@intentius/chant-lexicon-helm 0.45.0 → 0.49.0

package/src/render.test.ts

@@ -1,10 +1,16 @@
-import { describe, test, expect, beforeAll } from "vitest";
-import { mkdirSync, writeFileSync, rmSync, existsSync } from "node:fs";
-import { join } from "node:path";
+import { describe, test, expect, beforeAll, beforeEach, afterEach } from "vitest";
+import { mkdirSync, writeFileSync, rmSync, existsSync, readFileSync, mkdtempSync } from "node:fs";
+import { delimiter, join } from "node:path";
 import { execFileSync } from "node:child_process";
 import { tmpdir } from "node:os";
 
-import { HelmRender } from "./render";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+
+import { HelmRender, getHelmRenderRecords, clearHelmRenderRecords } from "./render";
+import { helmContentDigest, helmInputDigest, renderStability } from "./render-digest";
+import { loadRenderManifest } from "./render-store";
+import { clearValuesProbeRecords, getValuesProbeRecords } from "./values-probe";
+import { whm504 } from "./lint/post-synth/whm504";
 
 const FIXTURE_DIR = join(tmpdir(), "chant-helm-render-fixture");
 const CHART_DIR = join(FIXTURE_DIR, "tiny-chart");
@@ -256,3 +262,376 @@ describe.skipIf(!fixtureAvailable)("HelmRender", () => {
     }
   });
 });
+
+/**
+ * Capability-profile plumbing (#1235) — asserted against a scripted `helm`
+ * double that records its argv, so these tests need no real helm binary, no
+ * network, and no chart. The double answers any `helm template` with one
+ * minimal manifest.
+ */
+describe("HelmRender capability profiles", () => {
+  const FAKE_BIN = join(tmpdir(), "chant-helm-render-fake-bin");
+  let argvFile: string;
+  let origPath: string | undefined;
+  let origCwd: string;
+
+  beforeAll(() => {
+    mkdirSync(FAKE_BIN, { recursive: true });
+    writeFileSync(
+      join(FAKE_BIN, "helm"),
+      `#!/bin/sh
+printf '%s\\n' "$@" > "$CHANT_TEST_HELM_ARGV"
+cat <<'EOF'
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fake-render
+EOF
+`,
+      { mode: 0o755 },
+    );
+  });
+
+  beforeEach(() => {
+    argvFile = join(mkdtempSync(join(tmpdir(), "chant-helm-argv-")), "argv.txt");
+    process.env.CHANT_TEST_HELM_ARGV = argvFile;
+    origPath = process.env.PATH;
+    process.env.PATH = FAKE_BIN + delimiter + (origPath ?? "");
+    origCwd = process.cwd();
+    clearHelmRenderRecords();
+  });
+
+  afterEach(() => {
+    process.env.PATH = origPath;
+    delete process.env.CHANT_TEST_HELM_ARGV;
+    process.chdir(origCwd);
+  });
+
+  function renderedArgv(): string[] {
+    return readFileSync(argvFile, "utf8")
+      .split("\n")
+      .filter((l) => l.length > 0);
+  }
+
+  test("an inline profile pins --kube-version and one --api-versions per entry", () => {
+    HelmRender({
+      name: "rel",
+      chart: "/dev/null/some-chart",
+      noCache: true,
+      capabilityProfile: {
+        name: "prod",
+        kubeVersion: "1.33.6",
+        apiVersions: ["monitoring.coreos.com/v1", "cert-manager.io/v1"],
+      },
+    } as Parameters<typeof HelmRender>[0]);
+
+    const argv = renderedArgv();
+    const kvIdx = argv.indexOf("--kube-version");
+    expect(kvIdx).toBeGreaterThan(-1);
+    expect(argv[kvIdx + 1]).toBe("1.33.6");
+    const apiIdxs = argv.map((a, i) => (a === "--api-versions" ? i : -1)).filter((i) => i >= 0);
+    expect(apiIdxs.length).toBe(2);
+    expect(argv[apiIdxs[0] + 1]).toBe("monitoring.coreos.com/v1");
+    expect(argv[apiIdxs[1] + 1]).toBe("cert-manager.io/v1");
+  });
+
+  test("no profile means no capability flags — today's unpinned behavior", () => {
+    HelmRender({
+      name: "rel",
+      chart: "/dev/null/some-chart",
+      noCache: true,
+    } as Parameters<typeof HelmRender>[0]);
+
+    const argv = renderedArgv();
+    expect(argv).not.toContain("--kube-version");
+    expect(argv).not.toContain("--api-versions");
+  });
+
+  test("a profile named in chant.config.json resolves and pins the render", () => {
+    const projectDir = mkdtempSync(join(tmpdir(), "chant-helm-render-project-"));
+    writeFileSync(
+      join(projectDir, "chant.config.json"),
+      JSON.stringify({
+        helm: {
+          capabilityProfiles: {
+            prod: { kubeVersion: "v1.31.4", apiVersions: ["batch/v1"] },
+          },
+        },
+      }),
+    );
+    process.chdir(projectDir);
+
+    HelmRender({
+      name: "rel",
+      chart: "/dev/null/some-chart",
+      noCache: true,
+      capabilityProfile: "prod",
+    } as Parameters<typeof HelmRender>[0]);
+
+    const argv = renderedArgv();
+    const kvIdx = argv.indexOf("--kube-version");
+    expect(argv[kvIdx + 1]).toBe("v1.31.4");
+    const apiIdx = argv.indexOf("--api-versions");
+    expect(argv[apiIdx + 1]).toBe("batch/v1");
+  });
+
+  test("an undeclared profile reference is an error naming it, before helm runs", () => {
+    const projectDir = mkdtempSync(join(tmpdir(), "chant-helm-render-project-"));
+    writeFileSync(
+      join(projectDir, "chant.config.json"),
+      JSON.stringify({ helm: { capabilityProfiles: { staging: { kubeVersion: "1.31.4" } } } }),
+    );
+    process.chdir(projectDir);
+
+    expect(() =>
+      HelmRender({
+        name: "rel",
+        chart: "/dev/null/some-chart",
+        noCache: true,
+        capabilityProfile: "prod",
+      } as Parameters<typeof HelmRender>[0]),
+    ).toThrow(/capability profile "prod" is not declared/);
+    // Failed before any render: the double never ran.
+    expect(existsSync(argvFile)).toBe(false);
+  });
+
+  test("an invalid inline profile is an error naming the field", () => {
+    expect(() =>
+      HelmRender({
+        name: "rel",
+        chart: "/dev/null/some-chart",
+        noCache: true,
+        capabilityProfile: { name: "prod", kubeVersion: "latest" },
+      } as Parameters<typeof HelmRender>[0]),
+    ).toThrow(/kubeVersion/);
+  });
+
+  test("the render record carries the profile identity for pinned renders, and none for unpinned", () => {
+    HelmRender({
+      name: "pinned",
+      chart: "/dev/null/some-chart",
+      noCache: true,
+      capabilityProfile: { name: "prod", kubeVersion: "1.33.6", apiVersions: ["batch/v1"] },
+    } as Parameters<typeof HelmRender>[0]);
+    HelmRender({
+      name: "unpinned",
+      chart: "/dev/null/some-chart",
+      noCache: true,
+    } as Parameters<typeof HelmRender>[0]);
+
+    const records = getHelmRenderRecords();
+    expect(records.length).toBe(2);
+    expect(records[0].name).toBe("pinned");
+    expect(records[0].capabilityProfile).toEqual({
+      name: "prod",
+      kubeVersion: "1.33.6",
+      apiVersions: ["batch/v1"],
+    });
+    expect(records[1].name).toBe("unpinned");
+    expect(records[1].capabilityProfile).toBeUndefined();
+  });
+
+  test("digests are recorded only for pinned renders — unpinned renders record neither (#1237)", () => {
+    HelmRender({
+      name: "pinned",
+      chart: "/dev/null/some-chart",
+      noCache: true,
+      capabilityProfile: { name: "prod", kubeVersion: "1.33.6" },
+    } as Parameters<typeof HelmRender>[0]);
+    HelmRender({
+      name: "unpinned",
+      chart: "/dev/null/some-chart",
+      noCache: true,
+    } as Parameters<typeof HelmRender>[0]);
+
+    const [pinned, unpinned] = getHelmRenderRecords();
+    expect(pinned.contentDigest).toMatch(/^sha256:[0-9a-f]{64}$/);
+    expect(pinned.inputDigest).toMatch(/^sha256:[0-9a-f]{64}$/);
+    // The double's output is fixed, so the content digest is the canonical
+    // digest of that one ConfigMap — assert it against the canonicalizer.
+    expect(pinned.contentDigest).toBe(
+      helmContentDigest("apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: fake-render\n"),
+    );
+    expect(unpinned.contentDigest).toBeUndefined();
+    expect(unpinned.inputDigest).toBeUndefined();
+  });
+
+  test("a pinned render's inputDigest is #1243's input digest for the same inputs", () => {
+    HelmRender({
+      name: "rel",
+      chart: "/dev/null/some-chart",
+      noCache: true,
+      values: { replicaCount: 3 },
+      capabilityProfile: { name: "prod", kubeVersion: "1.33.6", apiVersions: ["batch/v1"] },
+    } as Parameters<typeof HelmRender>[0]);
+
+    const [record] = getHelmRenderRecords();
+    expect(record.inputDigest).toBe(
+      helmInputDigest({
+        chart: "/dev/null/some-chart",
+        chartVersion: undefined,
+        values: { replicaCount: 3 },
+        capabilityProfile: { kubeVersion: "1.33.6", apiVersions: ["batch/v1"] },
+      }),
+    );
+  });
+});
+
+/**
+ * Digest behavior against real helm renders of the deterministic fixture
+ * (#1237). Pinning uses an inline profile so `helm template` runs with
+ * `--kube-version` — the same invocation shape a config-declared profile
+ * produces.
+ */
+describe.skipIf(!fixtureAvailable)("HelmRender digests (real helm)", () => {
+  const PROFILE = { name: "test", kubeVersion: "1.33.6" };
+
+  beforeEach(() => {
+    clearHelmRenderRecords();
+  });
+
+  test("two pinned renders of the deterministic fixture agree on both digests", () => {
+    for (const name of ["rel", "rel"]) {
+      HelmRender({
+        name,
+        chart: CHART_DIR,
+        noCache: true,
+        capabilityProfile: PROFILE,
+      } as Parameters<typeof HelmRender>[0]);
+    }
+    const [first, second] = getHelmRenderRecords();
+    expect(first.contentDigest).toMatch(/^sha256:[0-9a-f]{64}$/);
+    expect(first.contentDigest).toBe(second.contentDigest);
+    expect(first.inputDigest).toBe(second.inputDigest);
+
+    const report = renderStability(getHelmRenderRecords());
+    expect(report.unstable).toEqual([]);
+    expect(report.stable.length).toBe(1);
+    expect(report.stable[0].names).toEqual(["rel", "rel"]);
+  });
+
+  test("a values change moves contentDigest and inputDigest together", () => {
+    for (const replicaCount of [1, 3]) {
+      HelmRender({
+        name: "rel",
+        chart: CHART_DIR,
+        noCache: true,
+        values: { replicaCount },
+        capabilityProfile: PROFILE,
+      } as Parameters<typeof HelmRender>[0]);
+    }
+    const [one, three] = getHelmRenderRecords();
+    expect(one.contentDigest).not.toBe(three.contentDigest);
+    expect(one.inputDigest).not.toBe(three.inputDigest);
+    // Different inputs — no stability claim to make, and no false alarm.
+    expect(renderStability(getHelmRenderRecords()).unstable).toEqual([]);
+  });
+
+  test("same inputs, different bytes — renderStability names the divergence", () => {
+    HelmRender({
+      name: "rel",
+      chart: CHART_DIR,
+      noCache: true,
+      capabilityProfile: PROFILE,
+    } as Parameters<typeof HelmRender>[0]);
+    const [genuine] = getHelmRenderRecords();
+    // A second record with the same inputs but different bytes — the shape an
+    // unstable chart (randAlphaNum, timestamps) produces. The fixture is
+    // deliberately deterministic, so fabricate the divergent twin.
+    const divergent = { ...genuine, contentDigest: "sha256:" + "0".repeat(64) };
+    const report = renderStability([genuine, divergent]);
+    expect(report.stable).toEqual([]);
+    expect(report.unstable.length).toBe(1);
+    expect(report.unstable[0].inputDigest).toBe(genuine.inputDigest);
+    expect(report.unstable[0].contentDigests).toEqual([genuine.contentDigest, divergent.contentDigest]);
+  });
+});
+
+/**
+ * End-to-end coalesced-values wiring (#1251, #1252): a real pinned build of
+ * the fixture chart carries the probe's digest and valueSources into its
+ * persisted `RenderManifest` (issue #1252 AC1), and a dead assignment in
+ * the supplied values produces a WHM504 finding through the same real
+ * build — not a hand-built probe record (AC3).
+ */
+describe.skipIf(!fixtureAvailable)("coalesced-values probe wired into the render path (#1251, #1252)", () => {
+  const PROFILE = { name: "test", kubeVersion: "1.33.6" };
+  let storeRoot: string;
+  let origRoot: string | undefined;
+
+  function makeCtx(): PostSynthContext {
+    const outputs = new Map<string, string>();
+    return {
+      outputs,
+      entities: new Map(),
+      buildResult: { outputs, entities: new Map(), warnings: [], errors: [], sourceFileCount: 1 },
+    };
+  }
+
+  beforeEach(() => {
+    clearHelmRenderRecords();
+    clearValuesProbeRecords();
+    storeRoot = mkdtempSync(join(tmpdir(), "chant-helm-render-store-"));
+    origRoot = process.env.CHANT_HELM_RENDER_ROOT;
+    process.env.CHANT_HELM_RENDER_ROOT = storeRoot;
+  });
+
+  afterEach(() => {
+    if (origRoot === undefined) delete process.env.CHANT_HELM_RENDER_ROOT;
+    else process.env.CHANT_HELM_RENDER_ROOT = origRoot;
+    rmSync(storeRoot, { recursive: true, force: true });
+  });
+
+  test("a pinned build of a clean chart records a digest and valueSources in the persisted RenderManifest", () => {
+    HelmRender({
+      name: "rel",
+      chart: CHART_DIR,
+      persist: true,
+      values: { replicaCount: 3 },
+      capabilityProfile: PROFILE,
+    } as Parameters<typeof HelmRender>[0]);
+
+    const [record] = getHelmRenderRecords();
+    expect(record.coalescedValuesDigest).toMatch(/^sha256:[0-9a-f]{64}$/);
+
+    const manifest = loadRenderManifest(record.contentDigest!, { root: storeRoot });
+    expect(manifest).toBeDefined();
+    expect(manifest!.coalescedValuesDigest).toBe(record.coalescedValuesDigest);
+    expect(manifest!.valueSources).toBeTruthy();
+    // The supplied override is attributed to the values layer that won it.
+    expect(manifest!.valueSources!["replicaCount"]).toBe("supplied file");
+
+    // No dead assignments in this build — WHM504 has nothing to say.
+    expect(getValuesProbeRecords()).toHaveLength(1);
+    expect(whm504.check(makeCtx())).toEqual([]);
+  });
+
+  test("a dead assignment in a real pinned build fires WHM504 end-to-end", () => {
+    HelmRender({
+      name: "rel",
+      chart: CHART_DIR,
+      persist: true,
+      // "totallyUnknownSubchart" names no dependency of the fixture chart
+      // (which has the "tiny-sub" subchart, so it does have dependencies)
+      // and no root default — the classic silently-ignored subchart typo.
+      values: { totallyUnknownSubchart: { replicas: 9 } },
+      capabilityProfile: PROFILE,
+    } as Parameters<typeof HelmRender>[0]);
+
+    const [record] = getHelmRenderRecords();
+    expect(record.coalescedValuesDigest).toMatch(/^sha256:[0-9a-f]{64}$/);
+
+    const manifest = loadRenderManifest(record.contentDigest!, { root: storeRoot });
+    expect(manifest!.coalescedValuesDigest).toBe(record.coalescedValuesDigest);
+
+    // The real build path recorded the probe — WHM504 fires without any
+    // test constructing a probe record by hand.
+    expect(getValuesProbeRecords()).toHaveLength(1);
+    const diags = whm504.check(makeCtx());
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WHM504");
+    expect(diags[0].entity).toBe("rel");
+    expect(diags[0].message).toContain("totallyUnknownSubchart");
+    expect(diags[0].message).toContain("target no subchart");
+  });
+});