From 4e3b4180fcc4c907fc064e9d5b1d4874fea40e48 Mon Sep 17 00:00:00 2001
From: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Date: Thu, 2 Apr 2026 07:47:09 +0000
Subject: [PATCH] feat(ci): add Helm chart lint and template validation to CI

Add kubeconform manifest validation to the existing helm CI job.
The helm job already had helm lint and helm template steps (added in
#1085). This commit completes the optional acceptance criterion from
#1089 by adding kubeconform v0.7.0 to validate rendered manifests
against the Kubernetes 1.29.0 schema in strict mode.

Changes:
- Install kubeconform v0.7.0 in the helm CI job
- Add 'Validate rendered manifests with kubeconform' step after
  helm template smoke render (strict mode, ignore-missing-schemas,
  kubernetes-version 1.29.0)
- Add 5 BDD scenarios to ci_workflow_validation.feature covering:
  - helm job existence
  - helm lint step
  - helm template step
  - kubeconform validation step
  - status-check dependency on helm job

ISSUES CLOSED: #1089
---
 .forgejo/workflows/ci.yml               | 23 ++++++++++++++++++++-
 features/ci_workflow_validation.feature | 27 +++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index a9c4c570a..712a8231f 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -498,7 +498,7 @@ jobs:
         container:
             image: python:3.13-slim
         steps:
-            - name: Install system dependencies (nodejs for checkout, curl for Helm)
+            - name: Install system dependencies (nodejs for checkout, curl for Helm and kubeconform)
               run: |
                   apt-get update && apt-get install -y -qq nodejs curl tar && rm -rf /var/lib/apt/lists/*
 
@@ -517,6 +517,18 @@ jobs:
                   chmod +x /usr/local/bin/helm
                   helm version --short
 
+            - name: Install kubeconform
+              run: |
+                  KUBECONFORM_VERSION="v0.7.0"
+                  ARCH="amd64"
+                  KUBECONFORM_TARBALL="kubeconform-linux-${ARCH}.tar.gz"
+                  curl -fsSL "https://github.com/yannh/kubeconform/releases/download/${KUBECONFORM_VERSION}/${KUBECONFORM_TARBALL}" \
+                    -o "/tmp/${KUBECONFORM_TARBALL}"
+                  tar -xzf "/tmp/${KUBECONFORM_TARBALL}" -C /tmp
+                  mv /tmp/kubeconform /usr/local/bin/kubeconform
+                  chmod +x /usr/local/bin/kubeconform
+                  kubeconform -v
+
             - name: Build Helm chart dependencies
               run: |
                   helm dependency build ./k8s
@@ -532,6 +544,15 @@ jobs:
                     --set database.url="postgresql+asyncpg://user:pass@db-host:5432/cleveragents" >/tmp/rendered.yaml
                   test -s /tmp/rendered.yaml
 
+            - name: Validate rendered manifests with kubeconform
+              run: |
+                  kubeconform \
+                    -strict \
+                    -ignore-missing-schemas \
+                    -kubernetes-version 1.29.0 \
+                    -summary \
+                    /tmp/rendered.yaml
+
     status-check:
         if: always()
         needs: [lint, typecheck, security, quality, unit_tests, integration_tests, e2e_tests, coverage, build, docker, helm]
diff --git a/features/ci_workflow_validation.feature b/features/ci_workflow_validation.feature
index eaf486276..356ff0f4d 100644
--- a/features/ci_workflow_validation.feature
+++ b/features/ci_workflow_validation.feature
@@ -154,3 +154,30 @@ Feature: CI workflow validation
     Given the CI workflow file at ".forgejo/workflows/ci.yml"
     When I parse the CI workflow YAML
     Then at least one job should use actions/cache
+
+  # --- Helm CI job ---
+
+  Scenario: CI workflow has helm validation job
+    Given the CI workflow file at ".forgejo/workflows/ci.yml"
+    When I parse the CI workflow YAML
+    Then the workflow should have a job named "helm"
+
+  Scenario: Helm job runs helm lint
+    Given the CI workflow file at ".forgejo/workflows/ci.yml"
+    When I parse the CI workflow YAML
+    Then the job "helm" should run "helm lint"
+
+  Scenario: Helm job runs helm template
+    Given the CI workflow file at ".forgejo/workflows/ci.yml"
+    When I parse the CI workflow YAML
+    Then the job "helm" should run "helm template"
+
+  Scenario: Helm job validates rendered manifests with kubeconform
+    Given the CI workflow file at ".forgejo/workflows/ci.yml"
+    When I parse the CI workflow YAML
+    Then the job "helm" should run "kubeconform"
+
+  Scenario: Status-check job depends on helm job
+    Given the CI workflow file at ".forgejo/workflows/ci.yml"
+    When I parse the CI workflow YAML
+    Then the job "status-check" should depend on "helm"
-- 
2.52.0