[CI] publish master helm-chart - #80
Conversation
This patch makes provisioning of VPC on all edges optional and based on the the omni.cast.ai/provision-on-all-edge-nodes annotation
this patch fixes an issue with the virtual kubelet: when it starts the node is created only with unknown conditions. This is because the input from the RemoteNode and ForeignCluster are applied only after the node is created, during the reconcile. This patch introduces an hydrate function, which populate the node before its creation.
Introduce VK reflection of the following resources: - ResourceSlice - DeviceClass - ResourceClaim
Kimchi Code Review
Summary📊 Review Score: 68/100 (overall code quality — 0 lowest, 100 highest) 🧪 Tests: no — No automated tests are included for GitHub Actions workflow changes; validation would require running the workflow on a fork or with act. 🔒 Security concerns found: The 📝 Found 4 issue(s). See inline comments for details. What to expectKimchi will analyze the changes in this pull request and post:
The review typically completes within a few minutes. This comment will be updated once the review is ready. Interact with Kimchi
ConfigurationReviews are configured by your organization admin. Powered by Kimchi — AI-powered code review by CAST AI |
![kimchi-review[bot]](https://avatars.githubusercontent.com/in/3223788?s=60&v=4){kind=small}
There was a problem hiding this comment.
📊 Review Score: 62/100 (overall code quality — 0 lowest, 100 highest)
⏱️ Estimated effort to review: 3/5 (1 = trivial, 5 = very complex)
🧪 Tests: no — No tests were added or modified. This is a GitHub Actions workflow change, which typically relies on manual workflow validation rather than unit tests, but no workflow-level tests or validation scripts were introduced.
🔒 Security concerns found: The Publish chart to GitHub Pages step embeds ${{ secrets.GITHUB_TOKEN }} directly into a Git remote URL (https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/...). Although GitHub Actions masks secrets in logs, constructing URLs containing secrets can lead to exposure in error messages, process listings, or third-party tooling and is considered an unsafe secret-handling pattern. The actions/checkout step already disabled persist-credentials, which is good, but this step reintroduces credential persistence in URL form.
📝 Found 6 issue(s). See inline comments for details.
aac90a9 to
aef0a77
Compare
cheina97
changed the title
9732bc8 to
2627430
Compare
|
@getkimchi review |
|
🔄 Starting review on |
There was a problem hiding this comment.
📊 Review Score: 68/100 (overall code quality — 0 lowest, 100 highest)
⏱️ Estimated effort to review: 2/5 (1 = trivial, 5 = very complex)
🧪 Tests: no — No automated tests are included for GitHub Actions workflow changes; validation would require running the workflow on a fork or with act.
🔒 Security concerns found: The GITHUB_TOKEN is embedded directly in the git remote URL for pushing to gh-pages, which increases exposure risk if logs leak or git commands print the remote. The workflow also lacks handling for concurrent updates to gh-pages.
📝 Found 4 issue(s). See inline comments for details.
2627430 to
7195225
Compare
|
Converting to draft as now we have this which does similar thing. Let's close this one eventually |
7 participants
ci: publish Helm charts for every master commit without GitHub Releases
What
Updates the
releasejob in.github/workflows/integration.ymlso that the Helm chart is published for every push tomaster, in addition to the existingv*tag releases. Master builds do not create a GitHub Release or git tag.Why
Today, testing upstream changes rebased onto the fork requires cutting a tag or a release. This makes it possible to install a chart built from the latest
mastercommit directly from the Helm repository, simply by referencing its SemVer prerelease version.How
branches: [master].releasejob runs onrefs/heads/masterin addition torefs/tags/v*.v0.x.x(unchanged).0.0.0-master.<short-sha>.gh-pagesbranch into acharts/directory, andindex.yamlis regenerated withhelm repo index ... --merge..Values.tagis set to the commit SHA so the chart pulls images from the-cisuffixed repositories (us-docker.pkg.dev/castai-hub/library/liqo/<component>-ci:<sha>).GITHUB_REPOSITORYinstead of being hardcoded tocastai/liqo.ncipollo/release-action+cr indexas before.crdownload, liqoctl artifact download, GitHub Releases,cr index) are skipped on master pushes.Chart release infostep prints the chart version, ref, commit, and install commands to the job summary.Versioning example
Usage
Verification
python3 -c 'import yaml; yaml.safe_load(...)'.actionlint; only pre-existing info-levelSC2086warnings in theconfigurejob remain.masteror tagging.Image tags for master charts
The master chart version is
0.0.0-master.<short-sha>, but the images referenced by the chart use the full commit SHA as the tag and the-cirepository suffix. For example:This matches what the
build-standardandbuild-gojobs push for non-tag commits.