Render tag-only image references and test them in CI

.gitea/workflows/deploy.yml

@@ -32,11 +32,8 @@ jobs:
 
       - name: Lint and render
         run: |
-          "${RUNNER_TEMP}/helm" lint . --values values-brunner-ninja.yaml
-          "${RUNNER_TEMP}/helm" template "${RELEASE_NAME}" . \
-            --namespace "${NAMESPACE}" \
-            --values values-brunner-ninja.yaml > "${RUNNER_TEMP}/rendered.yaml"
-          test -s "${RUNNER_TEMP}/rendered.yaml"
+          export PATH="${RUNNER_TEMP}:${PATH}"
+          ./test.sh
 
   deploy:
     name: Deploy to Kubernetes

templates/deployment.yaml

@@ -29,7 +29,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: nginx
-          image: {{ printf "%s:%s@%s" .Values.image.repository .Values.image.tag .Values.image.digest | quote }}
+          image: {{ printf "%s:%s" .Values.image.repository .Values.image.tag | quote }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
             - name: http

test.sh

@@ -23,6 +23,10 @@ for values_file in "${values_files[@]}"; do
     --namespace default \
     --values "${values_path}" > "${output}"
   test -s "${output}"
+  if grep -Eq 'image:.*(@|%!|<nil>)' "${output}"; then
+    echo "Rendered image must use a valid repository:tag reference" >&2
+    exit 1
+  fi
 done
 
 if [[ -f "${workdir}/values-brunner-ninja.yaml" ]]; then