.forgejo/workflows/ci.yml

@@ -498,7 +498,7 @@ jobs:
         container:
             image: python:3.13-slim
         steps:
-            - name: Install system dependencies (nodejs for checkout, curl for Helm)
+            - name: Install system dependencies (nodejs for checkout, curl for Helm and kubeconform)
               run: |
                   apt-get update && apt-get install -y -qq nodejs curl tar && rm -rf /var/lib/apt/lists/*
 
@@ -517,6 +517,18 @@ jobs:
                   chmod +x /usr/local/bin/helm
                   helm version --short
 
+            - name: Install kubeconform
+              run: |
+                  KUBECONFORM_VERSION="v0.7.0"
+                  ARCH="amd64"
+                  KUBECONFORM_TARBALL="kubeconform-linux-${ARCH}.tar.gz"
+                  curl -fsSL "https://github.com/yannh/kubeconform/releases/download/${KUBECONFORM_VERSION}/${KUBECONFORM_TARBALL}" \
+                    -o "/tmp/${KUBECONFORM_TARBALL}"
+                  tar -xzf "/tmp/${KUBECONFORM_TARBALL}" -C /tmp
+                  mv /tmp/kubeconform /usr/local/bin/kubeconform
+                  chmod +x /usr/local/bin/kubeconform
+                  kubeconform -v
+
             - name: Build Helm chart dependencies
               run: |
                   helm dependency build ./k8s
@@ -532,6 +544,15 @@ jobs:
                     --set database.url="postgresql+asyncpg://user:pass@db-host:5432/cleveragents" >/tmp/rendered.yaml
                   test -s /tmp/rendered.yaml
 
+            - name: Validate rendered manifests with kubeconform
+              run: |
+                  kubeconform \
+                    -strict \
+                    -ignore-missing-schemas \
+                    -kubernetes-version 1.29.0 \
+                    -summary \
+                    /tmp/rendered.yaml
+
     status-check:
         if: always()
         needs: [lint, typecheck, security, quality, unit_tests, integration_tests, e2e_tests, coverage, build, docker, helm]

features/ci_workflow_validation.feature

@@ -154,3 +154,30 @@ Feature: CI workflow validation
     Given the CI workflow file at ".forgejo/workflows/ci.yml"
     When I parse the CI workflow YAML
     Then at least one job should use actions/cache
+
+  # --- Helm CI job ---
+
+  Scenario: CI workflow has helm validation job
+    Given the CI workflow file at ".forgejo/workflows/ci.yml"
+    When I parse the CI workflow YAML
+    Then the workflow should have a job named "helm"
+
+  Scenario: Helm job runs helm lint
+    Given the CI workflow file at ".forgejo/workflows/ci.yml"
+    When I parse the CI workflow YAML
+    Then the job "helm" should run "helm lint"
+
+  Scenario: Helm job runs helm template
+    Given the CI workflow file at ".forgejo/workflows/ci.yml"
+    When I parse the CI workflow YAML
+    Then the job "helm" should run "helm template"
+
+  Scenario: Helm job validates rendered manifests with kubeconform
+    Given the CI workflow file at ".forgejo/workflows/ci.yml"
+    When I parse the CI workflow YAML
+    Then the job "helm" should run "kubeconform"
+
+  Scenario: Status-check job depends on helm job
+    Given the CI workflow file at ".forgejo/workflows/ci.yml"
+    When I parse the CI workflow YAML
+    Then the job "status-check" should depend on "helm"