ci(k8s): gate the Helm chart on every PR (refs #168)

`make k8s-lint` existed since the chart landed but nothing ran it, so the chart had no automated coverage at all. A `k8s` job now runs it plus `make k8s-drift` on every push and PR: no cluster, ~20s, and it catches the two failure modes the chart is actually exposed to — a values typo that renders invalid YAML, and a change made to one stack but not the other. helm is installed as its pinned static binary (the URL the Talos runbook already gives developers) rather than via a marketplace action: nothing extra to vet. The `k8s` targets stay out of `make ci` on purpose — helm is optional for anyone not deploying to Kubernetes — which is the one place local and CI now differ, noted in docs/runbooks/ci.md.
2026-09-10 11:01:29 +02:00
parent fddf14e5f9
commit 70de3d0a4d
4 changed files with 34 additions and 5 deletions
@@ -2,8 +2,10 @@

 > **Status: active.** The workflow `.gitea/workflows/ci.yaml` runs on Gitea's
 > hosted `ubuntu-latest` runner — no self-hosted runner required.
-> **`make ci` is still the local gate** — it runs the exact same checks
-> (the workflow calls the same `make` targets).
+> **`make ci` is still the local gate** — it runs the same checks via the same
+> `make` targets, with one exception: the `k8s` job's targets are not in `make ci`,
+> because `helm` is optional for everyone not deploying to Kubernetes. Run
+> `make k8s-lint k8s-drift` by hand after touching the chart or the compose file.

 ## The pipeline

@@ -16,6 +18,8 @@ and CI cannot drift:
 | `lint` | `make lint` → `dotnet format … --verify-no-changes` | .NET 10 SDK |
 | `build` | `make build` → `dotnet build … -c Release` | .NET 10 SDK |
 | `unit` | `make unit` → `dotnet test … -c Release --filter "Category!=Integration"` | .NET 10 SDK |
+| `frontend` | `make frontend` → Nx lint/test/build for the four portals | pnpm + Node |
+| `k8s` | `make k8s-lint` (render + schema-check the Helm chart) → `make k8s-drift` (chart still describes the same stack as `infra/docker-compose.yml`) | pinned `helm` binary + `docker compose` |
 | `mutation` | `make mutation` → `dotnet tool restore` → `dotnet stryker` (ACL); uploads the HTML report as an artifact | .NET 10 SDK |
 | `verify-stack` | the single live-stack stage — steps: `make verify-up` (full stack up + health, the DoD smoke) → `make verify-acl` (ACL ↔ OpenZaak) → `make verify-nrc` (OpenZaak → NRC delivery) → `make down` | container engine + egress (base images, nuget, `selectielijst.openzaak.nl`) |

@@ -322,6 +322,7 @@ The PVCs carry `helm.sh/resource-policy: keep`, so `make k8s-down` leaves the da

 ```bash
 make k8s-lint                      # render + schema-check the chart, no cluster needed
+make k8s-drift                     # fail if compose and the chart describe different stacks
 make k8s-portals                   # forward the portals + Keycloak to localhost (browser access)
 make k8s-images K8S_REGISTRY=...   # after changing a service or a portal
 make k8s-up TALOS_HOST=... K8S_REGISTRY=...
@@ -366,5 +367,7 @@ immutable, so `helm upgrade` is rejected with `cannot patch "…" with kind Job`
  `K8S_SET='--set workloads.tempo.enabled=true --set workloads.prometheus.enabled=true --set workloads.grafana.enabled=true'`.
  The .NET services still export OTLP; the exporter fails harmlessly when Tempo is absent.
 - **The verify/e2e lanes.** `make verify*` and the Playwright e2e drive compose, not the
-  chart. The Kubernetes path is verified with §5's smoke test.
+  chart. The Kubernetes path is verified with §5's smoke test. CI's `k8s` job runs the two
+  clusterless checks (`k8s-lint`, `k8s-drift`) on every PR — a values typo or a compose
+  image bump that skipped the chart fails there, but nothing deploys the chart in CI.
 - **Ingress, TLS, and resource requests.** See the ponytail ceiling in ADR-0033.