133 lines
6.3 KiB
YAML
133 lines
6.3 KiB
YAML
name: Validate Helm chart
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- infra/helm/**
|
|
- .github/workflows/helm-chart.yml
|
|
pull_request:
|
|
paths:
|
|
- infra/helm/**
|
|
- .github/workflows/helm-chart.yml
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
validate:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: azure/setup-helm@v4
|
|
with:
|
|
version: v3.17.3
|
|
- name: Lint chart
|
|
run: helm lint infra/helm/medical-chatbot
|
|
- name: Render default and production manifests
|
|
run: |
|
|
helm template default infra/helm/medical-chatbot > /tmp/default.yaml
|
|
|
|
# values-prod.yaml leaves the image tags empty on purpose: production
|
|
# must run an immutable commit SHA, supplied per deploy. Rendering it
|
|
# without one has to fail rather than fall back to a development tag,
|
|
# so assert that failure here — otherwise the guard could rot into a
|
|
# silent default and nobody would notice until a cutover.
|
|
if helm template production infra/helm/medical-chatbot \
|
|
--values infra/helm/medical-chatbot/values-prod.yaml \
|
|
> /tmp/untagged.yaml 2>/tmp/untagged.err; then
|
|
echo "::error::production render succeeded with no image tag; the immutable-tag guard is gone"
|
|
exit 1
|
|
fi
|
|
grep -q 'image.tag must be set to an immutable tag' /tmp/untagged.err
|
|
|
|
helm template production infra/helm/medical-chatbot \
|
|
--values infra/helm/medical-chatbot/values-prod.yaml \
|
|
--set aiService.image.tag="$GITHUB_SHA" \
|
|
--set web.image.tag="$GITHUB_SHA" \
|
|
> /tmp/production.yaml
|
|
grep -q 'ANSWER_MODEL_ID: "qwen.qwen3-next-80b-a3b"' /tmp/production.yaml
|
|
grep -q 'RERANK_ENABLED: "true"' /tmp/production.yaml
|
|
grep -q 'checksum/runtime-config:' /tmp/production.yaml
|
|
grep -q "image: \"ghcr.io/baovu2k4/vsf-duocthu-ai-service:$GITHUB_SHA\"" /tmp/production.yaml
|
|
grep -q "image: \"ghcr.io/baovu2k4/vsf-duocthu-web:$GITHUB_SHA\"" /tmp/production.yaml
|
|
|
|
# The practice cluster is only evidence for the production migration
|
|
# while it renders the same behavioural contract as production, so both
|
|
# of its releases are asserted here rather than trusted by review.
|
|
- name: Render practice manifests
|
|
run: |
|
|
helm template medical-chatbot-app infra/helm/medical-chatbot \
|
|
--values infra/helm/medical-chatbot/values-practice.yaml \
|
|
> /tmp/practice-app.yaml
|
|
helm template medical-chatbot-data infra/helm/medical-chatbot \
|
|
--values infra/helm/medical-chatbot/values-practice-data.yaml \
|
|
> /tmp/practice-data.yaml
|
|
|
|
# A bare `grep -q` fails the step with no indication of which
|
|
# assertion broke, and `set -e` ignores a status inverted with `!`,
|
|
# so a `! grep -q` assertion can never fail at all. Both directions
|
|
# go through helpers that name the pattern and exit explicitly.
|
|
# `--` matters: a YAML list item pattern starts with `-`, which grep
|
|
# would otherwise parse as an option bundle.
|
|
expect() {
|
|
if ! grep -q -- "$2" "$1"; then
|
|
echo "::error::$1 is missing: $2"
|
|
exit 1
|
|
fi
|
|
}
|
|
refute() {
|
|
if grep -q -- "$2" "$1"; then
|
|
echo "::error::$1 must not contain: $2"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# Behavioural parity with the audited production runtime contract.
|
|
expect /tmp/practice-app.yaml 'ANSWER_MODEL_ID: "qwen.qwen3-next-80b-a3b"'
|
|
expect /tmp/practice-app.yaml 'ANSWER_PROVIDER: "bedrock-converse"'
|
|
expect /tmp/practice-app.yaml 'EMBEDDING_PROVIDER: "cohere-v4"'
|
|
expect /tmp/practice-app.yaml 'EMBEDDING_DIMENSIONS: "1024"'
|
|
expect /tmp/practice-app.yaml 'EVIDENCE_MINIMUM_SCORE: "0.12"'
|
|
expect /tmp/practice-app.yaml 'RERANK_ENABLED: "true"'
|
|
expect /tmp/practice-app.yaml 'AWS_REGION: "us-east-1"'
|
|
expect /tmp/practice-app.yaml 'checksum/runtime-config:'
|
|
expect /tmp/practice-app.yaml '- host: "readytochat.realvuxbaro.me"'
|
|
|
|
# The production hostname now lives on this cluster, routed and with
|
|
# its own certificate secret -- kept separate from the rehearsal
|
|
# hostname's so one renewal failure cannot take both names offline.
|
|
expect /tmp/practice-app.yaml '- host: "realvuxbaro.me"'
|
|
expect /tmp/practice-app.yaml 'secretName: realvuxbaro-tls'
|
|
expect /tmp/practice-app.yaml 'secretName: readytochat-tls'
|
|
|
|
# Grafana answers on that same public hostname. Anonymous access may
|
|
# be open, but never as Admin, never with the login form disabled,
|
|
# and its root URL must be the name users actually arrive on.
|
|
expect /tmp/practice-app.yaml 'value: "https://realvuxbaro.me/grafana/"'
|
|
refute /tmp/practice-app.yaml 'value: "Admin"'
|
|
|
|
# grep is line-oriented, so read the value on the line after each
|
|
# flag rather than trying to match the pair as one pattern.
|
|
for check in "GF_AUTH_ANONYMOUS_ORG_ROLE:Viewer" "GF_AUTH_DISABLE_LOGIN_FORM:false"; do
|
|
flag=${check%%:*}
|
|
want=${check#*:}
|
|
got=$(grep -A1 -- "$flag" /tmp/practice-app.yaml | grep -- 'value:' | tr -d ' "' | cut -d: -f2)
|
|
if [ "$got" != "$want" ]; then
|
|
echo "::error::$flag rendered as '$got', expected '$want'"
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
# The app release must own neither data StatefulSet: PostgreSQL and
|
|
# Qdrant belong to the data release, so an app-side sync failure or
|
|
# prune can never delete the corpus or the query history. Only those
|
|
# two use volumeClaimTemplates — the observability PVCs are the app
|
|
# release's own and are expected here.
|
|
refute /tmp/practice-app.yaml 'volumeClaimTemplates'
|
|
expect /tmp/practice-app.yaml 'medical-chatbot-data-medical-chatbot-qdrant'
|
|
|
|
# ...and the data release must own nothing else.
|
|
refute /tmp/practice-data.yaml 'medical-chatbot-data-medical-chatbot-ai-service'
|
|
refute /tmp/practice-data.yaml 'kind: Ingress'
|
|
expect /tmp/practice-data.yaml 'volumeClaimTemplates'
|