Fallstar, sidelab, keeptrack updates

.editorconfig

@@ -1,14 +1,18 @@
-root = true
+root = true
 
 [*]
-charset = utf-8-bom
+charset = utf-8
 end_of_line = lf
 indent_size = 2
 indent_style = space
 insert_final_newline = true
 trim_trailing_whitespace = true
 max_line_length = 180
 
-[md]
+# Workflow files are read by tools that refuse a byte order mark.
+[.github/workflows/*.yml]
+charset = utf-8
+
+[*.md]
 trim_trailing_whitespace = false
 max_line_length = 240

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: CI
+name: CI
 # title: CI (Continuous Integration) pipeline
 
 on:
@@ -21,66 +21,140 @@ env:
   CHARTS_DIRECTORIES_ARG: "--chart-dirs charts"
 
 jobs:
-  build:
+  markup-lint:
+    name: Markup
+    uses: devpro/github-workflow-parts/.github/workflows/reusable-markup-lint.yml@591b0c7bfba6fbc7b0cab7d896447e0732b819de
+
+  docs:
+    name: Docs
+    uses: devpro/github-workflow-parts/.github/workflows/reusable-pages-deployment.yml@591b0c7bfba6fbc7b0cab7d896447e0732b819de
+    with:
+      # VitePress writes the site the GitLab pipeline publishes, which this job only builds.
+      deploy: false
+      job-name: Docs
+      site-path: public
+      workflow-parts-version: 591b0c7bfba6fbc7b0cab7d896447e0732b819de
+
+  charts:
+    name: Charts
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    outputs:
+      changed: ${{ steps.list-changed.outputs.changed }}
+      changed-charts: ${{ steps.list-changed.outputs.changed_charts }}
+    env:
+      # Read from the environment rather than pasted into the scripts by GitHub.
+      DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # note: important to have chart-testing work (see https://github.com/helm/chart-testing/issues/186)
           fetch-depth: 0
-      - name: Setup Node.js
-        uses: actions/setup-node@v7
-        with:
-          node-version: 22
-          cache: npm
-      - name: Install Node.js dependencies
-        run: npm install
-      - name: Build with VitePress
-        run: npm run docs:build
       - name: Install Helm
-        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
-        with:
-          version: latest
+        uses: devpro/github-workflow-parts/actions/helm/setup@591b0c7bfba6fbc7b0cab7d896447e0732b819de
       - name: Install kube-linter
-        env:
-          KUBE_LINTER_VERSION: "0.8.3"
-          KUBE_LINTER_SHA256: "1a6d8419b11971372971fdbc22682b684ebfb7cf1c39591662d1b6ca736c41df"
-        run: |
-          curl -sSLo kube-linter.tar.gz "https://github.com/stackrox/kube-linter/releases/download/v${KUBE_LINTER_VERSION}/kube-linter-linux.tar.gz"
-          echo "${KUBE_LINTER_SHA256}  kube-linter.tar.gz" | sha256sum -c -
-          tar -xzf kube-linter.tar.gz kube-linter
-          sudo mv kube-linter /usr/local/bin/
-          rm kube-linter.tar.gz
+        uses: devpro/github-workflow-parts/actions/kube-linter/setup@591b0c7bfba6fbc7b0cab7d896447e0732b819de
       - name: Run kube-linter
         run: kube-linter lint charts --config .kube-linter.yaml
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
+        uses: devpro/github-workflow-parts/actions/chart-testing/setup@591b0c7bfba6fbc7b0cab7d896447e0732b819de
       - name: Add dependency chart repositories
         run: ./scripts/add_helm_repo.sh
       - name: List changed charts
         id: list-changed
         run: |
-          changed=$(ct list-changed ${CHARTS_DIRECTORIES_ARG} --target-branch ${{ github.event.repository.default_branch }})
+          changed=$(ct list-changed ${CHARTS_DIRECTORIES_ARG} --target-branch "$DEFAULT_BRANCH")
           charts=$(echo "$changed" | tr '\n' ' ' | xargs)
           if [[ -n "$changed" ]]; then
-            echo "changed=true" >> $GITHUB_OUTPUT
-            echo "changed_charts=$charts" >> $GITHUB_OUTPUT
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "changed_charts=$charts" >> "$GITHUB_OUTPUT"
           fi
       - name: Lint charts
         if: steps.list-changed.outputs.changed == 'true'
-        run: ct lint $CHARTS_DIRECTORIES_ARG --target-branch ${{ github.event.repository.default_branch }}
-      # TODO: Enable when https://github.com/stackrox/kube-linter/issues/575 is fixed
-      # - name: Scan yamls
-      #   id: kube-lint-scan
-      #   uses: stackrox/kube-linter-action@v1
-      #   with:
-      #     directory: charts
-      #     config: .kube-linter.yaml
-      # TODO: debug & fix
-      # - name: Create kind cluster
-      #   uses: helm/kind-action@v1.4.0
-      #   if: steps.list-changed.outputs.changed == 'true'
-      # - name: Run chart-testing (install)
-      #   run: ct install $CHARTS_DIRECTORIES_ARG --target-branch ${{ github.event.repository.default_branch }}
-      #   if: steps.list-changed.outputs.changed == 'true'
+        run: ct lint $CHARTS_DIRECTORIES_ARG --target-branch "$DEFAULT_BRANCH"
+      - name: Install kubeconform
+        uses: devpro/github-workflow-parts/actions/kubeconform/setup@591b0c7bfba6fbc7b0cab7d896447e0732b819de
+      - name: Validate manifests against the Kubernetes schemas
+        run: ./scripts/validate_charts.sh
+      # The standalone binary of the helm-unittest plugin, so no plugin is installed into Helm.
+      - name: Install helm-unittest
+        uses: devpro/github-workflow-parts/actions/helm-unittest/setup@591b0c7bfba6fbc7b0cab7d896447e0732b819de
+      - name: Run chart unit tests
+        run: |
+          charts=$(dirname charts/*/tests | sort -u)
+          untt $charts
+
+  # A job of its own, which IstarCI leaves out of a local run: the kind node runs as a privileged container on the Docker it is given.
+  charts-install:
+    name: Charts install
+    needs: charts
+    if: needs.charts.outputs.changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: Install Helm
+        uses: devpro/github-workflow-parts/actions/helm/setup@591b0c7bfba6fbc7b0cab7d896447e0732b819de
+      - name: Set up chart-testing
+        uses: devpro/github-workflow-parts/actions/chart-testing/setup@591b0c7bfba6fbc7b0cab7d896447e0732b819de
+      - name: Add dependency chart repositories
+        run: ./scripts/add_helm_repo.sh
+      # kind and kubectl are installed by an action of the workflow parts, as helm/kind-action is a JavaScript action, and a container image has neither preinstalled.
+      - name: Install kind and kubectl
+        uses: devpro/github-workflow-parts/actions/kind/setup@591b0c7bfba6fbc7b0cab7d896447e0732b819de
+      # The cluster name carries the run, so two runs on one Docker daemon never share a cluster.
+      - name: Create kind cluster
+        id: create-cluster
+        run: kind create cluster --name "ct-${GITHUB_RUN_ID}" --image kindest/node:v1.36.4@sha256:099e049362a1526b2db71494e1947aae99bd16290d7c895f2b7ea312e3cbfaed --wait 120s
+      - name: Install charts
+        env:
+          # Charts that cannot reach a ready state on a bare cluster, given here rather than in ct.yaml so that ct lint still covers them.
+          # Custom resources only, whose CRDs a bare cluster lacks: capi-templates, gitops-bootstrap, letsencrypt, rancher-cluster-templates.
+          # Cloud providers and storage drivers: azure-storage, outscale.
+          # Private images, which the cluster cannot pull: fallstar, liveship, sidelab, trackboard.
+          # Default images no longer published: wordpress.
+          EXCLUDED_CHARTS: >-
+            capi-templates,gitops-bootstrap,letsencrypt,rancher-cluster-templates,
+            azure-storage,outscale,
+            fallstar,liveship,sidelab,trackboard,
+            wordpress
+          # Installs side by side on the one cluster, each chart in a release and a namespace of its own.
+          PARALLEL_INSTALLS: "3"
+          CHANGED_CHARTS: ${{ needs.charts.outputs.changed-charts }}
+        run: |
+          excluded=",${EXCLUDED_CHARTS// /},"
+          charts=()
+          for path in $CHANGED_CHARTS; do
+            [[ "$excluded" == *",$(basename "$path"),"* ]] || charts+=("$path")
+          done
+          if [ "${#charts[@]}" -eq 0 ]; then
+            echo "No changed chart to install"
+            exit 0
+          fi
+          # Each install writes a log of its own, shown chart by chart once all are done, rather than interleaved.
+          logs="$(mktemp -d)"
+          printf '%s\n' "${charts[@]}" | xargs -P "$PARALLEL_INSTALLS" -I{} bash -c '
+            name="$(basename "$1")"
+            if ct install --charts "$1" --helm-extra-args "--timeout 300s" > "$2/$name.log" 2>&1; then
+              echo "$name: installed"
+            else
+              echo "$name: failed"
+              echo "$name" >> "$2/failed"
+            fi' _ {} "$logs"
+          for path in "${charts[@]}"; do
+            echo "::group::$(basename "$path")"
+            cat "$logs/$(basename "$path").log"
+            echo "::endgroup::"
+          done
+          if [ -s "$logs/failed" ]; then
+            echo "::error::Charts that did not install: $(tr '\n' ' ' < "$logs/failed")"
+            exit 1
+          fi
+      # Only a cluster this run created, since a failure before it leaves neither kind nor a cluster.
+      - name: Delete kind cluster
+        if: always() && steps.create-cluster.outcome != 'skipped' && steps.create-cluster.outcome != ''
+        run: kind delete cluster --name "ct-${GITHUB_RUN_ID}"

.github/workflows/pkg.yml

@@ -1,4 +1,4 @@
-# title: Continuous Delivery (Packaging)
+# title: Continuous Delivery (Packaging)
 # requirements:
 #   - Create manually "gh-pages" branch
 #   - Maintain pages files in "gh-pages" branch: index.tpl, placeholder.png
@@ -29,14 +29,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout git repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - name: Setup Node.js
-        uses: actions/setup-node@v7
-        with:
-          node-version: 22
-          cache: npm
       # ref. https://vitepress.dev/guide/deploy#github-pages
       # - name: Install Node.js dependencies
       #   run: npm install
@@ -53,9 +48,7 @@ jobs:
           git config user.name "$GITHUB_ACTOR"
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
       - name: Install Helm
-        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
-        with:
-          version: latest
+        uses: devpro/github-workflow-parts/actions/helm/setup@591b0c7bfba6fbc7b0cab7d896447e0732b819de
       - name: Add dependency chart repositories
         run: ./scripts/add_helm_repo.sh
       - name: Host charts repository on GitHub Pages
@@ -65,23 +58,27 @@ jobs:
       # important: it needs to be done in the same pipeline as another pages workflow won't be triggered by the pust on the gh-pages branch
       # (tried with a PAT and several options but didn't work)
       - name: Checkout gh-pages branch
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: gh-pages
       # - uses: actions/download-artifact@v4
       #   with:
       #     name: docs
       #     path: docs
+      # A Go of its own rather than the one of the runner image, which changes with it.
       - name: Setup Go environment
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: "1.27.3"
+          cache: false
       - name: Generate index.html
         run: |
           go install github.com/halkeye/helm-repo-html@v0.2.1
-          /home/runner/go/bin/helm-repo-html
+          "$(go env GOPATH)/bin/helm-repo-html"
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
       - name: Build with Jekyll
-        uses: actions/jekyll-build-pages@v1
+        uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1.0.13
         with:
           source: ./
           destination: ./_site
@@ -92,7 +89,7 @@ jobs:
       #     sudo mkdir -p ./_site/docs
       #     sudo cp -r docs/* ./_site/docs/
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
   deploy:
     runs-on: ubuntu-latest
     needs: build
@@ -102,4 +99,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.gitignore

@@ -1,4 +1,4 @@
-# local downloaded chart compressed files
+# local downloaded chart compressed files
 /**/charts/*.tgz
 
 # local temporary files

.istarci.yml

@@ -0,0 +1,3 @@
+workflow:
+  # ct install runs a kind node, a privileged container, on the Docker of the machine, so it runs on GitHub only, on a runner thrown away after the job.
+  skipJobs: [charts-install]

.kube-linter.yaml

@@ -1,4 +1,4 @@
-checks:
+checks:
   addAllBuiltIn: true
   # ref. https://docs.kubelinter.io/#/generated/checks
   exclude:

.markdownlint-cli2.yaml

@@ -1,4 +1,4 @@
-gitignore: true
+gitignore: true
 ignores:
   - "**/node_modules/**"
   - "CLAUDE.md"

.yamllint.yaml

@@ -1,7 +1,15 @@
 extends: default
 
+# Helm templates are Go templates that render to YAML, not YAML themselves.
+ignore:
+  - "charts/*/templates/**"
+  - "samples/charts/*/templates/**"
+
 rules:
   line-length:
     level: warning
     max: 180
   truthy: disable
+  # The Fallstar recipes and Fleet patches write their flow mappings with a space inside the braces.
+  braces:
+    max-spaces-inside: 1

AGENTS.md

@@ -1,4 +1,4 @@
-# helm-charts: agent context
+# helm-charts: agent context
 
 ## What this is
 
@@ -22,6 +22,8 @@ helm lint charts/<chart>                                                  # lint
 helm template myapp charts/<chart> -f values.yaml --namespace myns        # render the manifests
 helm upgrade --install myapp charts/<chart> -f values.yaml --namespace myns --create-namespace
 kube-linter lint charts --config .kube-linter.yaml                        # the check CI runs
+scripts/validate_charts.sh [charts/<chart>]                               # validate the rendered manifests with kubeconform
+untt charts/<chart>                                                       # run the chart unit tests (helm-unittest binary)
 npm run docs:dev                                                          # serve the documentation site
 ```
 
@@ -36,6 +38,8 @@ Where a chart pins an image tag in `values.yaml`, that tag and `appVersion` must
 - Chart values are documented with `# --` comments above the key, which is the helm-docs annotation form.
 - A chart that packages a devpro application keeps its values structure close to the application's configuration keys, so that a setting can be traced from `values.yaml` to the environment variable it becomes.
 - CI runs `kube-linter` over `charts/` with `.kube-linter.yaml`, and `ct lint` over the charts changed against `main`.
+- CI renders every chart with each of its `ci/*-values.yaml` files and validates the manifests with kubeconform, so a chart that needs values to render has a `ci/` directory.
+- Unit tests of a chart live in its `tests/` directory as helm-unittest suites, listed in its `.helmignore` so they are not packaged.
   Exclusions belong in `.kube-linter.yaml` with a comment saying why.
 - Markdown and YAML are linted in CI through `.markdownlint-cli2.yaml` and `.yamllint.yaml`.
 - Do not run markdownlint: linting is run manually by the maintainer and in CI.

CONTRIBUTING.md

@@ -1,4 +1,4 @@
-# Contributing
+# Contributing
 
 ## File organization
 
@@ -140,3 +140,8 @@ This is a details block.
 ```
 
 - [Markdown Extensions](https://vitepress.dev/guide/markdown)
+
+## Run the pipeline locally
+
+[IstarCI](https://github.com/devpro/istarci) runs the GitHub Actions pipeline in Docker before the push.
+`istarci add` and `istarci install-hook` set it up for this repository.

README.md

@@ -1,4 +1,4 @@
-# Devpro Helm Charts
+# Devpro Helm Charts
 
 [![CI](https://github.com/devpro/helm-charts/actions/workflows/ci.yml/badge.svg)](https://github.com/devpro/helm-charts/actions/workflows/ci.yml)
 [![PKG](https://github.com/devpro/helm-charts/actions/workflows/pkg.yml/badge.svg)](https://github.com/devpro/helm-charts/actions/workflows/pkg.yml)

charts/capi-templates/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: capi-templates
 description: Helm chart for Cluster API (CAPI) Templates
 type: application
-version: 0.1.2
+version: 0.1.3
 appVersion: "1.0.0"
 home: https://github.com/devpro/helm-charts/tree/main/charts/capi-templates
 maintainers:

charts/capi-templates/ci/ci-values.yaml

@@ -0,0 +1,9 @@
+name: ci-cluster
+type: gke
+googlecloud:
+  project: ci-project
+  region: europe-west1
+  zone: europe-west1-b
+  vpc: ci-vpc
+  subnet:
+    name: ci-subnet