external-dns/.github/workflows/lint-test-chart.yaml
Raffaele Di Fazio a6266dd5ff
Minimize GitHub Actions workflow permissions (#6319)
Apply principle of least privilege across all workflows:

- end-to-end-tests.yml: add missing permissions (contents: read)
- dependency-update.yaml: add missing permissions (contents: read)
- lint-test-chart.yaml: replace top-level read-all with permissions: {}
- release-chart.yaml: replace top-level read-all with permissions: {}
- codeql-analysis.yaml: remove unused actions: read
- lint.yaml: remove unused pull-requests: read
- staging-image-tester.yaml: remove unused checks: write (no goveralls step)
2026-03-27 23:22:47 +05:30

199 lines
6.7 KiB
YAML

name: Lint and Test Chart
on:
pull_request:
branches:
- master
paths:
- "charts/external-dns/**"
concurrency:
group: chart-pr-${{ github.ref }}
cancel-in-progress: true
permissions: {}
jobs:
lint-test:
name: Lint and Test
if: github.repository == 'kubernetes-sigs/external-dns'
runs-on: ubuntu-latest
permissions:
contents: read
defaults:
run:
shell: bash
steps:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
fetch-depth: 0
- name: Install Helm
uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
with:
version: latest
- name: Configure Helm
run: |
set -euo pipefail
helm plugin install https://github.com/losisin/helm-values-schema-json.git --verify=false
helm plugin install https://github.com/helm-unittest/helm-unittest.git --verify=false
- name: Run Helm Schema check
working-directory: charts/external-dns
run: |
set -euo pipefail
helm schema
if [[ -n "$(git status --porcelain --untracked-files=no)" ]]
then
echo "Schema not up to date. Please run helm schema and commit changes!" >&2
exit 1
fi
- name: Install Helm Docs
uses: action-stars/install-tool-from-github-release@1fa61c3bea52eca3bcdb1f5c961a3b113fe7fa54 # v0.2.6
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
owner: norwoodj
repository: helm-docs
arch_amd64: x86_64
os_linux: Linux
check_command: helm-docs --version
version: latest
- name: Run Helm Docs check
run: |
set -euo pipefail
helm-docs
if [[ -n "$(git status --porcelain --untracked-files=no)" ]]
then
echo "Documentation not up to date. Please run helm-docs and commit changes!" >&2
exit 1
fi
- name: Run Helm Unit Tests
run: |
set -euo pipefail
helm unittest -f 'tests/*_test.yaml' charts/external-dns
- name: Install YQ
uses: action-stars/install-tool-from-github-release@1fa61c3bea52eca3bcdb1f5c961a3b113fe7fa54 # v0.2.6
with:
github_token: ${{ github.token }}
owner: mikefarah
repository: yq
extract: false
filename_format: "{name}_{os}_{arch}"
check_command: yq --version
version: latest
- name: Install MDQ
uses: action-stars/install-tool-from-github-release@1fa61c3bea52eca3bcdb1f5c961a3b113fe7fa54 # v0.2.6
with:
github_token: ${{ github.token }}
owner: yshavit
repository: mdq
arch_amd64: x64
filename_format: "{name}-{os}-{arch}.{ext}"
check_command: mdq --version
version: latest
- name: Run CHANGELOG check
run: |
set -euo pipefail
chart_file_path="./charts/external-dns/Chart.yaml"
changelog_file_path="./charts/external-dns/CHANGELOG.md"
version="$(yq eval '.version' "${chart_file_path}")"
entry="$(mdq --no-br --link-format inline "# v${version}" <"${changelog_file_path}" || true)"
if [[ -z "${entry}" ]]
then
echo "No CHANGELOG entry for ${chart} version ${version}!" >&2
exit 1
fi
added="$(mdq --output plain "# v${version} | # Added | -" <"${changelog_file_path}" || true)"
changed="$(mdq --output plain "# v${version} | # Changed | -" <"${changelog_file_path}" || true)"
deprecated="$(mdq --output plain "# v${version} | # Deprecated | -" <"${changelog_file_path}" || true)"
removed="$(mdq --output plain "# v${version} | # Removed | -" <"${changelog_file_path}" || true)"
fixed="$(mdq --output plain "# v${version} | # Fixed | -" <"${changelog_file_path}" || true)"
security="$(mdq --output plain "# v${version} | # Security | -" <"${changelog_file_path}" || true)"
changes_path="./charts/external-dns/changes.txt"
rm -f "${changes_path}"
old_ifs="${IFS}"
IFS=$'\n'
for item in ${added}; do
printf -- '- kind: added\n description: "%s"\n' "${item%.*}." >> "${changes_path}"
done
for item in ${changed}; do
printf -- '- kind: changed\n description: "%s"\n' "${item%.*}." >> "${changes_path}"
done
for item in ${deprecated}; do
printf -- '- kind: deprecated\n description: "%s"\n' "${item%.*}." >> "${changes_path}"
done
for item in ${removed}; do
printf -- '- kind: removed\n description: "%s"\n' "${item%.*}." >> "${changes_path}"
done
for item in ${fixed}; do
printf -- '- kind: fixed\n description: "%s"\n' "${item%.*}." >> "${changes_path}"
done
for item in ${security}; do
printf -- '- kind: security\n description: "%s"\n' "${item%.*}." >> "${changes_path}"
done
IFS="${old_ifs}"
if [[ -f "${changes_path}" ]]; then
echo "::group::Changes"
cat "${changes_path}"
echo "::endgroup::"
changes="$(cat "${changes_path}")" yq eval --inplace '.annotations["artifacthub.io/changes"] |= strenv(changes)' "${chart_file_path}"
rm -f "${changes_path}"
fi
- name: Install Artifact Hub CLI
uses: action-stars/install-tool-from-github-release@1fa61c3bea52eca3bcdb1f5c961a3b113fe7fa54 # v0.2.6
with:
github_token: ${{ github.token }}
owner: artifacthub
repository: hub
name: ah
check_command: ah version
version: latest
- name: Run Artifact Hub lint
run: ah lint --kind helm --path ./charts/external-dns || exit 1
- name: Install Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
token: ${{ github.token }}
python-version: "3.x"
- name: Set-up chart-testing
uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
- name: Run chart-testing lint
run: ct lint --charts=./charts/external-dns --target-branch=${{ github.event.repository.default_branch }} --check-version-increment=false
- name: Create Kind cluster
uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
with:
wait: 120s
- name: Run chart-testing install
run: ct install --charts=./charts/external-dns --target-branch=${{ github.event.repository.default_branch }}