action.yml

---
name: "Test Helm Chart"
description: |
  Action to lint and test installing some Helm chart(s).
  Mainly using [helm/chart-testing-action](https://github.com/helm/chart-testing-action).
author: hoverkraft
branding:
  icon: check-circle
  color: blue

inputs:
  working-directory:
    description: "Working directory"
    required: false
    default: "${{ github.workspace }}"
  helm-set:
    description: |
      Set values for Helm chart.
      Multiple values can be set using multiline string.
      Example:
      ```
      key1=value1
      key2=value2
      ```
    required: false
  helm-repositories:
    description: |
      List of Helm repositories to add before testing charts.
      See https://helm.sh/docs/helm/helm_repo_add/.
    required: false
  oci-registry:
    description: "OCI registry where to pull and push images"
    default: "ghcr.io"
    required: false
  oci-registry-username:
    description: |
      Username used to log against the OCI registry.
      See https://github.com/docker/login-action#usage.
    default: ${{ github.repository_owner }}
    required: false
  oci-registry-password:
    description: |
      Password or personal access token used to log against the OCI registry.
      Can be passed in using `secrets.GITHUB_TOKEN`.
      See https://github.com/docker/login-action#usage.
    default: ${{ github.token }}
    required: false
  check-diff-only:
    description: |
      Only run lint and tests on changed charts.
    required: false
    default: "true"
  enable-lint:
    description: |
      Enable linting of the Helm chart.
      See https://github.com/helm/chart-testing/blob/main/doc/ct_lint.md.
    required: false
    default: "true"
  enable-install:
    description: |
      Enable installing the Helm chart.
      See https://github.com/helm/chart-testing/blob/main/doc/ct_install.md.
    required: false
    default: "true"

runs:
  using: "composite"
  steps:
    - shell: bash
      if: ${{ inputs.enable-lint != 'true' && inputs.enable-install != 'true' }}
      run: |
        echo "::error ::At least one of 'enable-lint' or 'enable-install' input must be true"
        exit 1

    - uses: hoverkraft-tech/ci-github-common/actions/checkout@4b53189212d5810f710bed89711002626977215b # 0.33.0
      with:
        fetch-depth: 0

    - name: Check for .tools-version file
      id: check-tools-version
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      run: |
        if [[ -f .tools-version ]]; then
          echo "tools-version-exists=true" >> "$GITHUB_OUTPUT"
        else
          echo "tools-version-exists=false" >> "$GITHUB_OUTPUT"
        fi

    - name: Install tools with asdf
      if: ${{ steps.check-tools-version.outputs.tools-version-exists == 'true' }}
      uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4.0.1

    - name: Check for ct.yaml file
      id: check-ct-yaml
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      run: |
        if [[ -f ct.yaml ]]; then
          echo "path=ct.yaml" >> "$GITHUB_OUTPUT"
        fi

    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0

    - name: Set up chart-testing
      uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0

    - shell: bash
      run: |
        # For each line in the input, add the Helm repository
        echo "${{ inputs.helm-repositories }}" | while read -r line; do
          if [ -z "$line" ]; then
            continue
          fi

          # shellcheck disable=SC2086
          helm repo add $line
        done

    - name: Prepare ct variables
      id: prepare-ct-variables
      shell: bash
      run: |
        if [ "${{ inputs.check-diff-only }}" == "true" ]; then
          if [ "${{ github.event_name }}" == "pull_request" ]; then
            TARGET_BRANCH="${{ github.event.pull_request.base.ref }}"
          else
            TARGET_BRANCH="${{ github.event.repository.default_branch }}"
          fi
          CT_ARGS="--target-branch $TARGET_BRANCH"
        fi

        if [ -n "${{ steps.check-ct-yaml.outputs.path }}" ]; then
          CT_ARGS="$CT_ARGS --config ${{ steps.check-ct-yaml.outputs.path }}"
        fi

        if [ -z "$CT_ARGS" ]; then
          CT_ARGS="--all"
        fi

        echo "args=$CT_ARGS" >> "$GITHUB_OUTPUT"

        # Namespace for the test cluster
        NAMESPACE="test-chart-${{ github.run_id}}-$(uuidgen)"
        echo "namespace=$NAMESPACE" >> "$GITHUB_OUTPUT"

    - name: Run chart-testing (lint)
      if: ${{ inputs.enable-lint == 'true' }}
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      run: |
        ct lint ${{ steps.prepare-ct-variables.outputs.args }}

    - name: Create kind cluster
      if: ${{ inputs.enable-install == 'true' }}
      uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0

    - name: Install default OCI registry secrets
      id: oci-registry-secret
      if: ${{ inputs.enable-install == 'true' && inputs.oci-registry != '' && inputs.oci-registry-username != '' && inputs.oci-registry-password != '' }}
      shell: bash
      run: |
        SECRET_NAME="regcred"
        echo "oci-registry-secret=$SECRET_NAME" >> "$GITHUB_OUTPUT"

        # See https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
        NAMESPACE="${{ steps.prepare-ct-variables.outputs.namespace }}"
        kubectl create namespace "$NAMESPACE"

        SECRET_NAME="regcred"
        DOCKER_REGISTRY="${{ inputs.oci-registry }}"
        DOCKER_USERNAME="${{ inputs.oci-registry-username }}"
        DOCKER_PASSWORD="${{ inputs.oci-registry-password }}"

        kubectl --context kind-chart-testing create secret docker-registry "$SECRET_NAME" \
          --namespace="$NAMESPACE" \
          --docker-server=$DOCKER_REGISTRY \
          --docker-username=$DOCKER_USERNAME \
          --docker-password=$DOCKER_PASSWORD

    - name: Run chart-testing (install)
      if: ${{ inputs.enable-install == 'true' }}
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      env:
        HELM_EXPERIMENTAL_OCI: true
      run: |
        NAMESPACE="${{ steps.prepare-ct-variables.outputs.namespace }}"

        HELM_SET="namespace=$NAMESPACE
        ${{ inputs.helm-set }}"

        OCI_REGISTRY_SECRET="${{ steps.oci-registry-secret.outputs.oci-registry-secret }}"
        if [ -n "$OCI_REGISTRY_SECRET" ]; then
          # Ensure secret exists
          kubectl get secret "$OCI_REGISTRY_SECRET" --output=yaml --namespace=$NAMESPACE

          HELM_SET="$HELM_SET
          imagePullSecrets[0].name=${OCI_REGISTRY_SECRET}"
        fi

        HELM_EXTRA_SET_ARGS=""
        if [ -n "$HELM_SET" ]; then
          IFS=$'\n' read -r -d '' -a lines <<< "$HELM_SET" || true
          for line in "${lines[@]}"; do
            if [ -z "$line" ]; then
              continue
            fi
            # Remove leading and trailing whitespace
            line=$(echo "$line" | xargs) || true

            # Escape commas in the line
            line=$(echo "$line" | sed 's/,/\\,/g') || true

            if [ -n "$HELM_EXTRA_SET_ARGS" ]; then
              HELM_EXTRA_SET_ARGS="${HELM_EXTRA_SET_ARGS},"
            fi

            HELM_EXTRA_SET_ARGS="${HELM_EXTRA_SET_ARGS}${line}"
          done
        fi

        HELM_EXTRA_SET_ARGS="--set=${HELM_EXTRA_SET_ARGS}"

        COMMAND="ct install ${{ steps.prepare-ct-variables.outputs.args }} --namespace $NAMESPACE --helm-extra-set-args='${HELM_EXTRA_SET_ARGS}'"
        echo "::debug ::$COMMAND"

        # shellcheck disable=SC2086
        eval $COMMAND