feat(ci): validate HelmRelease values against the chart schema #209

Merged

grachevko merged 1 commit from feat/flux-local-gate into main

2026-09-24 18:14:47 +00:00

hermes commented

2026-09-24 18:05:55 +00:00

Collaborator

flate test all inflates the cluster but does not validate values against the chart schema: a value a chart rejects (for example a stray optional under valueFrom.secretKeyRef) reaches the rendered output with exit code 0 and only fails later in the cluster. flux-local inflates the cluster with helm, validates the values of every HelmRelease against its chart's values.schema.json, and can report the rendered diff of a change as a pull request comment.

test is the gate. It inflates all namespaces with --enable-helm, so every chart is fetched by the job itself — including the two mirrored ones from oci://harbor.grachevko.ru/charts — and nothing has to be checked out beside this repository.
diff renders the HelmReleases at the head and at the base branch and posts the difference as a review comment, so the blast radius of a value bump is visible where it is reviewed.
The jobs use the upstream composite actions of flux-local. The pinned-image form (uses: docker://...) that other home-ops repositories use is not available here: our runner is the Forgejo kubernetes plugin, which executes every step inside the job pod's main container and has no per-step images.
The Flux Local - Success aggregator exists because job-level success()/cancelled() are not evaluated on this Forgejo version (go-gitea/gitea#25897), so a job relying on them never starts and its check stays pending forever.

This is the second half of the chart-mirror work: with the harbor and vault charts coming from the registry mirror (#207, merged), every release can be inflated by the job, so the gate needs no exceptions. An earlier revision of that change carried this workflow, but its diff job could not render the base branch while the base still took those two charts from a git repository (unable to detect chart at <workdir>/Chart.yaml), which is why the workflow lands here separately.

Verified

flux-local test --enable-helm --all-namespaces --path kubernetes/flux/cluster --sources flux-system=.: 128 passed, no failures, on the current main; the same command reports the class of error this gate exists for when a value the chart schema rejects is introduced.
The test job already ran green in this cluster runner on the first revision of the earlier pull request (run 175), which is the same command in the real environment.

Rollback

Revert the commit: the workflow disappears and no cluster state is involved.

`flate test all` inflates the cluster but does not validate values against the chart schema: a value a chart rejects (for example a stray `optional` under `valueFrom.secretKeyRef`) reaches the rendered output with exit code 0 and only fails later in the cluster. flux-local inflates the cluster with helm, validates the values of every HelmRelease against its chart's `values.schema.json`, and can report the rendered diff of a change as a pull request comment. - `test` is the gate. It inflates all namespaces with `--enable-helm`, so every chart is fetched by the job itself — including the two mirrored ones from `oci://harbor.grachevko.ru/charts` — and nothing has to be checked out beside this repository. - `diff` renders the HelmReleases at the head and at the base branch and posts the difference as a review comment, so the blast radius of a value bump is visible where it is reviewed. - The jobs use the upstream composite actions of flux-local. The pinned-image form (`uses: docker://...`) that other home-ops repositories use is not available here: our runner is the Forgejo kubernetes plugin, which executes every step inside the job pod's `main` container and has no per-step images. - The `Flux Local - Success` aggregator exists because job-level `success()`/`cancelled()` are not evaluated on this Forgejo version (go-gitea/gitea#25897), so a job relying on them never starts and its check stays pending forever. This is the second half of the chart-mirror work: with the harbor and vault charts coming from the registry mirror (#207, merged), every release can be inflated by the job, so the gate needs no exceptions. An earlier revision of that change carried this workflow, but its diff job could not render the base branch while the base still took those two charts from a git repository (`unable to detect chart at <workdir>/Chart.yaml`), which is why the workflow lands here separately. ## Verified - `flux-local test --enable-helm --all-namespaces --path kubernetes/flux/cluster --sources flux-system=.`: 128 passed, no failures, on the current main; the same command reports the class of error this gate exists for when a value the chart schema rejects is introduced. - The `test` job already ran green in this cluster runner on the first revision of the earlier pull request (run 175), which is the same command in the real environment. ## Rollback Revert the commit: the workflow disappears and no cluster state is involved.

grachevko force-pushed feat/flux-local-gate from 04995aba16

Flate / Flate - Filter (pull_request) Successful in 4s

Details

Flate / Flate (pull_request) Has been skipped

Details

Flux Local / Flux Local - Test (pull_request) Successful in 44s

Details

Flate / Flate - Success (pull_request) Successful in 3s

Details

Flux Local / Flux Local - Diff (pull_request) Successful in 1m1s

Details

Flux Local / Flux Local - Success (pull_request) Successful in 3s