helm_checks.yaml

name: Lint and Test Charts

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  lint-test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        chart-name: [ "langgraph-cloud", "langsmith", "langsmith-auth-proxy" ]

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Set up Helm
        uses: azure/setup-helm@v3
        with:
          version: v3.12.1

      - uses: actions/setup-python@v4
        with:
          python-version: '3.9'
          check-latest: true

      - name: Set up chart-testing
        uses: helm/chart-testing-action@v2.6.0

      - name: Add Helm Repositories
        run: |
          helm repo add langchain https://langchain-ai.github.io/helm/
          helm repo update

      - name: Run chart-testing (lint)
        run: ct lint --target-branch ${{ github.event.repository.default_branch }} --charts charts/${{ matrix.chart-name }}

      - name: Install Helm Unittest
        run: helm plugin install https://github.com/helm-unittest/helm-unittest.git --version 0.7.0

      - name: Run chart unittest
        run: helm unittest charts/${{ matrix.chart-name }}

      - name: Create kind cluster
        uses: helm/kind-action@v1.12.0
        with:
          version: v0.25.0

      - name: Pre-pull and load external images into kind
        run: |
          docker exec chart-testing-control-plane crictl pull docker.io/redis:7
          docker exec chart-testing-control-plane crictl pull docker.io/postgres:14.7
          docker exec chart-testing-control-plane crictl pull docker.io/clickhouse/clickhouse-server:25.4
          docker exec chart-testing-control-plane crictl pull docker.io/mongo:7

      - name: Setup Redis with TLS for Custom CA Testing (LangSmith only)
        if: matrix.chart-name == 'langsmith'
        run: |
          set -e
          echo "=== Creating self-signed certificate for Redis ==="

          # Generate private key and certificate with SAN for Go TLS verification
          openssl genrsa -out /tmp/redis.key 2048
          cat >/tmp/redis-openssl.cnf <<'EOF'
          [req]
          distinguished_name = req_distinguished_name
          req_extensions = v3_req
          x509_extensions = v3_req
          prompt = no

          [req_distinguished_name]
          C = US
          ST = CA
          L = SF
          O = Test
          CN = redis-tls-master.default.svc.cluster.local

          [v3_req]
          basicConstraints = CA:FALSE
          keyUsage = nonRepudiation, digitalSignature, keyEncipherment
          extendedKeyUsage = serverAuth, clientAuth
          subjectAltName = @alt_names

          [alt_names]
          DNS.1 = redis-tls-master.default.svc.cluster.local
          DNS.2 = redis-tls-master
          EOF
          openssl req -new -x509 -key /tmp/redis.key -out /tmp/redis.crt -days 365 -config /tmp/redis-openssl.cnf

          # Create Kubernetes secrets
          kubectl create secret generic redis-tls-secret \
            --from-file=tls.crt=/tmp/redis.crt \
            --from-file=tls.key=/tmp/redis.key \
            --from-file=ca.crt=/tmp/redis.crt \
            --namespace default

          kubectl create secret generic langsmith-custom-ca \
            --from-file=ca-bundle.crt=/tmp/redis.crt \
            --namespace default

          echo "=== Installing Redis with TLS via Bitnami Helm chart ==="
          helm repo add bitnami https://charts.bitnami.com/bitnami
          helm repo update

          helm install redis-tls bitnami/redis \
            --namespace default \
            --set auth.enabled=false \
            --set master.persistence.enabled=false \
            --set replica.replicaCount=0 \
            --set tls.enabled=true \
            --set tls.authClients=false \
            --set tls.autoGenerated=false \
            --set tls.existingSecret=redis-tls-secret \
            --set tls.certFilename=tls.crt \
            --set tls.certKeyFilename=tls.key \
            --set tls.certCAFilename=ca.crt \
            --set master.resources.requests.cpu=50m \
            --set master.resources.requests.memory=64Mi \
            --timeout 5m \
            --wait

          echo "=== Redis with TLS ready for testing ==="

      - name: Run chart-testing (install)
        env:
          LANGSMITH_LICENSE_KEY: ${{ secrets.LANGSMITH_LICENSE_KEY }}
          LANGGRAPH_CLOUD_LICENSE_KEY: ${{ secrets.LANGGRAPH_CLOUD_LICENSE_KEY }}
        run: |
          LANGSMITH_LICENSE_KEY="${LANGSMITH_LICENSE_KEY:-ci-test-license-key}"
          LANGGRAPH_CLOUD_LICENSE_KEY="${LANGGRAPH_CLOUD_LICENSE_KEY:-ci-test-license-key}"
          ct install --target-branch ${{ github.event.repository.default_branch }} --charts charts/${{ matrix.chart-name }} --namespace default --helm-extra-set-args "--timeout=15m --set=frontend.service.type=ClusterIP --set=config.langsmithLicenseKey=$LANGSMITH_LICENSE_KEY --set=config.langGraphCloudLicenseKey=$LANGGRAPH_CLOUD_LICENSE_KEY --set=apiServer.service.type=ClusterIP --set=studio.service.type=ClusterIP --set=redis.statefulSet.resources.requests.cpu=50m --set=redis.statefulSet.resources.requests.memory=64Mi --set=postgres.statefulSet.resources.requests.cpu=100m --set=postgres.statefulSet.resources.requests.memory=256Mi --set=clickhouse.statefulSet.resources.requests.cpu=200m --set=clickhouse.statefulSet.resources.requests.memory=512Mi"

      - name: Collect LangSmith diagnostics (pods/events/logs)
        if: always() && matrix.chart-name == 'langsmith'
        run: |
          set -xe
          kubectl get pods -n default -o wide || true
          kubectl get events -n default --sort-by=.metadata.creationTimestamp | tail -n 200 || true

          pods=$(kubectl get pods -n default -o name | grep ingest-queue || true)
          for pod in $pods; do
            echo "=== Describe $pod ==="
            kubectl describe -n default "$pod" || true
            echo "=== Logs $pod (last 200 lines) ==="
            kubectl logs -n default "$pod" --tail=200 || true
          done