# Needs ct.yaml file 
# e.g.
# chart-dirs:
#  - charts
#  
# target-branch: main
# 
# Enforce semver bump on any changed chart.
# check-version-increment: true
# 
# Set to true if all maintainer GitHub usernames should be validated.
# validate-maintainers: false
# 
# Extra args passed through to every `helm lint` call.
# helm-extra-args: --timeout 120s
#
# Uncomment to validate values.yaml against a JSON schema (values.schema.json).
# validate-chart-schema: true

name: Helm Lint

on:
  workflow_call:
    inputs:
      chart-dirs:
        description: >
          Comma-separated chart directories. Must match chart_dirs in ct config.
        type: string
        default: "charts"
      ct-config:
        description: "Path to ct config in calling repo. Skipped if file absent."
        type: string
        default: "ct.yaml"
      lint-all:
        description: >
          Pass --all to ct lint. Lints every chart, not just ones changed
          relative to target-branch. Useful on main/release pushes.
        type: boolean
        default: true
      target-branch:
        description: "Branch ct diffs against for changed-chart detection."
        type: string
        default: "main"
      kubeconform:
        description: "Validate rendered manifests with kubeconform."
        type: boolean
        default: true
      k8s-version:
        description: "Kubernetes version for kubeconform schema validation."
        type: string
        default: "1.30.0"
      kubeconform-version:
        description: "kubeconform release version."
        type: string
        default: "0.6.7"
      helm-version:
        description: "Helm version."
        type: string
        default: "v3.14.4"
      runner:
        type: string
        default: "ubuntu-latest"

jobs:
  ct-lint:
    name: ct lint
    runs-on: ${{ inputs.runner }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: azure/setup-helm@v4
        with:
          version: ${{ inputs.helm-version }}

      - uses: helm/chart-testing-action@v2

      - name: Run ct lint
        run: |
          ARGS="--target-branch ${{ inputs.target-branch }}"

          if [[ -f "${{ inputs.ct-config }}" ]]; then
            ARGS="$ARGS --config ${{ inputs.ct-config }}"
          fi

          if [[ "${{ inputs.lint-all }}" == "true" ]]; then
            ARGS="$ARGS --all"
          fi

          ct lint $ARGS

  kubeconform:
    name: kubeconform
    runs-on: ${{ inputs.runner }}
    if: ${{ inputs.kubeconform }}
    steps:
      - uses: actions/checkout@v4

      - uses: azure/setup-helm@v4
        with:
          version: ${{ inputs.helm-version }}

      - name: Install kubeconform
        env:
          VERSION: ${{ inputs.kubeconform-version }}
        run: |
          curl -sLo kubeconform.tar.gz \
            "https://github.com/yannh/kubeconform/releases/download/v${VERSION}/kubeconform-linux-amd64.tar.gz"
          tar xf kubeconform.tar.gz kubeconform
          sudo mv kubeconform /usr/local/bin/
          kubeconform -v

      - name: Render and validate all charts
        env:
          K8S_VERSION: ${{ inputs.k8s-version }}
        run: |
          find . -name "Chart.yaml" \
              -not -path "*/.git/*" \
              -not -path "*/charts/*/Chart.yaml" \
          | while read chartfile; do
            chart_dir=$(dirname "$chartfile")
            echo "──► Validating: $chart_dir"
            helm dependency update "$chart_dir" 2>/dev/null || true
            helm template ci-release "$chart_dir" \
              | kubeconform \
                  -strict \
                  -kubernetes-version "$K8S_VERSION" \
                  -schema-location default \
                  -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
                  -summary \
                  -output pretty
          done