ci(k8s): gate the Helm chart on every PR (refs #168)

`make k8s-lint` existed since the chart landed but nothing ran it, so the chart had no automated coverage at all. A `k8s` job now runs it plus `make k8s-drift` on every push and PR: no cluster, ~20s, and it catches the two failure modes the chart is actually exposed to — a values typo that renders invalid YAML, and a change made to one stack but not the other. helm is installed as its pinned static binary (the URL the Talos runbook already gives developers) rather than via a marketplace action: nothing extra to vet. The `k8s` targets stay out of `make ci` on purpose — helm is optional for anyone not deploying to Kubernetes — which is the one place local and CI now differ, noted in docs/runbooks/ci.md.
2026-09-10 11:01:29 +02:00
parent fddf14e5f9
commit 70de3d0a4d
4 changed files with 34 additions and 5 deletions
@@ -126,8 +126,9 @@ Consequences of that shape, each chosen deliberately:

 **Negative / costs**

- A second deployment description to keep in step with compose. Nothing enforces that
-  today; a drift check belongs in CI (follow-up).
+- A second deployment description to keep in step with compose. `make k8s-drift` (#168)
+  now enforces the part that bites — the workload set and the resolved images, with the
+  four deviations below declared — but not per-workload env, ports or volumes.
 - `helm install` alone is not enough — the ConfigMaps must be seeded first, and a missing
  one surfaces as `ContainerCreating`, not as a clear error.
 - Generic templates mean a values typo can render valid-but-wrong YAML; `k8s-lint` catches