vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-07-09 16:00:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

Verify public Helm chart publication

Browse source
This commit is contained in:
rcourtman 2026-07-05 09:40:20 +01:00
parent c0ae794dc9
commit 1ba7bb06a0
5 changed files with 44 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

23
scripts/installtests/build_release_assets_test.go
View file

@ -1144,7 +1144,8 @@ func TestPromoteFloatingTagsReachableViaWorkflowCall(t *testing.T) {
}
func TestPublishHelmChartReachableViaWorkflowCall(t *testing.T) {
assertFileContainsAll(t, repoFile(".github", "workflows", "publish-helm-chart.yml"),
workflowPath := repoFile(".github", "workflows", "publish-helm-chart.yml")
assertFileContainsAll(t, workflowPath,
`workflow_call:`,
`chart_version:`,
`description: "Chart version (e.g., 6.0.0-rc.5). Required for workflow_call."`,
@ -1154,7 +1155,27 @@ func TestPublishHelmChartReachableViaWorkflowCall(t *testing.T) {
// Chart-version resolver prefers inputs over release-event tag.
`if [ -n "${INPUT_CHART_VERSION}" ]; then`,
`RELEASE_TAG="${RELEASE_TAG_NAME}"`,
`name: Verify public GHCR chart read`,
`helm registry logout ghcr.io || true`,
`helm show chart`,
`oci://ghcr.io/${{ github.repository_owner }}/pulse-chart/pulse`,
`--version "${{ steps.versions.outputs.chart_version }}"`,
)
content, err := os.ReadFile(workflowPath)
if err != nil {
t.Fatalf("read publish-helm-chart.yml: %v", err)
}
workflow := string(content)
for _, forbidden := range []string{
`versions/latest/restore`,
`-f visibility=public`,
`Package visibility configuration attempted`,
} {
if strings.Contains(workflow, forbidden) {
t.Fatalf("publish-helm-chart.yml must verify chart readability instead of masking GHCR visibility API failures; found %q", forbidden)
}
}
}
func TestCreateReleasePublishesPrivateProRuntime(t *testing.T) {

8
scripts/release_control/release_promotion_policy_test.py
View file

@ -807,6 +807,14 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
self.assertIn("--chart deploy/helm/pulse/Chart.yaml", helm)
self.assertIn("--chart deploy/helm/pulse/Chart.yaml", helm_pages)
self.assertIn('git checkout --detach "refs/tags/${RELEASE_TAG}"', helm)
self.assertIn("Verify public GHCR chart read", helm)
self.assertIn("helm registry logout ghcr.io || true", helm)
self.assertIn("helm show chart", helm)
self.assertIn("oci://ghcr.io/${{ github.repository_owner }}/pulse-chart/pulse", helm)
self.assertIn('--version "${{ steps.versions.outputs.chart_version }}"', helm)
self.assertNotIn("versions/latest/restore", helm)
self.assertNotIn("-f visibility=public", helm)
self.assertNotIn("Package visibility configuration attempted", helm)
self.assertNotIn("blob/main/docs/KUBERNETES.md", chart)
self.assertNotIn("raw.githubusercontent.com/rcourtman/Pulse/main/docs/images/pulse-logo.svg", chart)
self.assertIn("blob/{tag}/docs/KUBERNETES.md", chart_sync)