ci(lint): reorganize workflows and add jobs to check readme diff

.github/workflows/chart-lint.yml

@@ -0,0 +1,69 @@
+name: Lint Helm Chart
+
+concurrency:
+  group: ci-${{ github.run_id }}
+  cancel-in-progress: true
+
+on:
+  push:
+    branches:
+      - main
+      - v[0-9]+
+      - v[0-9]+.[0-9]+
+      - cryostat-v[0-9]+.[0-9]+
+
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - labeled
+      - unlabeled
+    branches:
+      - main
+      - v[0-9]+
+      - v[0-9]+.[0-9]+
+      - cryostat-v[0-9]+.[0-9]+
+
+jobs:
+  lint-chart:
+    runs-on: ubuntu-latest
+    env:
+      TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: v3.14.4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+          check-latest: true
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@v2.6.1
+      - name: Lint chart
+        run: ct lint --target-branch ${TARGET_BRANCH} --lint-conf lintconf.yaml --config ct.yaml --chart-yaml-schema chart_schema.yaml
+
+  check-readme-diff:
+    runs-on: ubuntu-latest
+    env:
+      README_GENERATOR_VERSION: 2.5.2
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Check README diff
+        run: |
+          npx @bitnami/readme-generator-for-helm@$README_GENERATOR_VERSION \
+            --values charts/cryostat/values.yaml \
+            --readme charts/cryostat/README.md \
+            --schema charts/cryostat/values.schema.json
+
+          if ! git diff --exit-code; then
+            echo "README requires updating. To update, run:"
+            echo "npx @bitnami/readme-generator-for-helm@$README_GENERATOR_VERSION --values charts/cryostat/values.yaml --readme charts/cryostat/README.md --schema charts/cryostat/values.schema.json"
+            exit 1
+          fi

.github/workflows/chart-test.yml

@@ -0,0 +1,82 @@
+name: Test Helm Chart
+
+concurrency:
+  group: ci-${{ github.run_id }}
+  cancel-in-progress: true
+
+on:
+  push:
+    branches:
+      - main
+      - v[0-9]+
+      - v[0-9]+.[0-9]+
+      - cryostat-v[0-9]+.[0-9]+
+
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - labeled
+      - unlabeled
+    branches:
+      - main
+      - v[0-9]+
+      - v[0-9]+.[0-9]+
+      - cryostat-v[0-9]+.[0-9]+
+
+jobs:
+  helm-test:
+    runs-on: ubuntu-latest
+    env:
+      TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
+      TEST_NAMESPACE: helm-test
+    steps:
+      - name: Fail if safe-to-test label NOT applied
+        if: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'safe-to-test') }}
+        run: exit 1
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: v3.14.4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+          check-latest: true
+      - uses: helm/chart-testing-action@v2.6.1
+      - name: Set up Kind cluster
+        uses: helm/kind-action@v1
+        with:
+          cluster_name: ci-${{ github.run_id }}
+      - name: Install and test chart
+        run: |
+          # FIXME: Remove when chart-testing fixes the issue https://github.com/helm/chart-testing/issues/525
+
+          HELM_LOCATION="$(which helm)"
+          sudo mv $HELM_LOCATION "$(dirname $HELM_LOCATION)/.helm"
+          cat <(echo '#!/usr/bin/env bash') <(echo 'exec .helm "${@//--reuse-values/--reset-then-reuse-values}"') | sudo tee $HELM_LOCATION
+          sudo chmod +x $HELM_LOCATION
+
+          kubectl create ns $TEST_NAMESPACE
+          ct install --target-branch ${TARGET_BRANCH} --upgrade --namespace=$TEST_NAMESPACE --config ct.yaml --debug
+
+  helm-unittest:
+    runs-on: ubuntu-latest
+    steps:
+      - name: fail if safe-to-test label NOT applied
+        if: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'safe-to-test') }}
+        run: exit 1
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: v3.14.4
+      - name: Install unit test plugin
+        run: helm plugin install https://github.com/helm-unittest/helm-unittest.git --version v0.5.1
+      - name: Run Helm unit tests
+        run: helm unittest --debug ./charts/cryostat

.github/workflows/push-oci.yml

@@ -1,5 +1,9 @@
 name: Push Helm Chart to OCI Registry
 
+concurrency:
+  group: ci-${{ github.run_id }}
+  cancel-in-progress: true
+
 on:
   push:
     branches:

.github/workflows/submodule.yml

@@ -1,4 +1,4 @@
-name: submodule
+name: Update Submodule
 
 on:
   workflow_call:
@@ -19,26 +19,26 @@ jobs:
     if: ${{ github.repository_owner == 'cryostatio' }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-      with:
-        repository: cryostatio/cryostatio.github.io
-        token: "${{ secrets.SUBMODULE_TOKEN }}"
-    - name: Import GPG key
-      uses: crazy-max/ghaction-import-gpg@v6
-      with:
-        gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
-        passphrase: ${{ secrets.GPG_PASSPHRASE }}
-        git_user_signingkey: true
-        git_commit_gpgsign: true
-    - name: Update submodule to latest commit
-      run: |
-        git submodule update --init
-        git submodule update --remote
-    - name: Commit and push submodule
-      run: |
-        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-        git config user.name "github-actions[bot]"
-        git add --all
-        git_hash="$(git rev-parse --short :helm-charts)"
-        git commit -S -m "build(helm-charts): update submodule to $git_hash" || echo "No changes to commit"
-        git push
+      - uses: actions/checkout@v4
+        with:
+          repository: cryostatio/cryostatio.github.io
+          token: "${{ secrets.SUBMODULE_TOKEN }}"
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@v6
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+      - name: Update submodule to latest commit
+        run: |
+          git submodule update --init
+          git submodule update --remote
+      - name: Commit and push submodule
+        run: |
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config user.name "github-actions[bot]"
+          git add --all
+          git_hash="$(git rev-parse --short :helm-charts)"
+          git commit -S -m "build(helm-charts): update submodule to $git_hash" || echo "No changes to commit"
+          git push