ci: add CI and CD workflows for a Helm charts repository

.github/actions/check-typos/action.yaml

@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: 2025 Yale University
+# SPDX-License-Identifier: Apache-2.0
+
+name: check-typos
+description: Helper for running Typos
+inputs:
+  files:
+    description: Files to check
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Install and run Typos
+      uses: crate-ci/typos@v1.29.7
+      with:
+        config: ./configs/typos.toml
+        files: ${{ inputs.files }}

.github/actions/setup-committed/action.yaml

@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: 2025 Yale University
+# SPDX-License-Identifier: Apache-2.0
+
+name: setup-committed
+description: Helper for installing Committed
+runs:
+  using: composite
+  steps:
+    - name: Install Committed
+      uses: jaxxstorm/action-install-gh-release@v2.1.0
+      with:
+        repo: crate-ci/committed
+        tag: v1.1.7

.github/actions/setup-helm/action.yaml

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2025 Yale University
+# SPDX-License-Identifier: Apache-2.0
+
+name: setup-helm
+description: Helper for installing Helm
+runs:
+  using: composite
+  steps:
+    - name: Install Helm
+      uses: azure/setup-helm@v4
+      with:
+        version: v3.17.0

.github/actions/setup-just/action.yaml

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2025 Yale University
+# SPDX-License-Identifier: Apache-2.0
+
+name: setup-just
+description: Helper for installing Just
+runs:
+  using: composite
+  steps:
+    - name: Install Just
+      uses: taiki-e/install-action@v2
+      with:
+        tool: just@1.40.0

.github/workflows/checks.yaml

@@ -0,0 +1,130 @@
+# SPDX-FileCopyrightText: 2025 Yale University
+# SPDX-License-Identifier: Apache-2.0
+
+# Reusable workflow for running various checks on Helm charts
+
+name: checks
+on:
+  workflow_call:
+    inputs:
+      enable-change-detection:
+        description: Enable change detection
+        default: false
+        type: boolean
+      chart:
+        description: Limit checks to a specific chart
+        default: ''
+        type: string
+    outputs:
+      charts:
+        description: List of validated charts
+        value: ${{ jobs.helm-linter.outputs.charts }}
+
+permissions:
+  contents: read
+
+env:
+  CLICOLOR: 1
+
+jobs:
+  helm-linter:
+    runs-on: ubuntu-latest
+    outputs:
+      charts: ${{ steps.ct-log-parser.outputs.charts }}
+    env:
+      CHART_TESTING_LOG: chart-testing.log
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          # Fetch whole history required for change detection (if enabled)
+          fetch-depth: ${{ (inputs.enable-change-detection) && '0' || '1' }}
+      - name: Install Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+          check-latest: true
+      - &install-just-step
+        name: Install Just
+        uses: ./.github/actions/setup-just
+      - &install-helm-step
+        name: Install Helm
+        uses: ./.github/actions/setup-helm
+      - &install-ct-step
+        name: Install chart-testing
+        uses: helm/chart-testing-action@v2.7.0
+      - &add-chart-repos-step
+        name: Add external chart repositories
+        run: just add-chart-repos
+      - name: Run chart linters and validators
+        run: |
+          set -o pipefail
+          if ${{ inputs.enable-change-detection }}; then
+            # Enable change detection if requested
+            set -- "--target-branch" "main"
+          elif test -n "${{ inputs.chart }}"; then
+            # Process only the specified chart
+            set -- "--charts" "./charts/${{ inputs.chart }}"
+          else
+            # Process all charts
+            set -- "--all"
+          fi
+          ct lint --config ./configs/chart-testing.yaml "$@" \
+            | tee "${{ env.CHART_TESTING_LOG }}"
+      - id: ct-log-parser
+        name: Parse chart-testing logs
+        uses: eaasi/chart-list-action@v0.3
+        with:
+          ct-log-file: ${{ env.CHART_TESTING_LOG }}
+
+  helm-tester:
+    runs-on: ubuntu-latest
+    needs:
+      - helm-linter
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - *install-just-step
+      - name: Install Minikube
+        uses: medyagh/setup-minikube@v0.0.20
+        with:
+          start: false
+      - name: Start Minikube cluster
+        run: just cluster-start
+      - *install-helm-step
+      - *install-ct-step
+      - *add-chart-repos-step
+      - name: Install and test charts
+        run: ct install --config ./configs/chart-testing.yaml --all
+
+  spell-checker:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Run spell checker
+        uses: ./.github/actions/check-typos
+
+  changelog-checker:
+    runs-on: ubuntu-latest
+    needs:
+      - helm-linter
+      - spell-checker
+    if: ${{ needs.helm-linter.outputs.charts != '[]' }}
+    strategy:
+      matrix:
+        chart: ${{ fromJSON(needs.helm-linter.outputs.charts) }}
+    env:
+      CHANGELOG_FILE: ${{ matrix.chart.path }}/CHANGELOG.md
+    steps:
+      - name: Checkout chart's changelog
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: ${{ env.CHANGELOG_FILE }}
+      - name: Check chart's changelog
+        uses: eaasi/release-notes-action@v0.6
+        with:
+          changelog-file: ${{ env.CHANGELOG_FILE }}
+          release-version: '${{ matrix.chart.version }}'
+        # Ignore missing changelogs for default chart version
+        continue-on-error: ${{ matrix.chart.version == '0.1.0' }}

.github/workflows/ci.yaml

@@ -0,0 +1,25 @@
+# SPDX-FileCopyrightText: 2025 Yale University
+# SPDX-License-Identifier: Apache-2.0
+
+# Workflow for running various CI checks
+
+name: continuous-integration
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - '**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+permissions:
+  contents: read
+
+jobs:
+  checks:
+    uses: ./.github/workflows/checks.yaml
+    with:
+      enable-change-detection: ${{ github.ref != 'refs/heads/main' }}

.github/workflows/commit-style.yaml

@@ -0,0 +1,44 @@
+# SPDX-FileCopyrightText: 2025 Yale University
+# SPDX-License-Identifier: Apache-2.0
+
+# Workflow for enforcing commit style conventions
+
+name: commit-style
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - '**'
+
+permissions:
+  contents: read
+
+env:
+  CLICOLOR: 1
+
+jobs:
+  commit-linter:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          # Fetch full history for merge-base detection!
+          fetch-depth: 0
+      - id: commit-range
+        name: Determine commit range
+        uses: eaasi/commit-range-action@v0.5
+      - name: Install commit style linter
+        uses: ./.github/actions/setup-committed
+      - name: Run commit style linter
+        run: |
+          range="${{ steps.commit-range.outputs.commit-range }}"
+          echo "Linting commits:"
+          git log --color=always --graph --oneline "${range:?}" || true
+          echo ""
+          committed -vv --color=always \
+            --config ./configs/committed.toml \
+            "${range}"
+          echo "DONE: Commits follow the required style conventions."

.github/workflows/pr-naming.yaml

@@ -0,0 +1,86 @@
+# SPDX-FileCopyrightText: 2025 Yale University
+# SPDX-License-Identifier: Apache-2.0
+
+# Workflow for enforcing PR naming conventions
+
+name: pr-naming
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - reopened
+
+permissions:
+  contents: none
+
+env:
+  COMMIT_MESSAGE_FILE: ./commit-message.txt
+  CLICOLOR: 1
+
+jobs:
+  commit-message:
+    runs-on: ubuntu-latest
+    outputs:
+      content: ${{ steps.message-constructor.outputs.content }}
+    steps:
+      - id: message-constructor
+        name: Construct commit message
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BODY: |
+            ${{ github.event.pull_request.body }}
+        run: |
+          print-commit-message() {
+            echo "${PR_TITLE:?}"
+            if test -n "${PR_BODY}"; then
+              echo ""
+              echo "${PR_BODY}"
+            fi
+          }
+          # Output commit message
+          {
+            echo "content<<ENDOFMSG"
+            print-commit-message
+            echo "ENDOFMSG"
+          } >> "${GITHUB_OUTPUT}"
+
+  commit-linter:
+    runs-on: ubuntu-latest
+    needs:
+      - commit-message
+    steps:
+      - &checkout-repository-step
+        name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github/actions
+            configs
+      - &prepare-commit-message-step
+        name: Prepare commit message
+        run: |
+          echo -n '${{ needs.commit-message.outputs.content }}' > "${{ env.COMMIT_MESSAGE_FILE }}"
+      - name: Install commit style linter
+        uses: ./.github/actions/setup-committed
+      - name: Run commit style linter
+        run: |
+          echo "Linting commit message:"
+          cat "${{ env.COMMIT_MESSAGE_FILE }}" | sed 's/^/> /'
+          echo ""
+          committed -vv --color=always \
+            --config ./configs/committed.toml \
+            --commit-file "${{ env.COMMIT_MESSAGE_FILE }}"
+          echo "DONE: PR follows the required naming conventions."
+
+  spell-checker:
+    runs-on: ubuntu-latest
+    needs:
+      - commit-message
+    steps:
+      - *checkout-repository-step
+      - *prepare-commit-message-step
+      - name: Run spell checker
+        uses: ./.github/actions/check-typos
+        with:
+          files: ${{ env.COMMIT_MESSAGE_FILE }}