chart.yml

# This workflow lints and tests the Helm chart on pull requests/pushes that
# touch chart-related files and once a day on main, and publishes it to the
# gh-pages Helm repository on version tags.

name: Chart

permissions:
  contents: read

defaults:
  run:
    shell: bash

# The operator image the chart test installs: built by the image job below from the tree under test,
# loaded into each leg's kind cluster, and named to `make test chart` through these two variables.
env:
  CHART_TEST_IMAGE_REPOSITORY: gpustack/gpustack-operator
  CHART_TEST_IMAGE_TAG: chart-test

# NB(thxCode): the paths below list only the hack/ files that belong to the chart alone: the
# upstream chart patches under hack/deploy/, hack/deps.sh that vendors them, and hack/lib/helm.sh.
# The entrypoints the chart shares with the Go code (the chart branches of hack/lint.sh,
# hack/test.sh and hack/generate.sh, the rest of hack/lib/ and the Makefile) are deliberately
# absent: listing them ran this whole workflow on every Go-only change. A change there that breaks
# the chart surfaces in the daily scheduled run instead, which GitHub starts on the default branch
# only, so it turns main red within a day rather than landing on the next unrelated chart pull
# request. Run it by hand through workflow_dispatch to check such a change sooner.
on:
  workflow_dispatch: { }
  schedule:
    - cron: "17 19 * * *"
  push:
    branches:
      - "main"
      - "v*-dev"
    paths:
      - "deploy/gpustack-operator/chart/**"
      - ".github/workflows/chart.yml"
      - ".github/configs/**"
      - "hack/deploy/**"
      - "hack/deps.sh"
      - "hack/lib/helm.sh"
  pull_request:
    branches:
      - "main"
      - "v*-dev"
    paths:
      - "deploy/gpustack-operator/chart/**"
      - ".github/workflows/chart.yml"
      - ".github/configs/**"
      - "hack/deploy/**"
      - "hack/deps.sh"
      - "hack/lib/helm.sh"

jobs:
  # NB(thxCode): the chart test used to install the published "dev" image, which is built from main.
  # A chart change that needs a binary change (a subcommand the chart starts, say) was then red on
  # every leg until it merged and "dev" was published again, and that red hid any real chart defect
  # beside it. One amd64 build of the tree under test now serves every leg. It reads the registry
  # build cache the CI workflow writes on main and writes none, and pushes nothing, so it needs no
  # credentials. Its Go cache shares the CI workflow's key for the same reason.
  image:
    # Skip on tag pushes, as lint-test does.
    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
    timeout-minutes: 60
    runs-on: ubuntu-24.04
    steps:
      - name: Prepare Env
        env:
          INPUT_REPOSITORY_OWNER: ${{ github.repository_owner }}
        run: |
          # The registry cache lives under the repository owner, as in _image.yml.
          echo "INPUT_NAMESPACE=$(tr '[:upper:]' '[:lower:]' <<<"${INPUT_REPOSITORY_OWNER}")" >> "$GITHUB_ENV"
      - name: Checkout
        uses: actions/checkout@v4
        with:
          lfs: true
          fetch-depth: 0
          persist-credentials: false
      - name: Maximize Docker Build Space
        uses: gpustack/.github/.github/actions/maximize-docker-build-space@main
        with:
          deep-clean: true
          root-reserve-mb: 40960
      # The builder and the build options below match the CI workflow's _image.yml. The options
      # are part of every RUN step's cache key, so any difference misses the registry cache, and
      # one vendor stage at a time is what keeps a standard runner's disk from running out.
      - name: Setup BuildX
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host
            env.BUILDKIT_STEP_LOG_MAX_SIZE=-1
            env.BUILDKIT_STEP_LOG_MAX_SPEED=-1
          buildkitd-flags: |
            --allow-insecure-entitlement=network.host
            --allow-insecure-entitlement=security.insecure
            --oci-worker-net=host
            --oci-worker-gc-keepstorage=204800
            --oci-max-parallelism=1
      - name: Setup BuildX Cache
        id: setup-buildx-cache
        uses: actions/cache@v4
        with:
          path: |-
            ${{ github.workspace }}/.cache/go-build
            ${{ github.workspace }}/.cache/go-mod
            ${{ github.workspace }}/.sbin
          key: ci-linux/amd64-${{ hashFiles('go.sum') }}
      - name: Restore BuildX Cache
        uses: reproducible-containers/buildkit-cache-dance@v3
        with:
          builder: ${{ steps.setup-buildx.outputs.name }}
          cache-map: |-
            {
              "${{ github.workspace }}/.cache/go-build": {
                "target": "/root/.cache/go-build"
              },
              "${{ github.workspace }}/.cache/go-mod": {
                "target": "/go/pkg/mod"
              },
              "${{ github.workspace }}/.sbin": {
                "target": "/usr/local/go/src/gpustack.ai/gpustack/.sbin"
              }
            }
          dockerfile: ${{ github.workspace }}/pack/gpustack-operator/Dockerfile
          skip-extraction: ${{ steps.setup-buildx-cache.outputs.cache-hit }}
      - name: Package
        uses: docker/build-push-action@v6
        with:
          allow: |
            network.host
            security.insecure
          ulimit: |
            nofile=65536:65536
          shm-size: "16G"
          provenance: false
          sbom: false
          push: false
          file: ${{ github.workspace }}/pack/gpustack-operator/Dockerfile
          context: ${{ github.workspace }}
          platforms: linux/amd64
          build-args: |
            GPUSTACK_GIT_COMMIT=${{ github.sha }}
            GPUSTACK_GIT_VERSION=
          tags: |
            ${{ env.CHART_TEST_IMAGE_REPOSITORY }}:${{ env.CHART_TEST_IMAGE_TAG }}
          cache-from: |
            type=registry,ref=${{ env.INPUT_NAMESPACE }}/build-cache:gpustack-operator-main-linux-amd64
          outputs: |
            type=docker,dest=${{ runner.temp }}/chart-test-image.tar
      - name: Upload Image
        uses: actions/upload-artifact@v4
        with:
          name: chart-test-image
          path: ${{ runner.temp }}/chart-test-image.tar
          retention-days: 1

  lint-test:
    # Skip on tag pushes: releases must not be gated by the version matrix.
    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
    needs:
      - image
    timeout-minutes: 60
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        # kindest/node images covering every other minor from v1.23 through v1.33,
        # plus the latest supported v1.35 and v1.36 patches.
        node-image:
          - "kindest/node:v1.23.17"
          - "kindest/node:v1.25.16"
          - "kindest/node:v1.27.16"
          - "kindest/node:v1.29.14"
          - "kindest/node:v1.31.14"
          - "kindest/node:v1.33.12"
          - "kindest/node:v1.35.8"
          - "kindest/node:v1.36.4"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: Setup Helm
        uses: azure/setup-helm@v4
        with:
          version: v3.21.4
      - name: Setup Toolbox Cache
        uses: actions/cache@v4
        with:
          # Cache the go-installed helm-docs/helm-schema binaries.
          key: chart-toolbox-${{ runner.os }}-${{ hashFiles('hack/lib/**') }}
          path: |-
            ${{ github.workspace }}/.sbin
      - name: Generate Kind Config
        env:
          NODE_IMAGE: ${{ matrix.node-image }}
        run: |
          .github/configs/render-kind-config.sh "${NODE_IMAGE}" "${RUNNER_TEMP}/kind-config.yaml"
          echo "::group::generated kind-config.yaml (${NODE_IMAGE})"
          cat "${RUNNER_TEMP}/kind-config.yaml"
          echo "::endgroup::"
      - name: Setup Kind
        uses: helm/kind-action@v1
        with:
          config: ${{ runner.temp }}/kind-config.yaml
          version: v0.32.0
      - name: Download Image
        uses: actions/download-artifact@v4
        with:
          name: chart-test-image
          path: ${{ runner.temp }}
      - name: Load Image
        # "chart-testing" is helm/kind-action's default cluster name.
        run: kind load image-archive "${RUNNER_TEMP}/chart-test-image.tar" --name chart-testing
      - name: Generate
        run: make generate chart
      - name: Verify Generated
        run: |
          changed="$(git status --porcelain -- \
            deploy/gpustack-operator/chart/README.md \
            deploy/gpustack-operator/chart/values.schema.json \
            deploy/gpustack-operator/chart/values.yaml)"
          if [[ -n "${changed}" ]]; then
            echo "::error::chart docs/schema are out of date; run 'make generate chart' and commit the result"
            git --no-pager diff -- \
              deploy/gpustack-operator/chart/README.md \
              deploy/gpustack-operator/chart/values.schema.json \
              deploy/gpustack-operator/chart/values.yaml
            exit 1
          fi
      - name: Lint
        run: make lint chart
      # NB(thxCode): the chart deploys Node Feature Discovery, Kueue and the CSI drivers
      # itself, so this phase needs network egress for all of those; the device-manager
      # DaemonSets stay at 0 desired on the GPU-less kind nodes. chart-testing installs into
      # a namespace it generates, which is also what proves the chart names no namespace of
      # its own. Topograph remains disabled in this install; make lint chart checks its
      # enabled configurations by rendering them without requiring GPU hardware.
      - name: Test
        run: make test chart
      # Vendoring lives in "make deps" only — "make generate chart" / "make lint chart" /
      # "make test chart" no longer re-vendor, and the trees are already committed, so
      # nothing else in this job would ever materialize a stale pin. Run it here so the
      # assertion below actually re-derives "charts/" instead of just re-reading whatever
      # was checked out — without this step a version bump committed without its
      # re-vendored tree would read as clean.
      - name: Vendor Charts
        run: make deps
      - name: Verify Vendored Charts
        run: |
          # Assert the re-vendor above didn't drift from the committed, patched trees,
          # and that "make lint chart" / "make test chart" didn't write their own
          # dependency archives back into "charts/" (which "helm dependency update"
          # would, but the vendored trees must not).
          changed="$(git status --porcelain -- deploy/gpustack-operator/chart/charts)"
          if [[ -n "${changed}" ]]; then
            echo "::error::vendored charts drifted from the committed tree; run 'make deps' and commit the result"
            git --no-pager diff -- deploy/gpustack-operator/chart/charts
            git --no-pager status --porcelain -- deploy/gpustack-operator/chart/charts
            exit 1
          fi
          tgz="$(find deploy/gpustack-operator/chart/charts -name '*.tgz')"
          if [[ -n "${tgz}" ]]; then
            echo "::error::unexpected chart archive(s) left under charts/:"
            echo "${tgz}"
            exit 1
          fi