This is an automated email from the ASF dual-hosted git repository.
villebro pushed a commit to branch main
in repository
https://gitbox.apache.org/repos/asf/superset-kubernetes-operator.git
The following commit(s) were added to refs/heads/main by this push:
new e6b56a8 fix(ci): stop Renovate corrupting helm/yq tool checksums
(#230)
e6b56a8 is described below
commit e6b56a83ca93bc3142f4041967a93c446950a173
Author: Ville Brofeldt <[email protected]>
AuthorDate: Thu Jul 23 14:29:48 2026 -0700
fix(ci): stop Renovate corrupting helm/yq tool checksums (#230)
The install-script custom manager captured the `_SHA256=` value as
`currentDigest`. For the `github-releases` datasource a "digest" is the
git commit SHA of the release tag (40 hex chars), not the release asset's
SHA-256 (64 hex chars), so Renovate rewrote the real checksums into git
commit SHAs (PRs #228, #229), breaking `sha256sum -c` in the Helm CI job.
Fix, per asset location:
- yq attaches the downloaded asset (`yq_linux_amd64`) to its GitHub
release, so switch its `# renovate:` comment to the
`github-release-attachments` datasource — the same one `install-oras.sh`
already uses — which downloads-and-hashes the attachment. The manager
passes `datasource` through, so no other change is needed and the
committed SHA is already correct.
- helm does not attach tarballs to GitHub (only detached signatures);
the tarballs and checksums live on get.helm.sh. Track only the version
in Renovate (split the install-script manager into an attachment-digest
manager for yq/oras and a version-only manager for helm), and keep
HELM_SHA256 in sync via a new `scripts/sync-helm-checksum.sh` wired to
`make sync-helm-checksum` / `verify-helm-checksum`, mirroring the
supported-versions sync. A `Verify Helm checksum pin` CI step makes
drift a hard failure, and a helm/helm packageRule note steers reviewers
to run the sync after a version bump.
---
.github/workflows/ci.yaml | 2 +
Makefile | 8 ++++
docs/contributing/development-setup.md | 2 +
renovate.json | 25 ++++++++++-
scripts/install-yq.sh | 2 +-
scripts/sync-helm-checksum.sh | 78 ++++++++++++++++++++++++++++++++++
6 files changed, 114 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 0bf3548..bd8b6f6 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -139,6 +139,8 @@ jobs:
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e #
v7.0.0
with:
go-version-file: go.mod
+ - name: Verify Helm checksum pin
+ run: make verify-helm-checksum
- name: Install Helm
run: bash scripts/install-helm.sh
- name: Install helm-unittest plugin
diff --git a/Makefile b/Makefile
index 4166a8a..08cb9f3 100644
--- a/Makefile
+++ b/Makefile
@@ -157,6 +157,14 @@ verify-supported-versions: ## Verify supported-k8s.json
matches the pinned kind
exit 1; \
fi
+.PHONY: sync-helm-checksum
+sync-helm-checksum: ## Sync the pinned Helm tarball SHA-256 in install-helm.sh
with the published checksum for HELM_VERSION.
+ ./scripts/sync-helm-checksum.sh --write
+
+.PHONY: verify-helm-checksum
+verify-helm-checksum: ## Verify install-helm.sh pins the correct Helm tarball
SHA-256 for its HELM_VERSION.
+ ./scripts/sync-helm-checksum.sh --check
+
##@ Helm
HELM_CHART_DIR ?= charts/superset-operator
diff --git a/docs/contributing/development-setup.md
b/docs/contributing/development-setup.md
index 6725692..2ac9765 100644
--- a/docs/contributing/development-setup.md
+++ b/docs/contributing/development-setup.md
@@ -149,6 +149,8 @@ kind delete cluster --name superset
| `make make-commands` | Regenerate the make-commands tables in the
contributing docs. |
| `make sync-supported-versions` | Sync .github/supported-k8s.json with the
pinned kind release's node images. |
| `make verify-supported-versions` | Verify supported-k8s.json matches the
pinned kind release and docs are up to date. |
+| `make sync-helm-checksum` | Sync the pinned Helm tarball SHA-256 in
install-helm.sh with the published checksum for HELM_VERSION. |
+| `make verify-helm-checksum` | Verify install-helm.sh pins the correct Helm
tarball SHA-256 for its HELM_VERSION. |
### Helm
diff --git a/renovate.json b/renovate.json
index 2c33fd7..edb9ae7 100644
--- a/renovate.json
+++ b/renovate.json
@@ -29,6 +29,15 @@
"config/manager/manager.yaml"
],
"enabled": false
+ },
+ {
+ "description": "Helm publishes tarballs (and their checksums) on
get.helm.sh, not as GitHub release attachments, so Renovate can only bump the
version — the pinned SHA-256 must be resynced separately.",
+ "matchDepNames": ["helm/helm"],
+ "matchFileNames": ["scripts/install-helm.sh"],
+ "addLabels": ["review:helm-checksum"],
+ "prBodyNotes": [
+ ":warning: After bumping Helm, run `make sync-helm-checksum` and
commit the result to update the pinned `HELM_SHA256` in
`scripts/install-helm.sh`. The `Verify helm checksum` CI check will fail until
this is done."
+ ]
}
],
"customManagers": [
@@ -61,13 +70,25 @@
},
{
"customType": "regex",
- "description": "Track hand-pinned GitHub release helper binaries in
install scripts",
- "managerFilePatterns": ["/^scripts\\/install-[a-z0-9-]+\\.sh$/"],
+ "description": "Track hand-pinned GitHub release-attachment helper
binaries in install scripts (version + SHA-256 of the attachment, computed by
Renovate)",
+ "managerFilePatterns": [
+ "/^scripts\\/install-yq\\.sh$/",
+ "/^scripts\\/install-oras\\.sh$/"
+ ],
"matchStrings": [
"# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(
versioning=(?<versioning>\\S+))?\\s+\\S+_VERSION=\"\\$\\{\\S+_VERSION:-(?<currentValue>[^\\\"]+)\\}\"[\\s\\S]*?\\S+_SHA256=\"\\$\\{\\S+_SHA256:-(?<currentDigest>[a-f0-9]+)\\}\""
],
"versioningTemplate": "{{#if
versioning}}{{{versioning}}}{{else}}semver-coerced{{/if}}"
},
+ {
+ "customType": "regex",
+ "description": "Track the version-only Helm pin in install-helm.sh
(tarballs live on get.helm.sh, not GitHub; the checksum is resynced via `make
sync-helm-checksum`)",
+ "managerFilePatterns": ["/^scripts\\/install-helm\\.sh$/"],
+ "matchStrings": [
+ "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(
versioning=(?<versioning>\\S+))?\\s+\\S+_VERSION=\"\\$\\{\\S+_VERSION:-(?<currentValue>[^\\\"]+)\\}\""
+ ],
+ "versioningTemplate": "{{#if
versioning}}{{{versioning}}}{{else}}semver-coerced{{/if}}"
+ },
{
"customType": "regex",
"description": "Track the version-only helm-unittest plugin pin (no
checksum; installed via helm plugin install)",
diff --git a/scripts/install-yq.sh b/scripts/install-yq.sh
index 9004964..dde8328 100755
--- a/scripts/install-yq.sh
+++ b/scripts/install-yq.sh
@@ -20,7 +20,7 @@
set -euo pipefail
-# renovate: datasource=github-releases depName=mikefarah/yq
+# renovate: datasource=github-release-attachments depName=mikefarah/yq
YQ_VERSION="${YQ_VERSION:-v4.53.3}"
YQ_SHA256="${YQ_SHA256:-fa52a4e758c63d38299163fbdd1edfb4c4963247918bf9c1c5d31d84789eded4}"
YQ_PLATFORM="${YQ_PLATFORM:-linux_amd64}"
diff --git a/scripts/sync-helm-checksum.sh b/scripts/sync-helm-checksum.sh
new file mode 100755
index 0000000..ad960b1
--- /dev/null
+++ b/scripts/sync-helm-checksum.sh
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Sync the Helm tarball SHA-256 pinned in scripts/install-helm.sh with the
+# checksum that Helm publishes for the pinned HELM_VERSION / HELM_PLATFORM.
+#
+# Helm does not attach its release tarballs to GitHub releases (only detached
+# signatures live there); the tarballs and their checksums are served from
+# get.helm.sh. Renovate therefore tracks only HELM_VERSION, and this script
+# keeps HELM_SHA256 in sync — mirroring scripts/sync-supported-versions.sh.
+#
+# Usage:
+# sync-helm-checksum.sh [--check|--write]
+#
+# --check (default): exit non-zero with a diff if the pinned SHA is out of
sync.
+# --write: rewrite the SHA in scripts/install-helm.sh in place.
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SCRIPT="${REPO_ROOT}/scripts/install-helm.sh"
+
+mode="${1:---check}"
+case "${mode}" in --check|--write) ;; *) echo "usage: $0 [--check|--write]"
>&2; exit 2 ;; esac
+
+command -v curl >/dev/null || { echo "curl required" >&2; exit 1; }
+
+# Read the shell defaults out of install-helm.sh (VAR="${VAR:-default}").
+read_default() {
+ sed -nE "s/^$1=\"\\\$\{$1:-([^}]*)\}\"$/\1/p" "${SCRIPT}" | head -n1
+}
+
+HELM_VERSION="$(read_default HELM_VERSION)"
+HELM_PLATFORM="$(read_default HELM_PLATFORM)"
+CURRENT_SHA="$(read_default HELM_SHA256)"
+[ -n "${HELM_VERSION}" ] || { echo "could not read HELM_VERSION from
${SCRIPT}" >&2; exit 1; }
+[ -n "${HELM_PLATFORM}" ] || { echo "could not read HELM_PLATFORM from
${SCRIPT}" >&2; exit 1; }
+
+# get.helm.sh publishes "<sha> <filename>" alongside each tarball. awk pulls
the
+# first field, which also handles a bare-hash ".sha256" file if the suffix
moves.
+sha_url="https://get.helm.sh/helm-${HELM_VERSION}-${HELM_PLATFORM}.tar.gz.sha256sum";
+NEW_SHA="$(curl -fsSL "${sha_url}" | awk '{print $1; exit}')"
+printf '%s' "${NEW_SHA}" | grep -Eq '^[a-f0-9]{64}$' \
+ || { echo "unexpected checksum content from ${sha_url}: ${NEW_SHA}" >&2;
exit 1; }
+
+case "${mode}" in
+ --write)
+ if [ "${CURRENT_SHA}" = "${NEW_SHA}" ]; then
+ echo "install-helm.sh already pins the correct SHA-256 for Helm
${HELM_VERSION}"
+ else
+ sed -i.bak -E
"s|^(HELM_SHA256=\"\\\$\{HELM_SHA256:-)[a-f0-9]*(\}\")|\1${NEW_SHA}\2|"
"${SCRIPT}"
+ rm -f "${SCRIPT}.bak"
+ echo "updated HELM_SHA256 to ${NEW_SHA} for Helm ${HELM_VERSION}"
+ fi
+ ;;
+ --check)
+ if [ "${CURRENT_SHA}" != "${NEW_SHA}" ]; then
+ echo "install-helm.sh HELM_SHA256 is out of sync with Helm
${HELM_VERSION} (${HELM_PLATFORM})." >&2
+ echo " pinned: ${CURRENT_SHA}" >&2
+ echo " published: ${NEW_SHA}" >&2
+ echo "Run 'make sync-helm-checksum' to update." >&2
+ exit 1
+ fi
+ ;;
+esac
