Add helm-unittest suites and CI for kafka-ui chart#68
Conversation
Introduce helm-unittest as a fast, cluster-free unit-testing harness for the kafka-ui chart, plus a CI job that runs it on every chart PR. Suites cover the core templates: - ingress.yaml API version selection, TLS, ingressClassName, templated host - service.yaml type/port, NodePort/LoadBalancer specifics, selector labels - deployment.yaml replicas vs. autoscaling, image reference, probes, env wiring - NOTES.txt ClusterIP port-forward fallback A tests/README.md documents how to run the suites and the pattern for adding tests when new templates or features land. The new `unit-test` job in .github/workflows/helm.yaml installs the plugin and runs `helm unittest charts/kafka-ui`.
|
AI Summary The GitHub issue proposes adding Helm unit tests for the |
kapybro
Bot
changed the title
kapybro
Bot
added
area/ux
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds four ChangesHelm Unit Test Infrastructure and Suites
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.github/workflows/helm.yaml (1)
10-21: ⚡ Quick winAdd explicit
permissionsblock to follow least-privilege principle.The job inherits default repository permissions, which may be broader than necessary. Explicitly declaring minimal permissions reduces the blast radius if the workflow is compromised.
🛡️ Recommended permissions block
unit-test: runs-on: ubuntu-latest + permissions: + contents: read steps:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/helm.yaml around lines 10 - 21, The unit-test job is missing an explicit permissions block, which means it inherits default repository permissions that may be broader than necessary. Add a permissions block at the job level (before the runs-on property) in the unit-test job to explicitly declare minimal permissions. For this job that only performs read operations (checkout and test execution), declare contents: read permission, which is the minimum required to check out the repository and run the helm unit tests on the charts/kafka-ui directory.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/helm.yaml:
- Line 13: The actions/checkout action is using version 3 which is deprecated
and has outdated runner infrastructure. Update the uses statement for
actions/checkout to use version 4 instead. Simply change the action reference
from `@v3` to `@v4` to use the current stable version with modern GitHub Actions
infrastructure support.
- Line 13: The actions/checkout@v3 step is missing security hardening. Add
`persist-credentials: false` as a parameter to the checkout action to prevent
GitHub credentials from being persisted in the workspace `.git/config` file,
which could expose sensitive credentials through artifacts or subsequent
workflow steps.
- Around line 13-15: The workflow file uses mutable tag references (`@v3`) for
GitHub Actions which creates supply chain security risks. Replace the mutable
tag references for actions/checkout and Azure/setup-helm with their
corresponding immutable commit SHA references. For each action, determine the
specific commit SHA for the intended version and replace the `@v3` syntax with
@<full-commit-sha> to ensure the workflow always uses the exact pinned version
regardless of any future changes to those tags.
In `@charts/kafka-ui/tests/deployment_test.yaml`:
- Around line 157-172: The environment variable name
SPRING_CONFIG_ADDITIONAL-LOCATION uses hyphens instead of the underscore format
that Spring Boot expects. Update this variable name to
SPRING_CONFIG_ADDITIONAL_LOCATION with underscores in both the test assertion in
this file (around the contains assertion path checking
spec.template.spec.containers[0].env) and in the corresponding deployment
template at charts/kafka-ui/templates/deployment.yaml to comply with Spring
Boot's documented environment variable naming convention.
---
Nitpick comments:
In @.github/workflows/helm.yaml:
- Around line 10-21: The unit-test job is missing an explicit permissions block,
which means it inherits default repository permissions that may be broader than
necessary. Add a permissions block at the job level (before the runs-on
property) in the unit-test job to explicitly declare minimal permissions. For
this job that only performs read operations (checkout and test execution),
declare contents: read permission, which is the minimum required to check out
the repository and run the helm unit tests on the charts/kafka-ui directory.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e3662387-9141-4943-8208-1cc91e866392
📒 Files selected for processing (7)
.github/workflows/helm.yamlcharts/kafka-ui/Chart.yamlcharts/kafka-ui/tests/README.mdcharts/kafka-ui/tests/deployment_test.yamlcharts/kafka-ui/tests/ingress_test.yamlcharts/kafka-ui/tests/notes_test.yamlcharts/kafka-ui/tests/service_test.yaml
| unit-test: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 |
There was a problem hiding this comment.
Upgrade to actions/checkout@v4.
The actions/checkout@v3 action is deprecated and its runner is too old for current GitHub Actions infrastructure.
⬆️ Recommended upgrade
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v3 | |
| - uses: actions/checkout@v4 |
🧰 Tools
🪛 actionlint (1.7.12)
[error] 13-13: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 zizmor (1.25.2)
[warning] 13-13: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 13-13: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/helm.yaml at line 13, The actions/checkout action is using
version 3 which is deprecated and has outdated runner infrastructure. Update the
uses statement for actions/checkout to use version 4 instead. Simply change the
action reference from `@v3` to `@v4` to use the current stable version with modern
GitHub Actions infrastructure support.
Source: Linters/SAST tools
Add persist-credentials: false to prevent credential leakage.
Without this setting, the checkout action persists GitHub credentials in the workspace .git/config, which can be inadvertently exposed through artifacts or subsequent steps.
🔒 Recommended fix
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v3 | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 actionlint (1.7.12)
[error] 13-13: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 zizmor (1.25.2)
[warning] 13-13: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 13-13: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/helm.yaml at line 13, The actions/checkout@v3 step is
missing security hardening. Add `persist-credentials: false` as a parameter to
the checkout action to prevent GitHub credentials from being persisted in the
workspace `.git/config` file, which could expose sensitive credentials through
artifacts or subsequent workflow steps.
Source: Linters/SAST tools
| - uses: actions/checkout@v3 | ||
| - name: Helm tool installer | ||
| uses: Azure/setup-helm@v3 |
There was a problem hiding this comment.
Pin action references to commit SHAs for supply-chain security.
Using mutable tag references (e.g., @v3, @v4) allows action maintainers to modify the code under those tags. Pinning to immutable SHAs prevents supply-chain attacks.
📌 Recommended pinning
- - uses: actions/checkout@v3
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+ with:
+ persist-credentials: false
- name: Helm tool installer
- uses: Azure/setup-helm@v3
+ uses: Azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0Note: Verify the SHA digests correspond to the intended action versions before applying.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v3 | |
| - name: Helm tool installer | |
| uses: Azure/setup-helm@v3 | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| persist-credentials: false | |
| - name: Helm tool installer | |
| uses: Azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0 |
🧰 Tools
🪛 actionlint (1.7.12)
[error] 13-13: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 zizmor (1.25.2)
[warning] 13-13: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 13-13: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 15-15: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/helm.yaml around lines 13 - 15, The workflow file uses
mutable tag references (`@v3`) for GitHub Actions which creates supply chain
security risks. Replace the mutable tag references for actions/checkout and
Azure/setup-helm with their corresponding immutable commit SHA references. For
each action, determine the specific commit SHA for the intended version and
replace the `@v3` syntax with @<full-commit-sha> to ensure the workflow always
uses the exact pinned version regardless of any future changes to those tags.
Source: Linters/SAST tools
Add .pre-commit-config.yaml so contributors can run the same checks CI
enforces before pushing:
- helm-unittest runs the chart's unit tests (matches the
unit-test workflow job)
- readme-generator regenerates CONFIGURATION.md from values.yaml
@param metadata (matches the update-config-docs
workflow, which otherwise auto-commits it)
- hygiene trailing-whitespace, end-of-file, merge-conflict,
large-file and yaml checks (Helm templates excluded)
The readme-generator hook also brings CONFIGURATION.md back in sync: the
startup-probe parameters added in kafbat#64 had not been regenerated.
Install with: pre-commit install
Address CodeRabbit feedback on the new unit-test job: - bump actions/checkout to v4 (v3 runner is deprecated) - add an explicit `permissions: contents: read` block Scoped to the new job only; the pre-existing jobs are left untouched to keep this PR additive.
|
Thanks @coderabbitai — went through all four:
|
|
Tip For best results, initiate chat on the files or code changes.
(っ◔◡◔)っ ♥ |
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/helm.yaml (1)
15-15:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDisable persisted credentials on checkout in the new unit-test job.
The checkout step still persists the token in local git config. Set
persist-credentials: falseto reduce credential exposure across later steps/artifacts.🔒 Proposed fix
- - uses: actions/checkout@v4 + - uses: actions/checkout@v4 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/helm.yaml at line 15, The actions/checkout@v4 step in the workflow is persisting credentials in the local git config, which poses a security risk by exposing credentials to later steps and artifacts. Add the `persist-credentials: false` configuration option to the checkout step to disable this behavior and reduce credential exposure throughout the workflow execution.Source: Linters/SAST tools
🧹 Nitpick comments (1)
.pre-commit-config.yaml (1)
30-30: Pinreadme-generator-for-helmto an explicit version.Line 30 uses
npx --yes@bitnami/readme-generator-for-helm`` without a version, making local runs non-reproducible. The CI workflow also installs this tool without version constraints. Pinning a version keeps docs generation deterministic across all environments.Suggested change
- entry: npx --yes `@bitnami/readme-generator-for-helm` --values charts/kafka-ui/values.yaml --readme charts/kafka-ui/CONFIGURATION.md + entry: npx --yes `@bitnami/readme-generator-for-helm`@<version> --values charts/kafka-ui/values.yaml --readme charts/kafka-ui/CONFIGURATION.mdAlso consider pinning the version in
.github/workflows/update-config-docs.yamlline 19 (npm install -g@bitnami/readme-generator-for-helm@<version>).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.pre-commit-config.yaml at line 30, The entry command for `@bitnami/readme-generator-for-helm` in the pre-commit configuration lacks an explicit version constraint, causing non-reproducible builds across environments. Add a specific version number to the package name by appending @<version> to `@bitnami/readme-generator-for-helm` in the entry command. Additionally, apply the same version pinning to the npm install command in the CI workflow file where `@bitnami/readme-generator-for-helm` is installed globally to maintain consistency across all build environments.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/helm.yaml:
- Line 15: The actions/checkout@v4 step in the workflow is persisting
credentials in the local git config, which poses a security risk by exposing
credentials to later steps and artifacts. Add the `persist-credentials: false`
configuration option to the checkout step to disable this behavior and reduce
credential exposure throughout the workflow execution.
---
Nitpick comments:
In @.pre-commit-config.yaml:
- Line 30: The entry command for `@bitnami/readme-generator-for-helm` in the
pre-commit configuration lacks an explicit version constraint, causing
non-reproducible builds across environments. Add a specific version number to
the package name by appending @<version> to `@bitnami/readme-generator-for-helm`
in the entry command. Additionally, apply the same version pinning to the npm
install command in the CI workflow file where `@bitnami/readme-generator-for-helm`
is installed globally to maintain consistency across all build environments.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 33c5b05f-7f17-499f-b6ff-331a951190aa
📒 Files selected for processing (3)
.github/workflows/helm.yaml.pre-commit-config.yamlcharts/kafka-ui/CONFIGURATION.md
✅ Files skipped from review due to trivial changes (1)
- charts/kafka-ui/CONFIGURATION.md
| uses: Azure/setup-helm@v3 | ||
|
|
||
| - name: Install helm-unittest plugin | ||
| run: helm plugin install https://github.com/helm-unittest/helm-unittest |
There was a problem hiding this comment.
Done — pinned to --version v1.1.1 (the current latest release, which the suite is verified against). Happy to bump it in a follow-up whenever you want to track newer plugin releases.
Per maintainer request: pin the plugin install to a fixed version instead of pulling the default branch, for reproducible CI runs.
2 participants
What
Adds
helm-unittestas a fast, cluster-free unit-testing harness for thekafka-uichart, plus a CI job that runs it on every chart PR.25 tests across 4 suites, covering the core templates:
ingress_test.yamlingress.yamlingressClassName, templated hostservice_test.yamlservice.yamldeployment_test.yamldeployment.yamlnotes_test.yamlNOTES.txtA
charts/kafka-ui/tests/README.mddocuments how to run the suites locally and the pattern for adding tests when new templates/features land.Why
The suites render templates and assert on the resulting manifests in milliseconds, with no cluster required. They catch template regressions — missing fields, broken conditionals, failed
fail/requiredguards — as red tests rather than redhelm templaterenders in CI. The newunit-testjob runs alongside the existing render/kubeconform job.Run locally
Notes for reviewers
main. A follow-up will add anhttproute_test.yamlsuite (including afailedTemplatecase for the empty-parentRefsguard) once feat: Add HTTPRoute support for Gateway API #67 merges — that test reproduces and pins the exact guard behavior introduced there.1.6.6on the assumption feat: Add HTTPRoute support for Gateway API #67 (1.6.5) merges first. Happy to rebase if the ordering changes.NOTES.txtrenders the ingress URL from.Values.ingress.hosts[].paths(plural/list), but the chart'svalues.yamlusesingress.host(singular). With standard values the ingress NOTES URL renders empty. Flagging for awareness; left out of this PR to avoid scope creep.Summary by CodeRabbit
failureThreshold,periodSeconds,timeoutSeconds)charts/**targetingmainUpdate: pre-commit config
Also adds a
.pre-commit-config.yamlso contributors can run the same checks CI enforces, before pushing:unit-testjob)CONFIGURATION.mdfromvalues.yaml@parammetadata (matches the existing Update README from values.yaml metadata workflow, which otherwise auto-commits it)While wiring up the readme-generator hook I noticed
CONFIGURATION.mdhad drifted fromvalues.yaml— theprobes.startup.*parameters added in #64 were never regenerated. This PR brings it back in sync.