name: Lint Helm Chart

on:
  pull_request:

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Lint chart
        run: helm lint chart/ --strict --set auth.accessKey=dummy --set auth.secretKey=dummy

      - name: Lint standalone IAM configurations
        run: |
          scenarios=(
            # existingSecret-based mTLS for both sides, plus NetworkPolicy
            "--set iam.enabled=true --set iam.type=standalone --set iam.standalone.certificate.existingSecret=iam-client-tls --set iamServer.enabled=true --set iamServer.private.certificate.existingSecret=iam-server-tls --set networkPolicy.enabled=true"
            # cert-manager-issued mTLS, plus TLS on the public control-plane API
            "--set iam.enabled=true --set iam.type=standalone --set iam.standalone.certificate.create=true --set iam.standalone.certificate.issuerRef.name=internal-ca --set iamServer.enabled=true --set iamServer.private.certificate.create=true --set iamServer.private.certificate.issuerRef.name=internal-ca --set iamServer.tls.enabled=true --set iamServer.tls.secretName=iam-public-tls"
            # Vault storage with multiple iamServer replicas
            "--set iamServer.enabled=true --set iamServer.replicaCount=2 --set iamServer.storage.type=vault --set iamServer.storage.vault.endpointUrl=https://vault.example.test --set iamServer.storage.vault.existingSecret=vault-auth --set iamServer.storage.vault.tlsExistingSecret=vault-tls --set iamServer.private.certificate.existingSecret=iam-server-tls"
            # externally managed standalone IAM service (no in-chart iamServer)
            "--set iam.enabled=true --set iam.type=standalone --set iam.standalone.endpoint=iam.example.test:7443 --set iam.standalone.certificate.existingSecret=iam-client-tls"
          )

          for scenario in "${scenarios[@]}"; do
            echo "::group::helm lint --set ${scenario}"
            # shellcheck disable=SC2086
            helm lint chart/ --strict --set auth.existingSecret=root-credentials ${scenario}
            echo "::endgroup::"
          done

      - name: Lint path prefix and internal IAM storage configurations
        run: |
          scenarios=(
            # admin API and WebUI on their own ports under path prefixes
            "--set admin.enabled=true --set admin.pathPrefix=/admin --set webui.enabled=true --set webui.pathPrefix=/ui"
            # admin API and WebUI on the S3 port under path prefixes
            "--set admin.pathPrefix=/admin --set webui.s3Prefix=/ui --set webui.apiGateways[0]=https://s3.example.test"
            # internal IAM on its own PVC with ephemeral backend data
            "--set iam.enabled=true --set iam.persistence.enabled=true --set iam.dir=/var/lib/versitygw/iam --set persistence.enabled=false"
            # internal IAM on an existing PVC
            "--set iam.enabled=true --set iam.persistence.enabled=true --set iam.persistence.create=false --set iam.persistence.claimName=versitygw-iam"
          )

          for scenario in "${scenarios[@]}"; do
            echo "::group::helm lint --set ${scenario}"
            # shellcheck disable=SC2086
            helm lint chart/ --strict --set auth.existingSecret=root-credentials ${scenario}
            echo "::endgroup::"
          done