ci: make the PR gate fast and deterministic, move ct install off PRs

.github/workflows/chart-install.yaml

@@ -0,0 +1,51 @@
+name: Install Charts (kind)
+
+# Deliberately not on pull_request. Installing the full MINT stack on a
+# single-node kind cluster on a 2-vCPU runner takes ~7 minutes and depends on
+# every upstream image and backing service being reachable and healthy, so it
+# cannot act as a merge gate. It runs nightly and on demand instead.
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 7 * * *"
+
+concurrency:
+  group: chart-install
+  cancel-in-progress: false
+
+jobs:
+  install:
+    name: ct install
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4.3.0
+        with:
+          version: v3.16.4
+
+      # Pinned deliberately. "3.x" with check-latest floats to the newest
+      # Python, which is how this workflow broke without a code change:
+      # chart-testing bundles yamale, yamale references ast.Num, and ast.Num
+      # was removed in Python 3.12.
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@v2.7.0
+
+      - name: Create kind cluster
+        uses: helm/kind-action@v1.12.0
+
+      # --config is mandatory, see linter.yaml. Without it the 600s
+      # helm-extra-args timeout in ct.yaml is dropped and helm falls back to
+      # 300s, which is not enough for this stack.
+      # --all because a scheduled run has no PR diff for list-changed.
+      - name: Run chart-testing (install)
+        run: ct install --config ct.yaml --all

.github/workflows/linter.yaml

@@ -1,47 +1,98 @@
 name: Lint and Test Charts
 
-# on pull request or any branch
 on:
   pull_request:
 
+concurrency:
+  group: lint-charts-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  lint-test:
+  lint:
+    name: Lint
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v4.2.0
+        uses: azure/setup-helm@v4.3.0
         with:
-          version: v3.14.4
+          version: v3.16.4
 
+      # Pinned deliberately. "3.x" with check-latest floats to the newest
+      # Python, which is how this workflow broke without a code change:
+      # chart-testing bundles yamale, yamale references ast.Num, and ast.Num
+      # was removed in Python 3.12.
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.x"
-          check-latest: true
+          python-version: "3.11"
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.6.1
+        uses: helm/chart-testing-action@v2.7.0
 
+      # --config is mandatory. chart-testing resolves its config from
+      # CT_CONFIG_DIR inside the tool cache, never from the repository root, so
+      # without this flag ct.yaml is silently ignored.
       - name: Run chart-testing (list-changed)
         id: list-changed
         run: |
-          changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }})
+          changed=$(ct list-changed --config ct.yaml)
           if [[ -n "$changed" ]]; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Run chart-testing (lint)
         if: steps.list-changed.outputs.changed == 'true'
-        run: ct lint --target-branch ${{ github.event.repository.default_branch }}
+        run: ct lint --config ct.yaml
 
-      - name: Create kind cluster
-        if: steps.list-changed.outputs.changed == 'true'
-        uses: helm/kind-action@v1.10.0
+  render:
+    name: Render (${{ matrix.name }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: default
+            args: ""
+          - name: ui-react
+            args: "-f charts/mint/ci/ui-react-values.yaml"
+          - name: arm64
+            args: "--set arm_support=true --set components.data_catalog.enabled=false"
+          # data_catalog is off by default, so this is the only permutation
+          # that renders datacatalog.yaml at all, and the only one that reaches
+          # its two arm_support branches.
+          - name: all-components-arm64
+            args: "--set arm_support=true --set components.data_catalog.enabled=true"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - name: Run chart-testing (install)
-        if: steps.list-changed.outputs.changed == 'true'
-        run: ct install --target-branch ${{ github.event.repository.default_branch }}
+      - name: Set up Helm
+        uses: azure/setup-helm@v4.3.0
+        with:
+          version: v3.16.4
+
+      - name: Install kubeconform
+        run: |
+          curl -sSL -o /tmp/kubeconform.tar.gz \
+            https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz
+          tar -xzf /tmp/kubeconform.tar.gz -C /tmp kubeconform
+          sudo install /tmp/kubeconform /usr/local/bin/kubeconform
+
+      # helm template proves the chart renders; kubeconform proves what it
+      # renders is valid Kubernetes. helm lint catches neither duplicate keys
+      # nor bad apiVersions.
+      - name: Render and validate
+        run: |
+          helm template mint charts/mint ${{ matrix.args }} > /tmp/manifests.yaml
+          kubeconform \
+            -strict \
+            -summary \
+            -kubernetes-version 1.29.0 \
+            -ignore-missing-schemas \
+            /tmp/manifests.yaml

charts/mint/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 9.0.0-beta.11
+version: 9.0.0-beta.12
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.

charts/mint/README.md

@@ -1,6 +1,6 @@
 # MINT
 
-![Version: 9.0.0-beta.11](https://img.shields.io/badge/Version-9.0.0--beta.11-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.3](https://img.shields.io/badge/AppVersion-1.16.3-informational?style=flat-square)
+![Version: 9.0.0-beta.12](https://img.shields.io/badge/Version-9.0.0--beta.12-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.3](https://img.shields.io/badge/AppVersion-1.16.3-informational?style=flat-square)
 
 A Helm chart for MINT
 

charts/mint/templates/pvc-hasura.yaml

@@ -7,7 +7,6 @@ metadata:
   namespace: {{ .Release.Namespace | quote }}
   {{- if or .Values.components.hasura_db.persistence.annotations .Values.commonAnnotations }}
   annotations:
-    helm.sh/resource-policy: keep
     {{- if .Values.components.hasura_db.persistence.annotations }}
     {{- include "common.tplvalues.render" ( dict "value" .Values.components.hasura_db.persistence.annotations "context" $ ) | nindent 4 }}
     {{- end }}