# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Helm Lint

on:
  merge_group:
    types: [checks_requested]
  push:
    branches:
      - "pull-request/[0-9]+"
  workflow_dispatch:

env:
  MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

permissions:
  contents: read
  packages: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  pr_metadata:
    name: Resolve PR metadata
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      should_run: ${{ steps.gate.outputs.should_run }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - id: gate
        uses: ./.github/actions/pr-gate

  helm_changes:
    name: Detect Helm changes
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      should_run: ${{ steps.default.outputs.should_run || steps.changes.outputs.any_changed }}
    steps:
      - id: default
        if: github.event_name != 'push'
        shell: bash
        run: echo "should_run=true" >> "$GITHUB_OUTPUT"

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        if: github.event_name == 'push'

      - id: merge-base
        if: github.event_name == 'push'
        uses: ./.github/actions/pr-merge-base
        with:
          gh_token: ${{ secrets.GITHUB_TOKEN }}

      - id: changes
        if: github.event_name == 'push'
        uses: tj-actions/changed-files@aa08304bd477b800d468db44fe10f6c61f7f7b11 # v42.1.0
        with:
          base_sha: ${{ steps.merge-base.outputs.base_sha }}
          skip_initial_fetch: ${{ steps.merge-base.outputs.base_sha != '' }}
          files: |
            deploy/helm/**
            mise.toml
            mise.lock
            tasks/helm.toml
            .github/workflows/helm-lint.yml

  helm-lint:
    name: Helm Lint
    needs: [pr_metadata, helm_changes]
    if: needs.pr_metadata.outputs.should_run == 'true' && needs.helm_changes.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install tools
        run: mise install --locked

      - name: Lint Helm chart
        run: mise run helm:lint

      - name: Check Helm chart README
        run: mise run helm:docs:check

      - name: Run Helm chart unit tests
        run: mise run helm:test