true
              --set s3.bucket=test-bucket
              --set s3.endpoint=s3.amazonaws.com
              --set s3.region=us-east-1
          - name: external-secret
            description: 外部 Secret
            args: >-
              --set existingSecret=my-custom-secret
          - name: scanner-disabled
            description: 禁用 Scanner
            args: >-
              --set scanner.enabled=false
          - name: hpa-pdb
            description: HPA + PDB
            args: >-
              --set server.autoscaling.enabled=true
              --set web.autoscaling.enabled=true
              --set scanner.autoscaling.enabled=true
              --set server.podDisruptionBudget.enabled=true
              --set web.podDisruptionBudget.enabled=true
              --set scanner.podDisruptionBudget.enabled=true

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          version: latest

      - name: Build dependencies
        run: helm dependency build .

      - name: Render template - ${{ matrix.scenario.name }}
        run: |
          echo "## ${{ matrix.scenario.description }}"
          helm template test-release . ${{ matrix.scenario.args }} > rendered.yaml
          echo "✅ Template rendered successfully"

      - name: Validate resources
        run: |
          RESOURCES=$(grep -c '^kind:' rendered.yaml || true)
          echo "Rendered $RESOURCES resources for ${{ matrix.scenario.name }}"
          if [ "$RESOURCES" -eq 0 ]; then
            echo "ERROR: No resources rendered for ${{ matrix.scenario.name }}"
            exit 1
          fi

      - name: Schema validation (kubeconform)
        uses: docker://ghcr.io/yannh/kubeconform:latest
        with:
          entrypoint: '/kubeconform'
          args: "-strict -summary -output text -schema-location default -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' charts/skillhub/rendered.yaml"