quoll-cli 0.2.0__py3-none-any.whl

quoll/console.py

@@ -0,0 +1,3 @@
+from rich.console import Console
+
+console = Console()

quoll/docker/__init__.py

@@ -0,0 +1 @@
+"""Dockerfile generation. Images are provided by the language and framework plugins (see quoll/languages)."""

quoll/docker/config.py

@@ -0,0 +1,64 @@
+"""The [docker] section of quoll.toml — the single source of truth for the generated Dockerfile."""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import ClassVar, Dict, Tuple
+
+from pydantic import Field, model_validator
+
+from quoll import languages
+from quoll.config.quoll_toml import CONFIG_FILE, ConfigError, ProjectConfig, load_section, save_section
+from quoll.languages.base import DockerImage
+
+__all__ = ["CONFIG_FILE", "ConfigError", "DockerConfig", "load_config", "save_config"]
+
+
+class DockerConfig(ProjectConfig):
+    # Runtime version of the base image, e.g. "3.13", "24", "1.25", "21".
+    version: str
+    port: int = Field(default=8000, ge=1, le=65535)
+    # What the container runs. Not needed for static sites or images that ship their own server.
+    command: str = ""
+    # Run in the build stage, e.g. "npm run build". Empty = nothing to build.
+    build_command: str = ""
+    # Build output the image ships: the site when `static`, otherwise a self-contained server bundle.
+    output_dir: str = ""
+    # Serve `output_dir` with nginx instead of running a server.
+    static: bool = False
+    # Static sites: path prefixes nginx forwards to an API, each to the URL held by an environment variable, e.g.
+    # {"/api/" = "BACK_URL"} (a workspace's compose.yaml sets <NAME>_URL for each of its projects).
+    proxy: Dict[str, str] = {}
+
+    omit_when_empty: ClassVar[Tuple[str, ...]] = ("proxy",)
+
+    @model_validator(mode="after")
+    def _check_docker(self) -> "DockerConfig":
+        if self.static and not self.output_dir:
+            raise ValueError("output_dir is required when static is true")
+        if self.proxy and not self.static:
+            raise ValueError("proxy is for static sites (static = true), served by nginx")
+        for path, variable in self.proxy.items():
+            if not path.startswith("/") or not path.endswith("/"):
+                raise ValueError(f"proxy: {path!r} should start and end with /, e.g. /api/")
+            if not re.fullmatch(r"[A-Z_][A-Z0-9_]*", variable):
+                raise ValueError(f"proxy: {variable!r} should name an environment variable, e.g. BACK_URL")
+        if not self.static and not self.command and self.image.requires_command:
+            raise ValueError(f"command is required: what should the {self.target} container run?")
+        return self
+
+    @property
+    def image(self) -> DockerImage:
+        image = languages.docker_image(self.stack, self.framework)
+        if image is None:
+            raise ValueError(f"quoll has no Docker image for {self.target} yet")
+        return image
+
+
+def load_config(project_dir: Path) -> DockerConfig:
+    return load_section(project_dir, "docker", DockerConfig)
+
+
+def save_config(project_dir: Path, config: DockerConfig) -> Path:
+    """Write [project] and [docker], preserving any other section already in quoll.toml."""
+    return save_section(project_dir, "docker", config)

quoll/docker/detect.py

@@ -0,0 +1,41 @@
+"""Infer the [docker] section from the project, through the language or framework image."""
+from __future__ import annotations
+
+from pathlib import Path
+from typing import List, Tuple
+
+from quoll import languages
+from quoll.ci.detect import Detection
+from quoll.docker.config import DockerConfig
+from quoll.languages.base import DockerDefaults
+from quoll.project import Project
+
+
+def image_defaults(project_dir: Path, det: Detection) -> DockerDefaults:
+    if det.stack is None:
+        raise ValueError("cannot build a Docker config without a detected stack")
+    image = languages.docker_image(det.stack, det.framework)
+    if image is None:
+        raise ValueError(f"quoll has no Docker image for {det.stack} yet")
+    return image.defaults(Project(project_dir), det)
+
+
+def default_config(det: Detection, defaults: DockerDefaults) -> Tuple[DockerConfig, List[str]]:
+    """The [docker] config (validated) and the warnings to show."""
+    cfg = DockerConfig.model_validate(
+        {
+            "platform": det.platform,
+            "stack": det.stack,
+            "framework": det.framework,
+            "package_manager": det.package_manager,
+            "package_manager_version": det.package_manager_version,
+            "services": det.services,
+            "version": det.version,
+            "port": defaults.port,
+            "command": defaults.command,
+            "build_command": defaults.build_command,
+            "output_dir": defaults.output_dir,
+            "static": defaults.static,
+        }
+    )
+    return cfg, defaults.warnings

quoll/docker/render.py

@@ -0,0 +1,162 @@
+"""Turn a DockerConfig into a Dockerfile and a .dockerignore."""
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any, Dict, List, Tuple
+
+from quoll.docker.config import DockerConfig
+from quoll.files import PlannedFile, header, planned
+from quoll.project import Project
+from quoll.services import DATABASE, SERVICES
+from quoll.yaml_dump import dump
+
+DOCKERFILE = Path("Dockerfile")
+DOCKERIGNORE = Path(".dockerignore")
+COMPOSE = Path("compose.yaml")
+# A compose file under another name is the project's own: quoll doesn't add a second one.
+_OTHER_COMPOSE_FILES = ("compose.yml", "docker-compose.yml", "docker-compose.yaml")
+
+# BuildKit parser directive: must be the very first line.
+_SYNTAX = "# syntax=docker/dockerfile:1\n"
+
+# Kept out of every build context: VCS, CI, editors, the Docker files themselves.
+_COMMON_IGNORE = [
+    ".git",
+    ".github",
+    ".gitignore",
+    ".dockerignore",
+    "Dockerfile",
+    "compose*.y*ml",
+    "docker-compose*.y*ml",
+    ".idea",
+    ".vscode",
+    "**/.DS_Store",
+]
+
+
+def render_dockerfile(project_dir: Path, cfg: DockerConfig) -> str:
+    return _SYNTAX + header("docker") + "\n" + cfg.image.render(Project(project_dir), cfg)
+
+
+def render_dockerignore(cfg: DockerConfig) -> str:
+    return header("docker") + "\n".join([*_COMMON_IGNORE, *cfg.image.dockerignore(cfg)]) + "\n"
+
+
+def render_compose(cfg: DockerConfig) -> str:
+    """The app built from the Dockerfile, plus its services with healthchecks and persistent volumes."""
+    app: Dict[str, Any] = {"build": ".", "ports": [f"{cfg.port}:{cfg.port}"]}
+    # Secrets (APP_KEY, SECRET_KEY_BASE...) stay in an untracked .env.
+    app["env_file"] = [{"path": ".env", "required": False}]
+    env = cfg.service_environment(lambda service: service)
+    if env:
+        app["environment"] = env
+    if cfg.services:
+        app["depends_on"] = {name: {"condition": "service_healthy"} for name in cfg.services}
+
+    doc: Dict[str, Any] = {"services": {"app": app}}
+    for name in cfg.services:
+        service = SERVICES[name]
+        container: Dict[str, Any] = {"image": service.image}
+        if service.env:
+            container["environment"] = service.env
+        container["volumes"] = [f"{name}-data:{service.data_dir}"]
+        container["healthcheck"] = {"test": ["CMD-SHELL", service.health], "interval": "5s", "retries": 20}
+        doc["services"][name] = container
+    if cfg.services:
+        doc["volumes"] = {f"{name}-data": None for name in cfg.services}
+    return header("docker") + "\n" + dump(doc, spaced=("services",))
+
+
+# Creates the missing databases of a workspace's projects in their shared instance, at every `up`: a project added
+# later gets its own even though the volume already exists (the image's init scripts only run on an empty one).
+_CREATE_DATABASES = {
+    "postgres": (
+        {"PGHOST": "postgres", "PGUSER": DATABASE, "PGPASSWORD": DATABASE, "PGDATABASE": DATABASE},
+        """psql -tAc "SELECT 1 FROM pg_database WHERE datname = '{db}'" | grep -q 1 """
+        """|| psql -c 'CREATE DATABASE {db}'""",
+    ),
+    "mysql": ({}, 'mysql -h mysql -uroot -proot -e "CREATE DATABASE IF NOT EXISTS {db}"'),
+}
+_CREATE_SCRIPT = "/quoll/create-databases.sh"
+
+
+def database_name(member: str) -> str:
+    return member.replace("-", "_")
+
+
+def render_workspace_compose(members: List[Tuple[str, str, DockerConfig]]) -> str:
+    """compose.yaml at a workspace's root: every project (name, directory, [docker]) on one network, each reaching
+    the others at http://<name>:<port> (<NAME>_URL), and one instance of each backing service with a database per
+    project."""
+    doc: Dict[str, Any] = {"services": {}}
+    used_ports: set = set()
+    backing = [s for s in SERVICES if any(s in cfg.services for _, _, cfg in members)]
+    for name, directory, cfg in members:
+        port = cfg.port
+        while port in used_ports:  # two projects listening on 3000: the second gets 3001 on the host
+            port += 1
+        used_ports.add(port)
+        app: Dict[str, Any] = {"build": f"./{directory}", "ports": [f"{port}:{cfg.port}"]}
+        app["env_file"] = [{"path": f"./{directory}/.env", "required": False}]
+        env = cfg.service_environment(lambda service: service, database=database_name(name))
+        for other, _, other_cfg in members:
+            if other != name:
+                env[f"{other.upper().replace('-', '_')}_URL"] = f"http://{other}:{other_cfg.port}"
+        if env:
+            app["environment"] = env
+        depends_on: Dict[str, Any] = {s: {"condition": "service_healthy"} for s in cfg.services}
+        # nginx resolves the projects it forwards to when it starts.
+        for other, _, _ in members:
+            if f"{other.upper().replace('-', '_')}_URL" in cfg.proxy.values():
+                depends_on[other] = {"condition": "service_started"}
+        if depends_on:
+            app["depends_on"] = depends_on
+        doc["services"][name] = app
+
+    configs: Dict[str, Any] = {}
+    for service_name in backing:
+        service = SERVICES[service_name]
+        container: Dict[str, Any] = {"image": service.image}
+        if service.env:
+            container["environment"] = service.env
+        container["volumes"] = [f"{service_name}-data:{service.data_dir}"]
+        container["healthcheck"] = {"test": ["CMD-SHELL", service.health], "interval": "5s", "retries": 20}
+        doc["services"][service_name] = container
+        if service_name in _CREATE_DATABASES:
+            env, statement = _CREATE_DATABASES[service_name]
+            users = [n for n, _, cfg in members if service_name in cfg.services]
+            create: Dict[str, Any] = {"image": service.image}
+            if env:
+                create["environment"] = env
+            script = "\n".join(statement.format(db=database_name(n)) for n in users)
+            configs[f"{service_name}-databases"] = {"content": script + "\n"}
+            create["configs"] = [{"source": f"{service_name}-databases", "target": _CREATE_SCRIPT}]
+            create["command"] = ["sh", "-e", _CREATE_SCRIPT]
+            create["depends_on"] = {service_name: {"condition": "service_healthy"}}
+            doc["services"][f"{service_name}-databases"] = create
+            for n in users:
+                doc["services"][n]["depends_on"][f"{service_name}-databases"] = {
+                    "condition": "service_completed_successfully"
+                }
+    if backing:
+        doc["volumes"] = {f"{name}-data": None for name in backing}
+    if configs:
+        doc["configs"] = configs
+    return header("docker") + "\n" + dump(doc, spaced=("services",))
+
+
+def plan_workspace(root: Path, members: List[Tuple[str, str, DockerConfig]]) -> List[PlannedFile]:
+    """The workspace's compose.yaml (none when the root has a compose file of its own)."""
+    if any((root / name).exists() for name in _OTHER_COMPOSE_FILES):
+        return []
+    return [planned(root, COMPOSE, render_workspace_compose(members))]
+
+
+def plan(project_dir: Path, cfg: DockerConfig) -> List[PlannedFile]:
+    files = [
+        planned(project_dir, DOCKERFILE, render_dockerfile(project_dir, cfg)),
+        planned(project_dir, DOCKERIGNORE, render_dockerignore(cfg)),
+    ]
+    if not any((project_dir / name).exists() for name in _OTHER_COMPOSE_FILES):
+        files.append(planned(project_dir, COMPOSE, render_compose(cfg)))
+    return files

quoll/files.py

@@ -0,0 +1,64 @@
+"""Files quoll generates: planned first (content + what is on disk), then written after confirmation."""
+from __future__ import annotations
+
+import difflib
+from dataclasses import dataclass
+from pathlib import Path
+from typing import List, Optional
+
+# First comment of every generated file; a file without it was written by hand and is never overwritten silently.
+MARKER = "# Generated by quoll"
+HEADER = f"""{MARKER} — https://github.com/theo-mrn/Quoll
+# Do not edit by hand: change quoll.toml, then run `quoll {{command}} update`.
+"""
+
+
+@dataclass
+class PlannedFile:
+    path: Path
+    content: str
+    existing: Optional[str]
+    # Written once for the project to own (e.g. Dependabot's config): `check` ignores it.
+    create_only: bool = False
+
+    @property
+    def changed(self) -> bool:
+        return self.existing != self.content
+
+    @property
+    def managed(self) -> bool:
+        """True when the file doesn't exist yet or was generated by quoll."""
+        return self.existing is None or MARKER in self.existing
+
+    def diff(self) -> str:
+        return "".join(
+            difflib.unified_diff(
+                (self.existing or "").splitlines(keepends=True),
+                self.content.splitlines(keepends=True),
+                fromfile=f"a/{self.path}",
+                tofile=f"b/{self.path}",
+            )
+        )
+
+
+def header(command: str) -> str:
+    return HEADER.format(command=command)
+
+
+def planned(project_dir: Path, rel: Path, content: str, create_only: bool = False) -> PlannedFile:
+    target = project_dir / rel
+    return PlannedFile(rel, content, target.read_text() if target.exists() else None, create_only)
+
+
+def eject(text: str, command: str) -> str:
+    """`text` without quoll's header, so that quoll treats the file as hand-written from now on."""
+    lines = text.splitlines(keepends=True)
+    body = [line for line in lines if not line.startswith((MARKER, "# Do not edit by hand"))]
+    return f"# Maintained by hand (ejected from `quoll {command}`).\n" + "".join(body)
+
+
+def write(project_dir: Path, files: List[PlannedFile]) -> None:
+    for f in files:
+        target = project_dir / f.path
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text(f.content)

quoll/k8s/chart/templates/_helpers.tpl

@@ -0,0 +1,38 @@
+{{/*
+# Generated by quoll — https://github.com/theo-mrn/Quoll
+# Do not edit by hand: change quoll.toml, then run `quoll k8s update`.
+*/}}
+
+{{- define "app.labels" -}}
+{{ include "app.selectorLabels" . }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version }}
+{{- end }}
+
+{{- define "app.selectorLabels" -}}
+app.kubernetes.io/name: {{ .Chart.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/* The image by digest when the deployment gives one (what was scanned and signed), else by tag. */}}
+{{- define "app.image" -}}
+{{- $repository := required "image.repository is required" .Values.image.repository -}}
+{{- if .Values.image.digest -}}
+{{ $repository }}@{{ .Values.image.digest }}
+{{- else -}}
+{{ $repository }}:{{ .Values.image.tag }}
+{{- end -}}
+{{- end }}
+
+{{/* HTTP on healthPath when the app has one, a TCP connection to its port otherwise. */}}
+{{- define "app.probe" -}}
+{{- if .Values.healthPath -}}
+httpGet:
+  path: {{ .Values.healthPath }}
+  port: http
+{{- else -}}
+tcpSocket:
+  port: http
+{{- end -}}
+{{- end }}

quoll/k8s/chart/templates/deployment.yaml

@@ -0,0 +1,93 @@
+# Generated by quoll — https://github.com/theo-mrn/Quoll
+# Do not edit by hand: change quoll.toml, then run `quoll k8s update`.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  revisionHistoryLimit: 5
+  # A new version takes traffic once ready; the old one stays until then.
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      {{- include "app.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "app.labels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ .Release.Name }}
+      automountServiceAccountToken: false
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range . }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: app
+          image: {{ include "app.image" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.port }}
+              protocol: TCP
+          {{- with .Values.env }}
+          env:
+            {{- range $name, $value := . }}
+            - name: {{ $name }}
+              value: {{ $value | quote }}
+            {{- end }}
+          {{- end }}
+          {{- if .Values.envFromSecret }}
+          envFrom:
+            # The app's secrets (DATABASE_URL...): kubectl create secret generic {{ .Values.envFromSecret }} --from-env-file=...
+            - secretRef:
+                name: {{ .Values.envFromSecret }}
+                optional: true
+          {{- end }}
+          startupProbe:
+            {{- include "app.probe" . | nindent 12 }}
+            periodSeconds: 2
+            failureThreshold: 60
+          readinessProbe:
+            {{- include "app.probe" . | nindent 12 }}
+            periodSeconds: 5
+          livenessProbe:
+            {{- include "app.probe" . | nindent 12 }}
+            periodSeconds: 10
+            failureThreshold: 3
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: {{ .Values.readOnlyRootFilesystem }}
+            capabilities:
+              drop: [ALL]
+          {{- if and .Values.readOnlyRootFilesystem .Values.writablePaths }}
+          volumeMounts:
+            {{- range $i, $path := .Values.writablePaths }}
+            - name: writable-{{ $i }}
+              mountPath: {{ $path }}
+            {{- end }}
+          {{- end }}
+      {{- if and .Values.readOnlyRootFilesystem .Values.writablePaths }}
+      volumes:
+        {{- range $i, $path := .Values.writablePaths }}
+        - name: writable-{{ $i }}
+          emptyDir: {}
+        {{- end }}
+      {{- end }}

quoll/k8s/chart/templates/hpa.yaml

@@ -0,0 +1,24 @@
+# Generated by quoll — https://github.com/theo-mrn/Quoll
+# Do not edit by hand: change quoll.toml, then run `quoll k8s update`.
+{{- if .Values.autoscaling.enabled }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ .Release.Name }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+{{- end }}

quoll/k8s/chart/templates/ingress.yaml

@@ -0,0 +1,35 @@
+# Generated by quoll — https://github.com/theo-mrn/Quoll
+# Do not edit by hand: change quoll.toml, then run `quoll k8s update`.
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.host }}
+      secretName: {{ .Release.Name }}-tls
+  {{- end }}
+  rules:
+    - host: {{ required "ingress.host is required" .Values.ingress.host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Release.Name }}
+                port:
+                  name: http
+{{- end }}

quoll/k8s/chart/templates/pdb.yaml

@@ -0,0 +1,16 @@
+# Generated by quoll — https://github.com/theo-mrn/Quoll
+# Do not edit by hand: change quoll.toml, then run `quoll k8s update`.
+# With several replicas, node maintenance (drains) never takes them all down at once.
+{{- if or .Values.autoscaling.enabled (gt (int .Values.replicaCount) 1) }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      {{- include "app.selectorLabels" . | nindent 6 }}
+{{- end }}

quoll/k8s/chart/templates/service.yaml

@@ -0,0 +1,18 @@
+# Generated by quoll — https://github.com/theo-mrn/Quoll
+# Do not edit by hand: change quoll.toml, then run `quoll k8s update`.
+# The other projects reach this one at http://{{ .Release.Name }}:{{ .Values.port }}, as in compose.yaml.
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    {{- include "app.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: http
+      port: {{ .Values.port }}
+      targetPort: http
+      protocol: TCP

quoll/k8s/chart/templates/serviceaccount.yaml

@@ -0,0 +1,10 @@
+# Generated by quoll — https://github.com/theo-mrn/Quoll
+# Do not edit by hand: change quoll.toml, then run `quoll k8s update`.
+# An identity of its own, without access to the Kubernetes API (no token mounted).
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+automountServiceAccountToken: false

quoll/k8s/ci.py

@@ -0,0 +1,39 @@
+"""The CI's checks of a Helm chart, the same on both platforms: lint, Kubernetes schemas, misconfigurations."""
+from __future__ import annotations
+
+from typing import List
+
+from quoll.ci.steps import Step, step
+from quoll.ci.tools import TRIVY_VERSION
+
+HELM_VERSION = "4.3.2"
+HELM_IMAGE = f"alpine/helm:{HELM_VERSION}"
+KUBECONFORM_VERSION = "0.8.0"
+# Where the tools go: no root needed, the same path on GitHub runners and in GitLab's helm image.
+_BIN = "/tmp/quoll-bin"
+
+_KUBECONFORM = f"https://github.com/yannh/kubeconform/releases/download/v{KUBECONFORM_VERSION}"
+_TRIVY = f"https://github.com/aquasecurity/trivy/releases/download/v{TRIVY_VERSION}"
+_INSTALL = f"""mkdir -p {_BIN}
+case "$(uname -m)" in x86_64) arch=amd64 trivy=64bit ;; *) arch=arm64 trivy=ARM64 ;; esac
+wget -qO- "{_KUBECONFORM}/kubeconform-linux-$arch.tar.gz" | tar -xz -C {_BIN} kubeconform
+wget -qO- "{_TRIVY}/trivy_{TRIVY_VERSION}_Linux-$trivy.tar.gz" | tar -xz -C {_BIN} trivy"""
+# Every environment's values: the image is set by the deployment, any name renders the chart.
+_LINT = """for values in {chart}/values-*.yaml; do
+  helm lint --strict {chart} -f "$values" --set image.repository=ci
+done"""
+_SCHEMAS = """for values in {chart}/values-*.yaml; do
+  echo "$values:"
+  helm template ci {chart} -f "$values" --set image.repository=ci | {bin}/kubeconform -strict -summary
+done"""
+_SCAN = "{bin}/trivy config --exit-code 1 --severity HIGH,CRITICAL --helm-set image.repository=ci {chart}"
+
+
+def chart_checks(chart: str) -> List[Step]:
+    """Steps checking the chart in `chart` (helm installed)."""
+    return [
+        step("Install kubeconform and Trivy", run=_INSTALL),
+        step("Lint chart", run=_LINT.format(chart=chart)),
+        step("Kubernetes schemas", run=_SCHEMAS.format(chart=chart, bin=_BIN)),
+        step("Misconfigurations", run=_SCAN.format(chart=chart, bin=_BIN)),
+    ]