Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,7 @@ High-level deployment action that handles both GitOps (ArgoCD) and direct kubect
| `create_namespace` | Create namespace if it does not exist | ❌ | `true` |
| `wait_timeout` | Timeout for waiting on deployments (seconds) | ❌ | `120` |
| `env_patches` | Environment file patches (JSON format) | ❌ | - |
| `enable_helm` | Pass `--enable-helm` to `kustomize build` (required for overlays using `helmCharts:`). Requires `helm` binary on the runner; fails fast if missing. Set to `false` to skip. | ❌ | `true` |

\* **Image input options** (choose one):
- Option 1: `image` (with embedded tag, e.g., `registry.io/app:v1.2.3`)
Expand Down
25 changes: 22 additions & 3 deletions action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,10 @@ inputs:
env_patches:
description: 'Environment file patches (JSON format matching patch-env-files, e.g., {"container.env":{"SENTRY_RELEASE":"v1.2.3"}})'
required: false
enable_helm:
description: 'Pass --enable-helm to kustomize build (requires helm binary on runner). When true, fails fast if helm is not installed.'
required: false
default: 'true'
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Breaking default: enable_helm requires helm on all runners

High Severity

The new enable_helm input defaults to 'true', which is a backward-incompatible change. Previously no --enable-helm flag was passed and no helm binary was required. Now every existing user of this action will have the validation check at line 108 enforce that helm is on PATH, and --enable-helm will be appended to all kustomize build calls. Any runner (especially self-hosted) without helm installed will fail immediately, even for overlays that don't use helmCharts. The safe default is 'false' so existing workflows are unaffected and users opt in explicitly.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 2a2f6a9. Configure here.


outputs:
mode:
Expand Down Expand Up @@ -101,6 +105,11 @@ runs:
exit 1
fi

if [ "${{ inputs.enable_helm }}" = "true" ] && ! command -v helm >/dev/null 2>&1; then
echo "::error::enable_helm=true but 'helm' binary not found in PATH. Install helm or set enable_helm=false."
exit 1
fi

- name: Resolve image inputs
id: images
shell: bash
Expand Down Expand Up @@ -294,6 +303,7 @@ runs:
uses: skyhook-io/kustomize-inspect@v1
with:
overlay_dir: ${{ inputs.working_directory }}/${{ inputs.overlay_dir }}
enable_helm: ${{ inputs.enable_helm }}

- name: Detect GitOps mode
id: detect
Expand All @@ -320,7 +330,11 @@ runs:
fi

# 2) Fall back to built manifests (app.kubernetes.io/managed-by)
BUILD_RESULT=$(kustomize build)
KUSTOMIZE_FLAGS=()
if [ "${{ inputs.enable_helm }}" = "true" ]; then
KUSTOMIZE_FLAGS+=(--enable-helm)
fi
BUILD_RESULT=$(kustomize build "${KUSTOMIZE_FLAGS[@]}")
MANAGED_BY=$(echo "$BUILD_RESULT" | grep "app.kubernetes.io/managed-by:" | head -n1 | sed 's/.*app.kubernetes.io\/managed-by:\s*//' | tr -d '[:space:]' || true)
echo "managed_by=$MANAGED_BY" >> $GITHUB_OUTPUT

Expand Down Expand Up @@ -359,7 +373,11 @@ runs:
shell: bash
working-directory: ${{ inputs.working_directory }}/${{ inputs.overlay_dir }}
run: |
KUSTOMIZE_BUILD_RESULT=$(kustomize build)
KUSTOMIZE_FLAGS=()
if [ "${{ inputs.enable_helm }}" = "true" ]; then
KUSTOMIZE_FLAGS+=(--enable-helm)
fi
KUSTOMIZE_BUILD_RESULT=$(kustomize build "${KUSTOMIZE_FLAGS[@]}")
echo "--- Deployment plan summary ---"
echo "Deployment mode: ${{ steps.mode.outputs.mode }}"
echo "KUSTOMIZE_BUILD_RESULT=$KUSTOMIZE_BUILD_RESULT"
Expand All @@ -383,4 +401,5 @@ runs:
namespace: ${{ steps.inspect.outputs.namespace }}
workloads_json: ${{ steps.inspect.outputs.workloads_json }}
wait: 'true'
wait_timeout: ${{ inputs.wait_timeout }}
wait_timeout: ${{ inputs.wait_timeout }}
enable_helm: ${{ inputs.enable_helm }}