From 7a482ada434bcaa077d8773e9f6c6fbb75eab1a4 Mon Sep 17 00:00:00 2001 From: Luis Ibarra Date: Tue, 30 Jun 2026 15:39:09 -0500 Subject: [PATCH 1/3] fix(ci): build helm deps natively to avoid bind-mount permission error The `helm dependency update` step added in #41926 ran inside the `helmunittest/helm-unittest` container. On the Linux CI runner the container's non-root user can't write to the bind-mounted workdir, so `helm dependency build` failed with `mkdir charts: permission denied` (it passed locally only because Docker Desktop on macOS ignores mount ownership). Run the dependency build natively on the runner via `azure/setup-helm`, matching the pattern already used in helm-release.yml and helm-docs.yml. The charts/ dir is then created as the runner user and the existing unittest container reads it without issue. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/helm-unittest.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/helm-unittest.yml b/.github/workflows/helm-unittest.yml index ef427d4b9c8..a107e92eeab 100644 --- a/.github/workflows/helm-unittest.yml +++ b/.github/workflows/helm-unittest.yml @@ -21,12 +21,19 @@ jobs: - name: Checkout the code uses: actions/checkout@v4 + - name: Setup Helm + uses: azure/setup-helm@v4 + with: + version: v4.1.4 + # Subchart .tgz files are gitignored, so a fresh checkout has no charts/. - # Pull dependencies first so tests that render subchart templates (e.g. + # Build dependencies first so tests that render subchart templates (e.g. # deriving the redis master host from the redis subchart fullname) pass. + # Run natively on the runner (not in the unittest container): the + # container user can't write charts/ into the bind-mounted workdir, which + # fails with "mkdir charts: permission denied". - name: Build chart dependencies - run: | - docker run --rm -v $(pwd):/apps --entrypoint helm helmunittest/helm-unittest dependency update . + run: helm dependency build - name: Unittest run: | From 03746e9f8fb2f503d3ad56d3fb7b307728885b4e Mon Sep 17 00:00:00 2001 From: Luis Ibarra Date: Tue, 30 Jun 2026 15:47:53 -0500 Subject: [PATCH 2/3] docs(ci): correct dep-build rationale comment The comment claimed the unit tests derive the redis master host from the redis subchart fullname; on release that host is hardcoded in the parent templates, so the tests don't currently require the built subcharts. Reword to state the actual rationale: resolve subchart templates when present and keep CI dependency resolution in parity with the publish job (helm-release.yml). Co-Authored-By: Claude Opus 4.8 --- .github/workflows/helm-unittest.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/helm-unittest.yml b/.github/workflows/helm-unittest.yml index a107e92eeab..c6bd047f016 100644 --- a/.github/workflows/helm-unittest.yml +++ b/.github/workflows/helm-unittest.yml @@ -27,11 +27,12 @@ jobs: version: v4.1.4 # Subchart .tgz files are gitignored, so a fresh checkout has no charts/. - # Build dependencies first so tests that render subchart templates (e.g. - # deriving the redis master host from the redis subchart fullname) pass. - # Run natively on the runner (not in the unittest container): the - # container user can't write charts/ into the bind-mounted workdir, which - # fails with "mkdir charts: permission denied". + # Build dependencies so any test that renders a subchart template can + # resolve it, and so CI resolves dependencies the same way the publish + # job (helm-release.yml, which also runs `helm dep build`) does. + # Run natively on the runner, not in the unittest container: the + # container's non-root user can't write charts/ into the bind-mounted + # workdir, which fails with "mkdir charts: permission denied". - name: Build chart dependencies run: helm dependency build From 2b498869330ada6fffe6e6a0efad84faf837965a Mon Sep 17 00:00:00 2001 From: Luis Ibarra Date: Tue, 30 Jun 2026 15:53:52 -0500 Subject: [PATCH 3/3] docs(ci): simplify Build chart dependencies comment Co-Authored-By: Claude Opus 4.8 --- .github/workflows/helm-unittest.yml | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/.github/workflows/helm-unittest.yml b/.github/workflows/helm-unittest.yml index c6bd047f016..0653ef917b4 100644 --- a/.github/workflows/helm-unittest.yml +++ b/.github/workflows/helm-unittest.yml @@ -26,13 +26,8 @@ jobs: with: version: v4.1.4 - # Subchart .tgz files are gitignored, so a fresh checkout has no charts/. - # Build dependencies so any test that renders a subchart template can - # resolve it, and so CI resolves dependencies the same way the publish - # job (helm-release.yml, which also runs `helm dep build`) does. - # Run natively on the runner, not in the unittest container: the - # container's non-root user can't write charts/ into the bind-mounted - # workdir, which fails with "mkdir charts: permission denied". + # charts/ is gitignored, so pull subcharts before running the tests. + # Done here, not in the container, which can't write to the mounted dir. - name: Build chart dependencies run: helm dependency build