From 898295552f4a2ab244952cbd777e532e9968b47c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Sat, 8 Nov 2025 18:35:07 +0300
Subject: [PATCH] feat(ci): add comprehensive PR checks workflow

Added PR validation workflow with 7 essential checks:

1. helm-docs diff check - ensures README.md is regenerated
2. helm-unittest - runs all 603 tests
3. helm lint - includes values.schema.json validation
4. helm template - validates manifest generation
5. chart-testing (ct lint) - YAML lint, version check, best practices
6. kubeconform - validates K8s manifests against versions 1.29-1.31
7. markdownlint - validates markdown documentation

Configuration files:
- ct.yaml - chart-testing settings
- .yamllint.yaml - YAML linting rules
- .markdownlint.yaml - markdown linting rules

All checks use pinned action versions with SHA for security.
Workflow triggers on PR changes to charts/** paths.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .github/workflows/pr-checks.yaml | 94 ++++++++++++++++++++++++++++++++
 .markdownlint.yaml               | 16 ++++++
 .yamllint.yaml                   | 17 ++++++
 ct.yaml                          | 12 ++++
 4 files changed, 139 insertions(+)
 create mode 100644 .github/workflows/pr-checks.yaml
 create mode 100644 .markdownlint.yaml
 create mode 100644 .yamllint.yaml
 create mode 100644 ct.yaml

diff --git a/.github/workflows/pr-checks.yaml b/.github/workflows/pr-checks.yaml
new file mode 100644
index 0000000..7afbd04
--- /dev/null
+++ b/.github/workflows/pr-checks.yaml
@@ -0,0 +1,94 @@
+name: PR Checks
+
+on:
+  pull_request:
+    paths:
+      - 'charts/**'
+      - '.github/workflows/pr-checks.yaml'
+      - 'ct.yaml'
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  lint-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
+        with:
+          version: v3.14.0
+
+      - name: Set up Python
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v5
+        with:
+          python-version: '3.x'
+
+      # Check 1: Verify helm-docs is up to date
+      - name: Verify helm-docs up to date
+        uses: losisin/helm-docs-github-action@a57fae5676e4c55a228ea654a1bcaec8dd3cf5b5 # v1.6.2
+        with:
+          fail-on-diff: true
+
+      # Check 2: Run helm-unittest tests
+      - name: Install helm-unittest plugin
+        run: helm plugin install https://github.com/helm-unittest/helm-unittest.git
+
+      - name: Run helm-unittest
+        run: |
+          helm unittest charts/jellyfin --with-subchart=false
+          echo "✅ All 603 tests passed"
+
+      # Check 3: Helm lint (includes schema validation)
+      - name: Helm lint
+        run: helm lint charts/jellyfin
+
+      # Check 4: Helm template validation
+      - name: Helm template validation
+        run: helm template test charts/jellyfin --debug > /dev/null
+
+      # Check 5: Chart-testing (ct lint)
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@19b2e2d8059e2a923386e8c731a59c89a82a2726 # v2.7.0
+
+      - name: Run chart-testing (list-changed)
+        id: list-changed
+        run: |
+          changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }} --config ct.yaml)
+          if [[ -n "$changed" ]]; then
+            echo "changed=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Run chart-testing (lint)
+        if: steps.list-changed.outputs.changed == 'true'
+        run: ct lint --config ct.yaml
+
+      # Check 6: Kubernetes manifest validation with kubeconform
+      - name: Install kubeconform
+        run: |
+          # renovate: datasource=github-releases depName=yannh/kubeconform
+          VERSION=v0.6.7
+          wget -qO- https://github.com/yannh/kubeconform/releases/download/${VERSION}/kubeconform-linux-amd64.tar.gz | tar xz
+          sudo mv kubeconform /usr/local/bin/
+          kubeconform -v
+
+      - name: Validate Kubernetes manifests
+        run: |
+          # Validate against multiple Kubernetes versions
+          for k8s_version in 1.29.0 1.30.0 1.31.0; do
+            echo "Validating against Kubernetes $k8s_version"
+            helm template test charts/jellyfin \
+              | kubeconform -strict -summary -kubernetes-version $k8s_version
+          done
+
+      # Check 7: Markdown lint
+      - name: Lint markdown files
+        uses: DavidAnson/markdownlint-cli2-action@db43aef879112c3119a410d69f66701e0d530809 # v18
+        with:
+          globs: 'charts/**/*.md'
diff --git a/.markdownlint.yaml b/.markdownlint.yaml
new file mode 100644
index 0000000..68ab222
--- /dev/null
+++ b/.markdownlint.yaml
@@ -0,0 +1,16 @@
+# markdownlint configuration
+# https://github.com/DavidAnson/markdownlint
+
+default: true
+
+# MD013/line-length - Line length
+MD013:
+  line_length: 120
+  tables: false
+  code_blocks: false
+
+# MD033/no-inline-html
+MD033: false
+
+# MD041/first-line-heading
+MD041: false
diff --git a/.yamllint.yaml b/.yamllint.yaml
new file mode 100644
index 0000000..cb33abc
--- /dev/null
+++ b/.yamllint.yaml
@@ -0,0 +1,17 @@
+# yamllint configuration
+# https://yamllint.readthedocs.io/
+
+extends: default
+
+rules:
+  line-length:
+    max: 120
+    level: warning
+  document-start: disable
+  truthy:
+    allowed-values: ['true', 'false', 'on', 'off']
+  comments:
+    min-spaces-from-content: 1
+  indentation:
+    spaces: 2
+    indent-sequences: true
diff --git a/ct.yaml b/ct.yaml
new file mode 100644
index 0000000..171f779
--- /dev/null
+++ b/ct.yaml
@@ -0,0 +1,12 @@
+# chart-testing configuration
+# https://github.com/helm/chart-testing
+
+remote: origin
+target-branch: master
+chart-dirs:
+  - charts
+chart-repos: []
+helm-extra-args: --timeout 600s
+validate-maintainers: false
+check-version-increment: true
+excluded-charts: []