HYPERFLEET-1321 - test: add entity render scenarios and refactor test-helm script

[rafabene]

Summary

• Add 3 new test-helm scenarios that render the configmap with entities configured (Channel, Version, WifConfig), validate the rendered config.yaml is parseable YAML (python3 yaml.safe_load), and run kubeconform — would have caught the HYPERFLEET-1320 bug before merge
• Refactor all 18 existing + 3 new test scenarios from inline Makefile commands (~250 lines) into scripts/test-helm.sh with reusable helper functions (render, assert_contains, validate_yaml, extract_config_yaml)
• Add charts/ci/entities-all-fields-values.yaml test fixture exercising all optional entity fields (parent_kind, on_parent_delete, references, required_adapters)

Test plan

• make test-helm passes all 21 scenarios
• make lint passes with 0 issues
• Verify the entity tests would catch HYPERFLEET-1320-style bugs (invalid YAML from Go template in comment)

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Moves Helm validation out of Makefile into scripts/test-helm.sh, with KUBECONFORM and YQ passed through to the script. Adds bingo-managed yq wiring in .bingo/Variables.mk, .bingo/variables.env, and .bingo/yq.mod. Adds charts/ci/entities-all-fields-values.yaml for entity-rendering coverage. The script now runs Helm lint/render checks, kubeconform validation, yq YAML validation, validation-schema checks, and entity output assertions.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested labels: ci, testing, dependencies, supply-chain

Suggested reviewers: platform-team, ci-maintainers

CWE-494: external schema locations are consumed by kubeconform during chart validation.
CWE-937: the test path now depends on generated bingo-managed tool metadata for yq.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	No slog/logr/zap/fmt.Print* statements interpolate token/password/credential/secret; only test inputs and generic echoes appear. CWE-532 not triggered.
No Hardcoded Secrets	✅ Passed	No new hardcoded secrets, embedded creds, or key-like literals; .bingo/yq.sum is dependency checksums, not secret material. No CWE-798/259/321 issue.
No Weak Cryptography	✅ Passed	No md5/des/rc4, ECB, SHA1-for-security, custom crypto, or secret compares found in changed files; CWE-327 not implicated.
No Injection Vectors	✅ Passed	No CWE-89/78/79/502 vector found: new shell/Makefile paths use hardcoded args, no exec/eval/template.HTML/yaml.Unmarshal on untrusted input.
No Privileged Containers	✅ Passed	Changed files are Makefile/scripts/fixtures only; keyword scan found no privileged:true, hostNetwork, hostPID, allowPrivilegeEscalation, runAsUser:0, or USER root.
No Pii Or Sensitive Data In Logs	✅ Passed	No added logs expose PII, sessions, raw bodies, or credentialed hostnames; the new echo/printf output is static test status only (CWE-532/CWE-200 not triggered).
Title check	✅ Passed	Title matches the main change: add entity render scenarios and refactor test-helm into a shell script.
Description check	✅ Passed	Description aligns with the changeset: new entity render tests, shell-script refactor, and the new values fixture.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

_{Comment @coderabbitai help to get the list of available commands.}

[hyperfleet-ci-bot]

Risk Score: 2 — risk/medium

Signal	Detail	Points
PR size	642 lines (>500)	+2
Sensitive paths	none	+0

_{Computed by hyperfleet-risk-scorer}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/test-helm.sh`:
- Around line 42-75: The assertion helpers in assert_contains and
assert_not_contains currently return a non-zero status on failure, which
triggers set -e and stops script execution before the summary and remaining
tests run. Update these functions so they still call fail() but return 0
afterward, allowing the top-level test calls to continue while FAILED/PASSED
counters and the final exit check in the script handle overall failure.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 2f603277-6b3e-4b94-a8fe-9361584c23d9

📥 Commits

Reviewing files that changed from the base of the PR and between 29dffce and 86113dd.

📒 Files selected for processing (3)

• Makefile
• charts/ci/entities-all-fields-values.yaml
• scripts/test-helm.sh

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual)
• openshift-hyperfleet/hyperfleet-broker (manual)

[rafabene]

/retest

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/test-helm.sh`:
- Around line 9-14: The kubeconform remote schema source in the
KUBECONFORM_FLAGS setup is pinned to the mutable datreeio/CRDs-catalog main
branch, which should be made immutable. Update the schema-location used in
scripts/test-helm.sh to reference a fixed tag or commit SHA instead of main, and
keep the existing KUBECONFORM_FLAGS array entry and kubeconform invocation
aligned with that pinned source.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 5b3e6ad1-7f32-41cb-94c4-d5f07576e40e

📥 Commits

Reviewing files that changed from the base of the PR and between 386ec0d and 1b028d5.

⛔ Files ignored due to path filters (1)

• .bingo/yq.sum is excluded by !**/*.sum

📒 Files selected for processing (6)

• .bingo/Variables.mk
• .bingo/variables.env
• .bingo/yq.mod
• Makefile
• charts/ci/entities-all-fields-values.yaml
• scripts/test-helm.sh

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual)
• openshift-hyperfleet/hyperfleet-broker (manual)

✅ Files skipped from review due to trivial changes (2)

• .bingo/variables.env
• .bingo/yq.mod

🚧 Files skipped from review as they are similar to previous changes (2)

• Makefile
• charts/ci/entities-all-fields-values.yaml

[tirthct]

Re: PR title / commit message

Warning

Blocking

Category: Standards

The PR title / commit subject is 77 chars (excluding the HYPERFLEET-1321 - prefix), which exceeds the 72-char limit in commit-standard.md. This looks like the cause of the currently-failing ci/prow/validate-commits required check.

Since this repo uses squash merges, the PR title is the final commit message — worth shortening both. Something like:

HYPERFLEET-1321 - test: add entity render scenarios and refactor test-helm script

(63 chars for the test: ... portion, under the limit.)

[Ruclo]

Are there any plans to use helm unittest in the future?

[rafabene]

@Ruclo Not at the moment — the current shell-based approach covers our needs (lint, template rendering, kubeconform validation, YAML parsing, and content assertions). helm-unittest would give us snapshot testing and more structured assertions, but it also adds another tool dependency and a different test authoring style. Open to revisiting if the test scenarios grow more complex or if the team sees value in it.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tirthct

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [tirthct]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@rafabene: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/presubmits-integration	08fd23f	link	unknown	/test presubmits-integration

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.