Repository navigation
perf(helm): bundle chart releases with shared distribution checks - #943
Merged
Merged
Conversation
Contributor
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter TRIVY |
Contributor
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter TRIVY |
Contributor
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter TRIVY |
Contributor
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter TRIVY |
neilime
changed the title
Contributor
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter TRIVY |
Contributor
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter TRIVY |
Contributor
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter TRIVY |
neilime
force-pushed
the
perf/bundle-chart-release-dependencies
branch
from
November 9, 2026 09:48
eb3fefe to
5389a2a
Compare
neilime
marked this pull request as ready for review
November 9, 2026 10:51
neilime
force-pushed
the
perf/bundle-chart-release-dependencies
branch
2 times, most recently
from
November 9, 2026 18:28
3c74b99 to
88ebdb0
Compare
neilime
changed the title
neilime
force-pushed
the
perf/bundle-chart-release-dependencies
branch
from
November 9, 2026 18:29
88ebdb0 to
21686fc
Compare
Contributor
Super-linter summary
All files and directories linted successfully For more information, see the GitHub Actions workflow run Powered by Super-linter |
neilime
force-pushed
the
perf/bundle-chart-release-dependencies
branch
5 times, most recently
from
November 9, 2026 19:57
c12dfdd to
d2defd0
Compare
neilime
force-pushed
the
perf/bundle-chart-release-dependencies
branch
2 times, most recently
from
November 9, 2026 22:54
3763a73 to
c9a82f9
Compare
neilime
force-pushed
the
perf/bundle-chart-release-dependencies
branch
from
November 10, 2026 06:44
c9a82f9 to
4252235
Compare
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Contributor
|
Internal - Pull request - Continuous Integration - Test results Workflow run and full reports · Commit b8143bb Jobs: 2 success · 0 failure · 0 cancelled · 0 skipped · 0 abandoned. Test: 5 passed · 0 failed · 0 skipped. Test detailsTest resultsTest Results
Job results and report availability
Only this attempt is included. On partial reruns, rerun all producer jobs for complete reports. CodeQL findings remain in code scanning; other diagnostics remain in the job logs. |
Contributor
|
Internal - Pull request - Continuous Integration - Code coverage Workflow run and full reports · Commit b8143bb Jobs: 2 success · 0 failure · 0 cancelled · 0 skipped · 0 abandoned. Coverage: 1 source report(s); percentages remain separate. Coverage detailsCoverage resultsCoverage
Overall: 100.00% 🟢 Job results and report availability
Only this attempt is included. On partial reruns, rerun all producer jobs for complete reports. CodeQL findings remain in code scanning; other diagnostics remain in the job logs. |
Contributor
|
Internal - Pull request - Continuous Integration - Lint results Workflow run and full reports · Commit b8143bb Jobs: 2 success · 0 failure · 0 cancelled · 0 skipped · 0 abandoned. Lint: Collected diagnostics and Super-Linter summaries. Execution status is included in the job outcomes. Super-Linter detailsSuper-linter summary
All files and directories linted successfully For more information, see the GitHub Actions workflow run Powered by Super-linter Job results and report availability
Only this attempt is included. On partial reruns, rerun all producer jobs for complete reports. CodeQL findings remain in code scanning; other diagnostics remain in the job logs. |
neilime
force-pushed
the
perf/bundle-chart-release-dependencies
branch
4 times, most recently
from
November 10, 2026 09:58
b130016 to
5cf8d9c
Compare
neilime
force-pushed
the
perf/bundle-chart-release-dependencies
branch
from
November 10, 2026 10:55
5cf8d9c to
702e21e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bundle the Chart.lock helper so chart releases execute through
github-scriptwithout Node.js setup or a runtime YAML installation. Preserve version replacement, digest handling, missing-lockfile behavior and Helm publication/signing; commit the complete bundle and licenses.Update every external GitHub Action and reusable workflow call to the latest stable release verified on 2026-11-10, preserving full commit pins. This includes Common 4.0.0, Node.js 3.0.0, Publish 3.0.2 and Docker, Helm, Cosign, Python, yq and Renovate actions. Remove all ten obsolete Common local-action helper steps and use native
$/references for sibling actions. The updated Node.js setup disables installation scripts by default; Helm documentation tools work with that default.Adopt automatic package discovery and shared distribution validation from ci-github-common 4.0.0, pinned to its verified release commit. Rebuild callers use default-branch manifests as the writer allowlist. CI generates host/container package checks from the tested revision. Recursive patterns replace action-specific generated-output exclusions.
Use ES modules and colocated tests under
src/, action-owned manifests/lockfiles, and standardtest,test:watchandtest:ciscripts. Coverage output is created on a clean checkout and ignored by Git. Follow Common'sparse-ci-reportsCI pattern for every action package with tests: use the Node.js reusable workflow with explicit job permissions, package-ownedtest:ci, CodeQL and dependency review. Generate native LCOV and JUnit reports, disable producer comments and callci-reportsonce after the jobs complete, including failures. Coverage figures stay separate per action within one coverage comment. Distribution checks verify bundles without repeating source tests; public-action integration checks remain separate.Remove the copied
tests/distribution.cjsand the hardcoded package test job. The action retains its own contract assertions andtest:distributionscript; the shared quality action handles bundle isolation, failure propagation and cleanup. Existing Helm integration and security checks remain enabled. Native same-repository references replace the temporary copy of sibling Helm actions.Remove
build-workflowfrom both event callers. The shared writer resolves the builder from the exact workflow name already declared in its default-branch trigger; ambiguous or untrusted matches fail closed.The trusted writer preserves bot identity, artifact, allowed-path and atomic-head checks. It never executes PR code. Its App configuration and live dependency-update handoff still need verification after the callers reach the default branch.
Validation: five package tests and five isolated bundle contracts pass on Node.js 24. Rebuilding produces no bundle drift; formatting, workflow lint/security checks and changed Markdown pass. Existing security and integration checks remain enabled.
The CI configuration audit verifies one source-test call per package, the parser options and explicit permissions throughout the call chain. Actionlint, Zizmor, formatting, Markdown and changed-guide links pass for this update.
Add the CodeQL configuration referenced by the action CI job so source scanning succeeds and generated bundles are excluded.
Use the released ci-github-nodejs 3.0.0, pinned to its verified release commit, for consolidated reporting. The updated test commands pass on Node.js 24. Local collection of the actual reports verifies grouping, separate coverage figures, stale/unrelated exclusions and comment eligibility.
Latest dependency migration validation: all 354 external calls across both PRs match verified stable release commits; action/workflow inputs, secrets, required inputs and native action paths pass the metadata audit. Actionlint, Zizmor and formatting checks pass. Generated Markdown passes formatting and Markdown lint. Publish 3.0.2 is pinned to its verified release commit; its release-actions inputs, secrets, outputs and workflow permissions are unchanged from 3.0.1. The caller contract, Actionlint, Zizmor, formatting and diff checks pass for this update. GitHub CI is rerun on the updated commit.