Conversation
stigglor
changed the title
Add a templated Helm chart under helm/ for deploying Logflare to Kubernetes, along with a GitHub Actions workflow that gates chart changes on pull requests. The workflow runs only on PRs that touch helm/**, and it: - installs Helm and the helm-unittest plugin - lints the chart - runs the chart unit tests - renders the chart with default values via helm template - verifies the chart version in Chart.yaml has been bumped above main
![depthfirst-app[bot]](https://avatars.githubusercontent.com/in/1021002?s=60&v=4){kind=small}
| uses: azure/setup-helm@v4 | ||
|
|
||
| - name: Install helm-unittest plugin | ||
| run: helm plugin install --verify=false https://github.com/helm-unittest/helm-unittest |
There was a problem hiding this comment.
🟡 Severity: MEDIUM
The --verify=false flag explicitly disables cryptographic signature verification when downloading the helm-unittest plugin from GitHub. If the upstream repository or release artifacts are compromised, a malicious plugin binary would be installed and executed with full CI runner privileges without any integrity check.
Helpful? Add 👍 / 👎
💡 Fix Suggestion
Suggestion: Remove the --verify=false flag from the helm plugin install command so that Helm performs its default cryptographic signature verification when downloading and installing the helm-unittest plugin. This ensures the integrity of the plugin binary is validated before execution in the CI runner.
⚠️ Experimental Feature: This code suggestion is automatically generated. Please review carefully.
| run: helm plugin install --verify=false https://github.com/helm-unittest/helm-unittest | |
| run: helm plugin install https://github.com/helm-unittest/helm-unittest |
| fetch-depth: 0 | ||
|
|
||
| - name: Set up Helm | ||
| uses: azure/setup-helm@v4 |
There was a problem hiding this comment.
🟡 Severity: MEDIUM
The azure/setup-helm action is pinned to the mutable tag v4 rather than an immutable full-length commit SHA. If the v4 tag is moved — e.g. after a supply chain compromise of the upstream repo — a malicious action version would execute with full CI runner privileges and access to all workflow secrets.
Helpful? Add 👍 / 👎
💡 Fix Suggestion
Suggestion: Pin the azure/setup-helm action to an immutable full-length commit SHA instead of the mutable v4 tag. This prevents a tag move or supply-chain compromise from silently replacing the action with malicious code. The current commit SHA behind the v4 tag is 1a275c3b69536ee54be43f2070a358922e12c8d4. Keep the # v4 comment so the human-readable version is still visible. Additionally, note that actions/checkout@v6 on line 17 has the same problem and should also be pinned to its immutable SHA.
⚠️ Experimental Feature: This code suggestion is automatically generated. Please review carefully.
| uses: azure/setup-helm@v4 | |
| uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4 |
2 participants
What
Adds an initial (templated) Helm chart under
helm/for deploying Logflare to Kubernetes, plus aHelm ChartGitHub Actions workflow to validate chart changes.Why
Gives us a versioned, testable deployment artifact for Kubernetes and enforces basic quality gates so chart changes can't merge broken or without a version bump.
Workflow behavior
Runs only on pull requests, and only when the diff touches
helm/**:azure/setup-helm) and thehelm-unittestpluginhelm lintthe charthelm unittest -f '*_test.yaml' helm)helm template helm)versioninhelm/Chart.yamlhas not been bumped above the base branch (skips this check when no chart exists on the base yet)