helm-regression.yaml

name: helm-regression

on:
  workflow_call:
  pull_request:
    branches:
      - main
    paths:
      - "charts/**"
      - "tests/contract/**"
      - "proxy/**"
      - "collector/**"
      - ".github/workflows/helm-regression.yaml"

jobs:
  chart-regression:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    env:
      CHART_DIR: charts/llm-gateway
      RELEASE_NAME: llm-gateway
      NAMESPACE: llm-system

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Helm
        uses: azure/setup-helm@v4
        with:
          version: v3.20.0

      - name: Helm lint
        run: |
          helm lint "${CHART_DIR}"

      - name: Render manifests (default + test values)
        run: |
          mkdir -p /tmp/rendered
          helm template "${RELEASE_NAME}" "${CHART_DIR}" \
            -f "${CHART_DIR}/values-ci.yaml" \
            > /tmp/rendered/default.yaml
          if [ -f "${CHART_DIR}/values-test.yaml" ]; then
            helm template "${RELEASE_NAME}" "${CHART_DIR}" -f "${CHART_DIR}/values-test.yaml" > /tmp/rendered/test.yaml
          fi
          echo "Rendered files:"
          ls -la /tmp/rendered

      - name: Install kubeconform
        run: |
          set -euo pipefail
          KUBECONFORM_VERSION="v0.6.7"
          curl -sSL "https://github.com/yannh/kubeconform/releases/download/${KUBECONFORM_VERSION}/kubeconform-linux-amd64.tar.gz" \
            | tar -xz
          sudo mv kubeconform /usr/local/bin/kubeconform
          kubeconform -v

      - name: Validate rendered YAML against Kubernetes schemas (kubeconform)
        run: |
          set -euo pipefail
          kubeconform -strict -ignore-missing-schemas /tmp/rendered/default.yaml
          if [ -f /tmp/rendered/test.yaml ]; then
            kubeconform -strict -ignore-missing-schemas /tmp/rendered/test.yaml
          fi

      - name: Install helm-unittest plugin
        run: |
          helm plugin install https://github.com/helm-unittest/helm-unittest

      - name: Helm unit tests
        run: |
          helm unittest "${CHART_DIR}" --values "${CHART_DIR}/values-ci.yaml"

      - name: Setup kind cluster
        uses: helm/kind-action@v1.10.0
        with:
          version: v0.23.0
          kubectl_version: v1.30.0

      - name: Build images
        run: |
          docker build -t llm-proxy:ci ./proxy
          docker build -t llm-collector:ci ./collector
          docker build -t mock-openai:ci ./tests/contract/mock-openai

      - name: Load images into kind
        run: |
          kind load docker-image llm-proxy:ci --name chart-testing
          kind load docker-image llm-collector:ci --name chart-testing
          kind load docker-image mock-openai:ci --name chart-testing

      - name: Create dummy secret for CI
        run: |
          set -euo pipefail
          kubectl create namespace "${NAMESPACE}" --dry-run=client -o yaml | kubectl apply -f -
          kubectl create secret generic ci-dummy-secret -n "${NAMESPACE}" \
            --from-literal=UPSTREAM_OPENAI_API_KEY=dummy-key \
            --dry-run=client -o yaml | kubectl apply -f -
      
      - name: Deploy mock OpenAI upstream
        run: |
          set -euo pipefail
          kubectl apply -n "${NAMESPACE}" -f tests/contract/k8s/mock-openai.yaml
          kubectl rollout status deployment/mock-openai -n "${NAMESPACE}" --timeout=180s

      - name: Install chart into kind (default)
        run: |
          set -euo pipefail

          helm upgrade --install "${RELEASE_NAME}" "${CHART_DIR}" \
            -f "${CHART_DIR}/values-ci.yaml" \
            --set proxy.image.repository=llm-proxy \
            --set proxy.image.tag=ci \
            --set proxy.image.pullPolicy=IfNotPresent \
            --set collector.image.repository=llm-collector \
            --set collector.image.tag=ci \
            --set collector.image.pullPolicy=IfNotPresent \
            --set proxy.env.UPSTREAM_OPENAI_BASE_URL="http://mock-openai:8080" \
            -n "${NAMESPACE}" --create-namespace

          kubectl get all -n "${NAMESPACE}"

          kubectl rollout status deployment/llm-proxy -n "${NAMESPACE}" --timeout=180s
          kubectl rollout status deployment/llm-collector -n "${NAMESPACE}" --timeout=180s

      - name: Upgrade chart (simulate change via values-test if present)
        run: |
          set -euo pipefail
          if [ -f "${CHART_DIR}/values-test.yaml" ]; then
            helm upgrade "${RELEASE_NAME}" "${CHART_DIR}" \
              -n "${NAMESPACE}" \
              -f "${CHART_DIR}/values-test.yaml"
          else
            echo "No values-test.yaml found. Skipping upgrade-with-test-values."
          fi

          kubectl rollout status deployment/llm-proxy -n "${NAMESPACE}" --timeout=180s
          kubectl rollout status deployment/llm-collector -n "${NAMESPACE}" --timeout=180s

      - name: Smoke check (pods ready + service endpoints)
        run: |
          set -euo pipefail
          kubectl get pods -n "${NAMESPACE}" -o wide
          kubectl get svc  -n "${NAMESPACE}" -o wide

          kubectl wait --for=condition=Available deployment/llm-proxy -n "${NAMESPACE}" --timeout=180s
          kubectl wait --for=condition=Available deployment/llm-collector -n "${NAMESPACE}" --timeout=180s

      - name: Contract tests (OpenAI-compatible contract)
        shell: bash
        run: |
          chmod +x tests/contract/ci-contract.sh
          NAMESPACE="${NAMESPACE}" ./tests/contract/ci-contract.sh