ci: re-enable in-process Helm render in validate (revert --skip-helm-render) - #2273
ci: re-enable in-process Helm render in validate (revert --skip-helm-render)#2273botantler-1[bot] merged 11 commits into
Conversation
Sorry, something went wrong.
…render) Removes the --skip-helm-render workaround added in #2270 and restores full in-process rendering for `ksail workload validate`, so the actually-applied manifests are validated again. The non-determinism that forced the workaround was a buffer-aliasing data race in kubeconform's resource.FromStream (ksail#5362), fixed upstream in yannh/kubeconform#363 — not the Helm render itself. Merge only after ksail's kubeconform dependency is bumped to include that fix, or validate goes flaky again. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting. Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThe CI workflow’s manifest validation job removes --skip-helm-render from both validation commands and updates the surrounding comment to describe the upstream kubeconform fix and the TRIPWIRE note. Possibly related issues
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. ❤️ ShareComment @coderabbitai help to get the list of available commands. |
Sorry, something went wrong.
Why this PR's CI is red (documented so the failure is explained, per the open-PR hygiene sweep): This PR re-enables the in-process Helm render — which re-exposes the kubeconform#363 FromStream buffer-alias race it was skipped to avoid. Two consecutive 🧪 Validate Manifests runs failed with different randomly-corrupted resources, the race's signature:
Re-running is a coin flip, not a fix. The root-cause fix is upstream (yannh/kubeconform#363, fix PR submitted); a ksail-side replace to a fork is ruled out (supply-chain policy). This PR stays draft-parked until ksail ships a kubeconform release containing the fix, then goes green and merges (tracked in ksail#5362). Side-observation from the render log: the in-process render also surfaces the actual-budget chart-schema failure (login.openid oneOf) that #2359 fixes — one more reason to promote #2359. |
Sorry, something went wrong.
Updated diagnosis (518th-run sweep): this revert is now blocked by two things, not just the kubeconform race —
Next actionable step for this PR: add the #2359-style schema-valid filler to the local actual-budget values (can ride in this branch — it only affects the render-enabled validation path), then wait out (1). |
Sorry, something went wrong.
Correction to yesterday's re-diagnosis — deeper local repro (6× ksail workload validate on this branch) shows the actual-budget login.openid oneOf message is only a render-skip warning, not a deterministic failure: ksail falls back to validating the HelmRelease as-is and the leg passes whenever the render race doesn't fire (3/6 runs fully green, 101/101). The sole real blocker is the known kubeconform YAML-corruption race (kubeconform#363), and on this branch it consistently bites the largest rendered document — CustomResourceDefinition/ephemeralreports.reports.kyverno.io (from HelmRelease kyverno/kyverno, providers/docker/infrastructure/controllers, same yaml: line 145 corruption in all 3 failing runs). So the original gate stands unchanged: merge only after ksail ships a kubeconform with #363 fixed. The "add a #2359-style local filler" next-step from yesterday is retracted — no values change is needed for CI here. (Separately, making the base's schema-satisfaction offline-resolvable — existingSecret instead of the valuesFrom-injected clientSecret — would let CI really render-validate actual-budget instead of warning-skipping it; filed as its own issue since it touches the live prod values path.) I've re-run the failed check; expect ~coin-flip greens until the upstream fix lands. |
Sorry, something went wrong.
Status note on the promotion: this revert stays red by design until the root cause ships — the 🧪 Validate Manifests failure is the kubeconform YAML-corruption race itself (yannh/kubeconform#363, my upstream fix, still open as of 2026-07-02). The merge order is: kubeconform releases with #363 → ksail bumps kubeconform → this PR's gate turns green → merge restores in-process Helm render validation. I sweep the upstream PR every run; no action needed here — promoting it early is fine, it will be driven to merge the moment the chain unblocks. |
Sorry, something went wrong.
@coderabbitai review |
Sorry, something went wrong.
|
@devantler Understood — kicking off a review now, though per the discussion this PR is expected to remain red until the kubeconform #363 fix lands upstream and ksail bumps its dependency. ✅ Action performedReview finished.
|
Sorry, something went wrong.
|
✅ Action performed
Review finished.
|
Sorry, something went wrong.
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1).github/workflows/ci.yaml (1)105-111: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win
Verify multi-run CI stability before relying on this step, given documented nondeterminism.
Per PR comments, the underlying race causes different failures across reruns rather than a single stable regression. A single green CI run on this step is not sufficient confidence that the race is actually resolved; consider requiring several consecutive green runs (or a temporary re-run-on-schedule check) before treating this as unblocked.
🤖 Prompt for AI AgentsVerify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yaml around lines 105 - 111, The CI validation step in the workflow is being treated as fully unblocked based on a single run, but the comment notes the underlying race can still produce nondeterministic rerun failures. Update the check around the ksail workload validate commands to require stronger stability evidence before relying on it, such as several consecutive successful runs or a temporary scheduled rerun verification, and anchor this logic in the existing validation job that runs ksail workload validate and ksail --config ksail.prod.yaml workload validate.
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. Outside diff comments: In @.github/workflows/ci.yaml: - Around line 105-111: The CI validation step in the workflow is being treated as fully unblocked based on a single run, but the comment notes the underlying race can still produce nondeterministic rerun failures. Update the check around the ksail workload validate commands to require stronger stability evidence before relying on it, such as several consecutive successful runs or a temporary scheduled rerun verification, and anchor this logic in the existing validation job that runs ksail workload validate and ksail --config ksail.prod.yaml workload validate.
ℹ️ Review info ⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 29b4b9b3-8632-41d7-b2b1-37392037a9c9
📥 CommitsReviewing files that changed from the base of the PR and between 36372d5 and 8b9d4e2.
📒 Files selected for processing (1)- .github/workflows/ci.yaml
CodeRabbit considers these linked repositories for cross-repo context during reviews:
- devantler-tech/actions (auto-detected)
- devantler-tech/aws (auto-detected)
- devantler-tech/ksail (auto-detected)
- devantler-tech/reusable-workflows (auto-detected)
- devantler-tech/wedding-app (auto-detected)
- devantler-tech/ascoachingogvaner (auto-detected)
- devantler-tech/unifi (auto-detected)
- devantler-tech/provider-upjet-unifi (auto-detected)
- devantler-tech/agent-skills (auto-detected)
Linked repositories findings
devantler-tech/ksail
- pkg/svc/gitops/render/resolver.go — states the FromStream race is fixed only by bumping kubeconform past yannh/kubeconform#363, so removing --skip-helm-render is consistent with the intended fixed behavior.
- schemas/ksail-config.schema.json:1127 — helmRender defaults to true and --skip-helm-render is documented as an override, so CI dropping the flag matches current config semantics.
- docs/src/content/docs/cli-flags/workload/workload-validate.mdx:39-46 — docs describe in-process Helm rendering as the default for ksail workload validate, with --skip-helm-render only as an opt-out.
- .github/actions/ksail-system-test/action.yaml:322 — already invokes ksail workload validate without the skip flag, showing an existing consumer path expects full rendering.
devantler-tech/actions
- setup-ksail-cli/action.yaml is present, but the repo search found no ksail workload validate, skip-helm-render, kubeconform, or FromStream references.
- No cross-repo consumer here appears to depend on the removed workaround.
.github/workflows/ci.yaml (1)79-111: 🩺 Stability & Availability
No issue: the --skip-helm-render workaround can stay removed. ksail 7.159.1 already pins kubeconform v0.8.0, which includes the FromStream fix.
> Likely an incorrect or invalid review comment.
Sorry, something went wrong.
# Conflicts: # .github/workflows/ci.yaml
Resolved the CodeRabbit outside-diff finding from the latest review body while clearing the merge conflict. I live-verified the dependency chain before editing: yannh/kubeconform#363 is still open, and the latest kubeconform release is still v0.8.0, so the old “already fixed” wording on this branch was stale. The conflict resolution now keeps origin/main's kubeconform schema cache, keeps this PR's deliberate no---skip-helm-render validation command, and updates the workflow comment to say the PR stays parked until ksail carries the kubeconform FromStream fix and this gate has stable green evidence. I did not add a separate scheduled/consecutive-run workflow here because that would be new CI machinery outside this revert's scope. The merge gate remains the required validation job once the upstream dependency actually carries the fix. |
Sorry, something went wrong.
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1).github/workflows/ci.yaml (1)78-91: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Comment at Lines 87-91 contradicts the PR's actual status (and lines 127-131 in the same file).
This block asserts the kubeconform#363 race is "Fixed upstream... and picked up via ksail's kubeconform bump," implying full-render validation is safely restored. But per the PR's own description and comments, the upstream fix has not yet shipped/been picked up by ksail — this PR is red right now specifically because of this same race, and is intentionally parked until the fix lands. The validate-step comment at Lines 127-131 correctly reflects this ("Keep it parked until ksail carries the kubeconform FromStream fix... and this gate has stable green evidence."), so the two comment blocks in this file directly disagree on whether the fix is in place.
Leaving the misleading "fixed and restored" framing at Lines 87-91 risks confusing whoever eventually merges this PR into thinking the workaround removal is already validated as safe, when it should instead only be merged once CI is actually green with the upstream fix incorporated.
✏️ Suggested comment correction- # buffer-aliasing data race in kubeconform's resource.FromStream (it yields - # resources aliasing the reused bufio.Scanner buffer, parsed concurrently - # with the producer's next Scan()) corrupted the validated stream on the - # >4MB HelmRelease-dense overlays (ksail#5362) — and was worked around with - # --skip-helm-render (platform PR `#2270`). Fixed upstream in - # yannh/kubeconform#363 and picked up via ksail's kubeconform bump, so the - # workaround is removed below and full-render validation is restored. - # TRIPWIRE: if validate/scan starts swinging run-to-run again, re-add - # --skip-helm-render and reopen ksail#5362. + # buffer-aliasing data race in kubeconform's resource.FromStream (it yields + # resources aliasing the reused bufio.Scanner buffer, parsed concurrently + # with the producer's next Scan()) corrupted the validated stream on the + # >4MB HelmRelease-dense overlays (ksail#5362) — and was worked around with + # --skip-helm-render (platform PR `#2270`). The workaround is removed below + # to restore full-render validation, but this is only safe once + # yannh/kubeconform#363 is fixed upstream AND picked up via a ksail bump — + # do not merge this change until CI is stable green with that fix in place. + # TRIPWIRE: if validate/scan swing run-to-run, re-add --skip-helm-render + # and reopen ksail#5362.As per PR objectives: The description says the earlier reduction in validation was temporary to avoid a third-party tool bug, and that full validation should be restored once the upstream fix for yannh/kubeconform#363 is available in ksail. It also says the PR should not be merged until that fix ships and is picked up by ksail.
Also applies to: 121-134
🤖 Prompt for AI AgentsVerify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yaml around lines 78 - 91, The Setup KSail comment currently says the kubeconform#363 issue is already fixed upstream and picked up by ksail, which conflicts with the parked-validate comment later in this workflow. Update the text in the comment block around the validate step to match the PR’s real status: the workaround removal is not yet safe, the upstream fix has not been carried by ksail, and full-render validation should remain parked until the fix lands and green CI evidence exists. Keep the wording consistent with the later comment block so the references to kubeconform#363 and ksail’s kubeconform bump do not imply the issue is already resolved.
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. Outside diff comments: In @.github/workflows/ci.yaml: - Around line 78-91: The Setup KSail comment currently says the kubeconform#363 issue is already fixed upstream and picked up by ksail, which conflicts with the parked-validate comment later in this workflow. Update the text in the comment block around the validate step to match the PR’s real status: the workaround removal is not yet safe, the upstream fix has not been carried by ksail, and full-render validation should remain parked until the fix lands and green CI evidence exists. Keep the wording consistent with the later comment block so the references to kubeconform#363 and ksail’s kubeconform bump do not imply the issue is already resolved.
ℹ️ Review info ⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a6d91411-efb2-4e1f-ba08-4331a7ce82ba
📥 CommitsReviewing files that changed from the base of the PR and between 8b9d4e2 and 60a9d28.
📒 Files selected for processing (1)- .github/workflows/ci.yaml
CodeRabbit considers these linked repositories for cross-repo context during reviews:
- devantler-tech/actions (auto-detected)
- devantler-tech/aws (auto-detected)
- devantler-tech/ksail (auto-detected)
- devantler-tech/reusable-workflows (auto-detected)
- devantler-tech/wedding-app (auto-detected)
- devantler-tech/ascoachingogvaner (auto-detected)
- devantler-tech/unifi (auto-detected)
- devantler-tech/provider-upjet-unifi (auto-detected)
- devantler-tech/agent-skills (auto-detected)
- GitHub Check: 🧪 Validate Manifests
Linked repositories findings
devantler-tech/actions
- .github/workflows/validate-go-project.yaml:645-676 — this workflow caches ~/.cache/ksail/kubeconform and explicitly references ksail’s kubeconform-backed schema validation. It does not call ksail workload validate or use --skip-helm-render, so the CI flag removal in the PR does not appear to affect this repo’s workflow directly. [::devantler-tech/actions::]
- .github/workflows/validate-go-project.yaml:734-758 — same cache pattern in the second job block; again no dependency on the removed Helm-render workaround. [::devantler-tech/actions::]
devantler-tech/reusable-workflows
- Search for ksail workload validate, skip-helm-render, kubeconform, and FromStream returned no matches. No direct consumer of the changed validation behavior was found here. [::devantler-tech/reusable-workflows::]
devantler-tech/ksail
- I couldn’t clone the repo in this run due to an internal clone error, but prior research already identified that ksail documents helmRender as the default and --skip-helm-render as an opt-out, which is consistent with the PR’s behavior change. [::devantler-tech/ksail::]
Sorry, something went wrong.
Rechecked this PR against KSail 7.162.0 while sweeping trusted PR hygiene. Full in-process Helm render validation is still nondeterministic, so this PR is not ready to merge yet:
Opened devantler-tech/ksail#5978 as a draft fix for #5362 by splitting rendered manifest streams before kubeconform validation. Leaving this platform PR unchanged until that fix lands in a KSail release and this branch can be revalidated with repeated clean runs. |
Sorry, something went wrong.
Resolved the latest CodeRabbit outside-diff finding by aligning both workflow comments with the PR's real parked status: full Helm-render validation is intentionally not merge-ready until ksail carries yannh/kubeconform#363 and this gate has stable green evidence. @coderabbitai review |
Sorry, something went wrong.
|
@devantler Got it — kicking off the review now. As context, this PR is expected to continue showing red on 🧪 Validate Manifests until yannh/kubeconform#363 lands upstream and ksail bumps its dependency, per the documented parked status. ✅ Action performedReview finished.
|
Sorry, something went wrong.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agentsVerify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. Inline comments: In @.github/workflows/ci.yaml: - Around line 86-91: The CI workflow is removing the `--skip-helm-render` workaround too early, which leaves the shared `validate` job exposed to the kubeconform `FromStream` flake. Update the workflow around the `validate`/`scan` job steps in `.github/workflows/ci.yaml` to keep passing `--skip-helm-render` until the pinned `KSAIL_VERSION` is bumped to a release that includes the fix, or otherwise ensure the `validate` path only runs after that bump.
ℹ️ Review info ⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: afb163da-6cd0-4ce6-9c62-a597678d1331
📥 CommitsReviewing files that changed from the base of the PR and between 60a9d28 and 3ca5b22.
📒 Files selected for processing (1)- .github/workflows/ci.yaml
CodeRabbit considers these linked repositories for cross-repo context during reviews:
- devantler-tech/actions (auto-detected)
- devantler-tech/aws (auto-detected)
- devantler-tech/ksail (auto-detected)
- devantler-tech/reusable-workflows (auto-detected)
- devantler-tech/wedding-app (auto-detected)
- devantler-tech/ascoachingogvaner (auto-detected)
- devantler-tech/unifi (auto-detected)
- devantler-tech/provider-upjet-unifi (auto-detected)
- devantler-tech/agent-skills (auto-detected)
GitHub Actions: CI / 0_CI - Required Checks.txt: ci: re-enable in-process Helm render in validate (revert --skip-helm-render)
Conclusion: failure
##[group]Run set -Eeuo pipefail
�[36;1mset -Eeuo pipefail�[0m
�[36;1m�[0m
�[36;1m# Disable globbing so wildcards in input are not expanded.�[0m
�[36;1mset -f�[0m
�[36;1mread -r -a results <<< "$JOB_RESULTS"�[0m
�[36;1m�[0m
�[36;1mfailed=false�[0m
�[36;1mallowed_values="success, failure, cancelled, skipped"�[0m
�[36;1m�[0m
�[36;1mfor result in "${results[@]}"; do�[0m
�[36;1m case "$result" in�[0m
�[36;1m success|skipped)�[0m
�[36;1m ;;�[0m
�[36;1m failure|cancelled)�[0m
�[36;1m failed=true�[0m
�[36;1m ;;�[0m
�[36;1m *)�[0m
�[36;1m printf '%s\n' "❌ $CHECK_NAME — unknown job result: '$result'. Allowed values: $allowed_values."�[0m
�[36;1m exit 1�[0m
�[36;1m ;;�[0m
�[36;1m esac�[0m
�[36;1mdone�[0m
�[36;1m�[0m
�[36;1mif [ "$failed" = true ]; then�[0m
�[36;1m printf '%s\n' "❌ $CHECK_NAME — at least one job failed or was cancelled."�[0m
�[36;1m exit 1�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mprintf '%s\n' "✅ $CHECK_NAME — all jobs succeeded or were skipped."�[0m
shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
env:
JOB_RESULTS: success failure success success skipped
CHECK_NAME: CI - Required Checks
##[endgroup]
❌ CI - Required Checks — at least one job failed or was cancelled.
##[error]Process completed with exit code 1.
GitHub Actions: CI / 🧪 Validate Talos Machine Config: ci: re-enable in-process Helm render in validate (revert --skip-helm-render)
Conclusion: failure
�[36;1m echo "::group::${dir} (${mode})"�[0m
�[36;1m�[0m
�[36;1m # Every ${VAR} referenced by the overlay's patches must be set and�[0m
�[36;1m # non-empty here — an empty expansion is exactly the class of�[0m
�[36;1m # failure that evicted `#2462` from the merge queue.�[0m
�[36;1m local vars v fmt=""�[0m
�[36;1m vars=$(grep -rhoE '[$][{][A-Za-z_][A-Za-z0-9_]*[}]' "$dir" | sort -u | tr -d '{}$') || true�[0m
�[36;1m for v in $vars; do�[0m
�[36;1m if [ -z "${!v:-}" ]; then�[0m
�[36;1m echo "::error::${dir}: \${${v}} is referenced by a patch but unset/empty — deploy would render an invalid machine config"�[0m
GitHub Actions: CI / 🧪 Validate Manifests: ci: re-enable in-process Helm render in validate (revert --skip-helm-render)
Conclusion: failure
##[group]Run ksail workload validate
�[36;1mksail workload validate�[0m
�[36;1mksail --config ksail.prod.yaml workload validate�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
✅ Validating kustomizations...
2026/07/09 17:07:13 warning: destination for crossview.secrets.dbPassword is a table. Ignoring non-table value ()
2026/07/09 17:07:13 warning: destination for crossview.secrets.sessionSecret is a table. Ignoring non-table value ()
2026/07/09 17:07:13 warning: destination for crossview.secrets.OIDCClientSecret is a table. Ignoring non-table value ()
2026/07/09 17:07:13 warning: destination for crossview.secrets.adminPassword is a table. Ignoring non-table value (password)
✔ bases/apps/ascoachingogvaner validated
✔ bases/apps/crossview validated
✔ bases/apps/github-config validated
✔ bases/apps/backstage validated
✔ bases/apps/actual-budget validated
✔ bases/apps/fleetdm validated
✔ bases/apps/headlamp validated
✔ bases/apps/wedding-app validated
✔ bases/bootstrap validated
✔ bases/bootstrap/priority-classes validated
✔ bases/components/helmrelease-drift-detection validated
✔ bases/components/helmrelease-flux-defaults validated
✔ bases/apps/homepage validated
✔ bases/infrastructure/cluster-policies validated
✔ bases/infrastructure/cluster-role-bindings validated
✔ bases/infrastructure/cluster-roles validated
✔ bases/infrastructure/cluster-secret-stores validated
✔ bases/infrastructure/cluster-security-exceptions validated
✔ bases/apps/umami validated
✔ bases/apps/whoami validated
✔ bases/infrastructure/controllers/auth-proxy validated
✔ bases/infrastructure/controllers/cdi validated
✔ bases/infrastructure/controllers/cert-manager validated
✔ bases/infrastructure validated
✔ bases/infrastructure/controllers/chaos-mesh validated
✔ bases/infrastructure/controllers/coredns validated
✔ bases/infrastructure/controllers/cilium validated
✔ bases/infrastructure/controllers/cloudnative-pg validated
✔ bases/infrastructure/controllers/coro...
GitHub Actions: CI / 2_🧪 Validate Talos Machine Config.txt: ci: re-enable in-process Helm render in validate (revert --skip-helm-render)
Conclusion: failure
�[36;1m echo "::group::${dir} (${mode})"�[0m
�[36;1m�[0m
�[36;1m # Every ${VAR} referenced by the overlay's patches must be set and�[0m
�[36;1m # non-empty here — an empty expansion is exactly the class of�[0m
�[36;1m # failure that evicted `#2462` from the merge queue.�[0m
�[36;1m local vars v fmt=""�[0m
�[36;1m vars=$(grep -rhoE '[$][{][A-Za-z_][A-Za-z0-9_]*[}]' "$dir" | sort -u | tr -d '{}$') || true�[0m
�[36;1m for v in $vars; do�[0m
�[36;1m if [ -z "${!v:-}" ]; then�[0m
�[36;1m echo "::error::${dir}: \${${v}} is referenced by a patch but unset/empty — deploy would render an invalid machine config"�[0m
GitHub Actions: CI / CI - Required Checks: ci: re-enable in-process Helm render in validate (revert --skip-helm-render)
Conclusion: failure
##[group]Run set -Eeuo pipefail
�[36;1mset -Eeuo pipefail�[0m
�[36;1m�[0m
�[36;1m# Disable globbing so wildcards in input are not expanded.�[0m
�[36;1mset -f�[0m
�[36;1mread -r -a results <<< "$JOB_RESULTS"�[0m
�[36;1m�[0m
�[36;1mfailed=false�[0m
�[36;1mallowed_values="success, failure, cancelled, skipped"�[0m
�[36;1m�[0m
�[36;1mfor result in "${results[@]}"; do�[0m
�[36;1m case "$result" in�[0m
�[36;1m success|skipped)�[0m
�[36;1m ;;�[0m
�[36;1m failure|cancelled)�[0m
�[36;1m failed=true�[0m
�[36;1m ;;�[0m
�[36;1m *)�[0m
�[36;1m printf '%s\n' "❌ $CHECK_NAME — unknown job result: '$result'. Allowed values: $allowed_values."�[0m
�[36;1m exit 1�[0m
�[36;1m ;;�[0m
�[36;1m esac�[0m
�[36;1mdone�[0m
�[36;1m�[0m
�[36;1mif [ "$failed" = true ]; then�[0m
�[36;1m printf '%s\n' "❌ $CHECK_NAME — at least one job failed or was cancelled."�[0m
�[36;1m exit 1�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mprintf '%s\n' "✅ $CHECK_NAME — all jobs succeeded or were skipped."�[0m
shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
env:
JOB_RESULTS: success failure success success skipped
CHECK_NAME: CI - Required Checks
##[endgroup]
❌ CI - Required Checks — at least one job failed or was cancelled.
##[error]Process completed with exit code 1.
GitHub Actions: CI / 4_🧪 Validate Manifests.txt: ci: re-enable in-process Helm render in validate (revert --skip-helm-render)
Conclusion: failure
##[group]Run ksail workload validate
�[36;1mksail workload validate�[0m
�[36;1mksail --config ksail.prod.yaml workload validate�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
✅ Validating kustomizations...
2026/07/09 17:07:13 warning: destination for crossview.secrets.dbPassword is a table. Ignoring non-table value ()
2026/07/09 17:07:13 warning: destination for crossview.secrets.sessionSecret is a table. Ignoring non-table value ()
2026/07/09 17:07:13 warning: destination for crossview.secrets.OIDCClientSecret is a table. Ignoring non-table value ()
2026/07/09 17:07:13 warning: destination for crossview.secrets.adminPassword is a table. Ignoring non-table value (password)
✔ bases/apps/ascoachingogvaner validated
✔ bases/apps/crossview validated
✔ bases/apps/github-config validated
✔ bases/apps/backstage validated
✔ bases/apps/actual-budget validated
✔ bases/apps/fleetdm validated
✔ bases/apps/headlamp validated
✔ bases/apps/wedding-app validated
✔ bases/bootstrap validated
✔ bases/bootstrap/priority-classes validated
✔ bases/components/helmrelease-drift-detection validated
✔ bases/components/helmrelease-flux-defaults validated
✔ bases/apps/homepage validated
✔ bases/infrastructure/cluster-policies validated
✔ bases/infrastructure/cluster-role-bindings validated
✔ bases/infrastructure/cluster-roles validated
✔ bases/infrastructure/cluster-secret-stores validated
✔ bases/infrastructure/cluster-security-exceptions validated
✔ bases/apps/umami validated
✔ bases/apps/whoami validated
✔ bases/infrastructure/controllers/auth-proxy validated
✔ bases/infrastructure/controllers/cdi validated
✔ bases/infrastructure/controllers/cert-manager validated
✔ bases/infrastructure validated
✔ bases/infrastructure/controllers/chaos-mesh validated
✔ bases/infrastructure/controllers/coredns validated
✔ bases/infrastructure/controllers/cilium validated
✔ bases/infrastructure/controllers/cloudnative-pg validated
✔ bases/infrastructure/controllers/coro...
Linked repositories findings
devantler-tech/ksail
- pkg/svc/gitops/render/resolver.go:31-35, 39, 129-130 — the in-process Helm render path is explicitly serialized with helmRenderMu because of the kubeconform FromStream race, and the comment says the fix is only in a newer kubeconform than the repo currently pins. This is the direct upstream context for re-enabling ksail workload validate without --skip-helm-render. [::devantler-tech/ksail::]
- docs/src/content/docs/cli-flags/workload/workload-validate.mdx:43-46 — documents --skip-helm-render as an opt-out and says Helm charts are rendered in-process by default. Removing the flag from CI aligns with the documented default behavior. [::devantler-tech/ksail::]
- schemas/ksail-config.schema.json:1125-1127 — the config schema also documents helmRender as default true and --skip-helm-render as the per-run override, confirming the CI change is restoring the intended validation mode. [::devantler-tech/ksail::]
devantler-tech/actions
- .github/workflows/validate-go-project.yaml:645-676, 734-758 — this repo caches ~/.cache/ksail/kubeconform for test/coverage jobs and references ksail’s kubeconform-backed validation, but it does not invoke ksail workload validate or depend on --skip-helm-render. No direct breakage from the CI flag removal was found here. [::devantler-tech/actions::]
devantler-tech/reusable-workflows
- No matches for ksail workload validate, skip-helm-render, kubeconform, or FromStream; no direct consumer of the changed behavior was found. [::devantler-tech/reusable-workflows::]
devantler-tech/aws
- No matches for ksail workload validate, skip-helm-render, kubeconform, or FromStream; no direct consumer of the changed behavior was found. [::devantler-tech/aws::]
Sorry, something went wrong.
Re-verified this during the 2026-07-10 scheduled sweep before attempting to push any branch update. I merged current platform/main locally into claude/ci-restore-render so this PR's validation path used the newly merged KSAIL_VERSION: "7.163.0" from #2552, then ran the exact static gate with the v7.163.0 release binary:
Result: still fails with the same nondeterministic rendered-stream corruption signature, now on CloudNativePG CRDs: providers/docker/infrastructure/controllers: ... CustomResourceDefinition/databases.postgresql.cnpg.io: error unmarshalling resource: error converting YAML to JSON: yaml: line 147: could not find expected ':' (from HelmRelease cnpg-system/cloudnative-pg)
I did not push the branch update because it would only retrigger the same red gate. Current conclusion: #2273 remains blocked on the ksail-side stream splitting fix in devantler-tech/ksail#5978 / devantler-tech/ksail#5362, not on platform drift. |
Sorry, something went wrong.
|
🎉 This PR is included in version 1.110.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Sorry, something went wrong.
Why
Platform temporarily disabled in-process Helm rendering during manifest
validation in #2270 because a kubeconform stream-aliasing race corrupted large,
multi-document overlays. Reduced validation could allow errors in rendered Helm
resources to reach the cluster unseen.
What
and per-document byte-cloning containment from ksail#5978 / ksail#5362.
nondeterministic again while fix: copy scanner bytes in FromStream to prevent aliasing data race yannh/kubeconform#363 remains open.
Validation
the binary reports commit 14d474c78252949a95c9de72127c07428e97a056.
runs.
Merge evidence
Upstream kubeconform#363 is still open, so the KSail containment is the active
fix. Merge only after consecutive full Linux CI validation runs remain green;
any renewed parse corruption or score swing reactivates the documented tripwire.