[andibeuge]

Summary

Part of INF-4419 (SOC 2 CHG-1). A reusable workflow that validates Helm charts, so a chart-only PR is checked by something that looks at the chart. Today it either skips the tests or runs unrelated ones.

Description

.github/workflows/helm.yaml (workflow_call):

• Finds every chart under chartsPath (default .chart), i.e. every directory with a Chart.yaml. Subcharts vendored into <chart>/charts/ are skipped.
• For each chart: helm dependency build, helm lint, and helm template (skipped for type: library charts, which render nothing).
• Inputs follow the other reusable workflows: runner, timeoutMinutes, chartsPath.

Usage:

jobs:
  helm:
    uses: parcelLab/ci/.github/workflows/helm.yaml@v9
    # with:
    #   chartsPath: parcellab   # parcelLab/charts

A run takes about 15 seconds, so callers can run it on every PR and add it to their ci_check_result gate's needs without a path filter.

Testing

The script ran locally against main of 9 repos, and all passed:

Repo	chartsPath	Charts
charts	parcellab	common (library), cronjob, microservice, monolith, worker-group
cronicle	.chart	prod
html-to-pdf, zelda, zelda-tracking-api, trending-delay-forecast, product-recommendation, selection-guide	.chart	prod, staging
csm-dashboard	.chart	preprod, prod

A broken values.yaml fails the run (cannot load values.yaml).

Release

Non-breaking addition, so publish the draft as v9.3.0 (release-drafter proposes the next patch). The major-tag workflow then moves v9.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T11:32:44.733421Z	6e3bc23	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6e3bc233e4

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Prune vendored subcharts directly below the search root

When chartsPath is itself a chart directory, an unpacked dependency at <chartsPath>/charts/dep/Chart.yaml does not match this exclusion because the pattern requires an additional component before /charts/. The dependency is therefore processed as a top-level chart, which can duplicate validation or fail when the subchart relies on values supplied by its parent; prune every charts/ subtree, including the one directly below CHARTS_PATH.

Useful? React with 👍 / 👎.

[Copilot]

🟡 Changes recommended

Chart discovery can incorrectly include vendored dependencies and exclude genuine charts, causing lint or render failures and incomplete validation.

1 open issue

• Prune nested charts only when the parent is a chart · New

What changed in this PR

Adds a reusable Helm validation workflow to the Kubernetes CI pipelines, giving chart-only pull requests relevant checks.

Changes:

• Adds configurable runner, timeout, and chart search path inputs.
• Discovers charts, builds dependencies, and runs Helm lint and template checks.
• Skips rendering library charts and fails when no charts are found.

File	Description
.github/​workflows/​helm.yaml	Adds the reusable chart discovery, linting, and rendering workflow.

_{Review effort: Balanced}