Merge pull request #904 from rstudio/docs-fix/connect-recommended-exe… #2538
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint and Test Charts | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| merge_group: | |
| workflow_dispatch: | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0 | |
| - name: Add rstudio helm repo | |
| run: helm repo add rstudio https://helm.rstudio.com | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.10" | |
| - name: Set up chart-testing | |
| uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0 | |
| - name: Run chart-testing (list-changed) | |
| id: list-changed | |
| run: | | |
| changed=$(ct list-changed --use-helmignore --target-branch main --chart-dirs charts --chart-dirs other-charts) | |
| if [[ -n "$changed" ]]; then | |
| echo 'changed=true' >> $GITHUB_OUTPUT | |
| fi | |
| - name: Run chart-testing (lint changed) | |
| id: ct-lint | |
| if: steps.list-changed.outputs.changed == 'true' | |
| run: ct lint --use-helmignore --target-branch main --chart-dirs charts --chart-dirs other-charts | |
| continue-on-error: true | |
| - name: Run chart-testing (lint all) | |
| id: ct-lint-all | |
| run: ct lint --use-helmignore --target-branch main --all --chart-dirs charts --chart-dirs other-charts | |
| continue-on-error: true | |
| - name: Notify Slack of chart linting failure if on main | |
| if: github.ref == 'refs/heads/main' && (steps.ct-lint.outcome == 'failure' || steps.ct-lint-all.outcome == 'failure') | |
| uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3 | |
| with: | |
| payload-delimiter: "_" | |
| payload: | | |
| { | |
| "blocks": [ | |
| { | |
| "type": "section", | |
| "text": { | |
| "type": "mrkdwn", | |
| "text": "Linting failed for ${{ steps.ct-lint.outcome == 'failure' && 'changed' || 'all' }} charts. ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| } | |
| } | |
| ] | |
| } | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} | |
| SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK | |
| - name: Fail the workflow if failed linting | |
| if: steps.ct-lint.outcome == 'failure' || steps.ct-lint-all.outcome == 'failure' | |
| run: exit 1 | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0 | |
| with: | |
| version: "v3.19.2" | |
| - name: Install helm unittest plugin | |
| run: helm plugin install https://github.com/helm-unittest/helm-unittest.git --version v1.0.0 | |
| - name: Run chart unit tests | |
| id: unittest | |
| run: | | |
| # Run unit tests for charts with test suites | |
| for dir in charts/*/ other-charts/*/; do | |
| [ -d "$dir" ] || continue | |
| [ -d "$dir/tests" ] || continue | |
| (cd "$dir" && helm dependencies update) | |
| helm unittest "$dir" | |
| done | |
| continue-on-error: true | |
| # checks for uncommitted changes to any Chart.lock files | |
| - name: Git status check | |
| run: | | |
| ./tools/dev/check-uncommitted-changes.sh || \ | |
| (echo "run 'just update-lock' and commit the result." && exit 1) | |
| # checks that bumped chart versions have a corresponding NEWS.md entry | |
| - name: Check NEWS.md entries | |
| if: github.ref != 'refs/heads/main' | |
| run: ./tools/dev/check-news-entries.sh main | |
| - name: Notify Slack of chart unittest failure if on main | |
| if: github.ref == 'refs/heads/main' && steps.unittest.outcome == 'failure' | |
| uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3 | |
| with: | |
| payload-delimiter: "_" | |
| payload: | | |
| { | |
| "blocks": [ | |
| { | |
| "type": "section", | |
| "text": { | |
| "type": "mrkdwn", | |
| "text": "Chart unit tests failed. ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| } | |
| } | |
| ] | |
| } | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} | |
| SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK | |
| - name: Fail the workflow if failed unittest | |
| if: steps.unittest.outcome == 'failure' | |
| run: exit 1 | |
| install: | |
| runs-on: ubuntu-latest-4x | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0 | |
| - name: Add rstudio helm repo | |
| run: helm repo add rstudio https://helm.rstudio.com | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.10" | |
| - name: Set up chart-testing | |
| uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0 | |
| - name: Run chart-testing (list-changed) | |
| id: list-changed | |
| run: | | |
| changed=$(ct list-changed --use-helmignore --target-branch main --chart-dirs charts --chart-dirs other-charts) | |
| if [[ -n "$changed" ]]; then | |
| echo 'changed=true' >> $GITHUB_OUTPUT | |
| fi | |
| - name: Create kind cluster | |
| uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0 | |
| - name: Install SealedSecrets Helm Chart | |
| run: | | |
| helm repo add sealed-secrets https://bitnami.github.io/sealed-secrets | |
| helm install sealed-secrets sealed-secrets/sealed-secrets | |
| - name: Create posit-test namespace | |
| run: kubectl create namespace posit-test | |
| - name: Create License File Secrets | |
| env: | |
| PWB_LICENSE: ${{ secrets.PWB_LICENSE_FILE }} | |
| PCT_LICENSE: ${{ secrets.PCT_LICENSE_FILE }} | |
| PPM_LICENSE: ${{ secrets.PPM_LICENSE_FILE }} | |
| run: | | |
| # Use env vars and stdin to avoid secrets in temp files and command line args | |
| printf '%s' "$PWB_LICENSE" | kubectl create secret generic pwb-license --from-file=pwb.lic=/dev/stdin --namespace posit-test | |
| printf '%s' "$PCT_LICENSE" | kubectl create secret generic pct-license --from-file=pct.lic=/dev/stdin --namespace posit-test | |
| printf '%s' "$PPM_LICENSE" | kubectl create secret generic ppm-license --from-file=ppm.lic=/dev/stdin --namespace posit-test | |
| - name: Create Workbench Secrets to test existingSecrets | |
| run: | | |
| echo "Generating a fake launcher.pem file" | |
| openssl genrsa -out launcher.pem 4096 | |
| kubectl create secret generic launcherpem-secret --from-file=launcher.pem=launcher.pem --namespace posit-test | |
| kubectl create secret generic userpassword-secret --from-literal=password="testpassword" --namespace posit-test | |
| kubectl create secret generic securecookiekey-secret --from-literal=secure-cookie-key="ec44ae41-5b74-44a4-915b-3b0ac8ef72b6" --namespace posit-test | |
| kubectl create secret generic globalsecurecookiekey-secret --from-literal=secure-cookie-key="ec44ae41-5b74-44a4-915b-3b0ac8ef72b6" --namespace posit-test | |
| kubectl create secret generic databaseconf-secret --from-literal=database.conf="testdatabaseconf" --namespace posit-test | |
| # no allow-failure until https://github.com/actions/toolkit/issues/399 | |
| - name: Run chart-testing (install changed) | |
| id: ct-install | |
| if: ${{ github.ref != 'refs/heads/main' && steps.list-changed.outputs.changed == 'true' }} | |
| run: ct install --target-branch main --chart-dirs charts --chart-dirs other-charts --excluded-charts rstudio-library,rstudio-library-test --namespace posit-test | |
| continue-on-error: true | |
| # no allow-failure until https://github.com/actions/toolkit/issues/399 | |
| - name: Run chart-testing (install all) | |
| id: ct-install-all | |
| run: ct install --target-branch main --all --chart-dirs charts --chart-dirs other-charts --excluded-charts rstudio-library,rstudio-library-test --namespace posit-test | |
| continue-on-error: true | |
| - name: Notify Slack of chart install failure if on main | |
| if: github.ref == 'refs/heads/main' && (steps.ct-install.outcome == 'failure' || steps.ct-install-all.outcome == 'failure') | |
| uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3 | |
| with: | |
| payload-delimiter: "_" | |
| payload: | | |
| { | |
| "blocks": [ | |
| { | |
| "type": "section", | |
| "text": { | |
| "type": "mrkdwn", | |
| "text": "Failure during test installation of ${{ steps.ct-install.outcome == 'failure' && 'changed' || 'all' }} charts. ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| } | |
| } | |
| ] | |
| } | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} | |
| SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK | |
| - name: Fail the workflow if failed installs | |
| if: steps.ct-install.outcome == 'failure' || steps.ct-install-all.outcome == 'failure' | |
| run: exit 1 | |
| check-versions-connect: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0 | |
| - name: Add rstudio helm repo | |
| run: helm repo add rstudio https://helm.rstudio.com | |
| - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 | |
| - name: Run executable verification for default interpreters | |
| run: | | |
| just test-connect-interpreter-versions | |
| zizmor: | |
| name: Zizmor | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| # SARIF upload needs security-events:write; fork PRs get read-only but | |
| # zizmor still runs as a pass/fail check — only the upload is skipped. | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 | |
| with: | |
| advanced-security: ${{ github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request' }} |