Helm lint component

The lint-helm component validates a Helm chart before it is packaged or deployed. It creates a job named lint:helm:<name> and runs only when the configured chart contains a Chart.yaml. Scheduled pipelines skip the job.

Usage

Include the component and identify the chart. The default chart path is chart/.

include:
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/common@stable
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/lint-helm@stable
    inputs:
      name: application
      path: chart

The component performs the following checks and preparation steps:

1. Installs Helm, logs in to configured chart registries, and updates chart dependencies.
2. Expands supported environment variables in chart metadata and Markdown.
3. Lints chart YAML outside templates/ with yamllint.
4. Runs helm lint and helm template for the chart.
5. Validates the rendered manifest with kubernetes-validate when the command is available.

Library charts are linted but are not rendered with helm template because they do not produce Kubernetes manifests. Every check emits a PASS or FAILED result, and any failed required check fails the job.

Test values

Add YAML files below <path>/tests/ to exercise non-default configurations. Each top-level *.yaml or *.yml file in that directory is tested separately and in filename order with both helm lint and helm template.

chart/
├── Chart.yaml
├── values.yaml
└── tests/
    ├── minimal.yaml
    └── production.yaml

If the directory contains no test-values files, the component validates the chart once with its default values. A failed run also points to <path>/tests/test.yaml as the recommended place for a reproducible test configuration.

YAML lint configuration

The job checks chart YAML files up to two levels below the chart directory, excluding files below templates/. It uses the first project-root configuration file found in this order:

1. .yamllint.yaml
2. .yamllint.yml
3. .yamllint

When none exists, the CI Tools default configuration is used. The YAML check is skipped with a warning if yamllint is unavailable in an overridden runtime environment.

Schema domain replacement

Before linting, the job finds *.schema.json files up to three levels below the project root and replaces schema.example.com with the value of DOMAIN. The default domain is schema.xrow.com; override the job variable when schemas must reference another host.

variables:
  DOMAIN: schema.company.example

Registry authentication

Dependency updates can authenticate automatically to these registries when their variables are available:

• The project GitLab registry through CI_REGISTRY, CI_REGISTRY_USER, and CI_REGISTRY_PASSWORD, falling back to CI_JOB_TOKEN.
• GitHub Container Registry through GITHUB_TOKEN. Set GITHUB_USER when the token owner cannot be discovered through the GitHub API or a specific username is required.
• Red Hat Registry through RH_REGISTRY_ACCOUNT and RH_REGISTRY_PASSWORD.

Optional registry-login failures are reported as warnings. A later dependency operation still fails with Helm's native error when authentication is required.

Inputs

Name	Default	Description
name	Required	Suffix of the generated lint:helm:<name> job.
stage	lint	Pipeline stage for the lint job.
path	chart/	Project-relative chart directory containing Chart.yaml.
allow-failure	false	Whether the pipeline may continue when validation fails.
needs	[]	Jobs that must complete before the lint job.
tags	[]	Runner tags assigned to the lint job.

The Helm cache is stored at /tmp/helm and reused with the cache-helm cache key.

Advanced job controls

Use needs when the chart depends on files generated by another job, and use tags to select a runner with project-specific capabilities.

include:
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/lint-helm@stable
    inputs:
      name: application
      path: deploy/chart
      stage: test
      needs:
        - job: generate:chart
          artifacts: true
      tags:
        - container
      allow-failure: false

Inputs

Name	Description	Default	Type
---	---	---	---
allow-failure	Should the pipeline fail if the linting fails?	false	boolean
name	The name of the Helm Chart.		string
needs	The jobs that this job depends on.	[]	array
path	Relative path to the Helm Chart, ending in '/'.	chart/	string
stage	The name of the stage.	lint	string
tags	The runners that this job depends on.	[]	array