ci: use chartpress to build/test/publish images and Helm chart

.github/workflows/build-publish-helm-chart.yaml

@@ -0,0 +1,65 @@
+# This is a GitHub workflow defining a set of jobs with a set of steps.
+# ref: https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions
+#
+name: Build and publish Helm chart
+
+on:
+  push:
+    tags: ["**"]
+  workflow_dispatch:
+
+jobs:
+  build-publish-helm-chart:
+    name: "Build and publish Helm chart"
+    runs-on: ubuntu-latest
+
+    # permissions requested for secrets.github_token in order to push to the
+    # container registry, available for push and workflow_dispatch triggers.
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          # chartpress requires git history to set chart version and image tags
+          # correctly
+          fetch-depth: 0
+      - uses: actions/setup-python@v3
+
+      - name: Install chart publishing dependencies (chartpress, pyyaml, helm)
+        run: |
+          pip install chartpress pyyaml
+          pip list
+
+          echo "Helm is already installed"
+          helm version
+
+      - name: Set up QEMU (for docker buildx)
+        uses: docker/setup-qemu-action@v1
+
+      - name: Set up Docker Buildx (for multi-arch builds)
+        uses: docker/setup-buildx-action@v1
+
+      - name: Login to container registry
+        run: echo "${{ secrets.github_token }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+
+      # chartpress pushes a packages Helm chart to dask/helm-chart's gh-pages
+      # branch, so we need to have a git user.email and user.name configured
+      - name: Configure a git user
+        run: |
+          git config --global user.email "github-actions@example.local"
+          git config --global user.name "GitHub Actions user"
+
+      - name: Generate values.schema.json from YAML equivalent
+        run: resources/helm/tools/generate-json-schema.py
+
+      - name: Build and publish Helm chart with chartpress
+        env:
+          # chartpress can make use of a personal access token by setting these
+          # environment variables like this, for details see:
+          # https://github.com/jupyterhub/chartpress/blob/d4e2346d50f0724f6bee387f4f8aebc108afb648/chartpress.py#L118-L128
+          #
+          GITHUB_ACTOR: ""
+          GITHUB_TOKEN: "${{ secrets.dask_bot_token }}"
+        run: continuous_integration/kubernetes/build-publish-helm-chart.sh

.github/workflows/test.yaml

@@ -84,10 +84,7 @@ jobs:
         run: |
           cd tests
           pip install -r requirements.txt
-
-      - name: List Python packages
-        run: |
-          pip freeze
+          pip list
 
       - name: Run Python tests
         run: |
@@ -121,43 +118,64 @@ jobs:
           - k3s-channel: v1.21
           - k3s-channel: v1.22
           - k3s-channel: v1.23
+
     steps:
       - uses: actions/checkout@v3
+        with:
+          # chartpress requires git history to set chart version and image tags
+          # correctly
+          fetch-depth: 0
+      - uses: actions/setup-python@v3
 
       # Starts a k8s cluster with NetworkPolicy enforcement and installs both
       # kubectl and helm
       #
       # ref: https://github.com/jupyterhub/action-k3s-helm/
       #
-      - uses: jupyterhub/action-k3s-helm@v1
+      - uses: jupyterhub/action-k3s-helm@v2
         with:
           k3s-channel: ${{ matrix.k3s-channel }}
           metrics-enabled: false
           traefik-enabled: false
           docker-enabled: true
 
-      - name: Helm lint and render templates
-        run: |
-          ./continuous_integration/kubernetes/helm-lint-and-template.sh
-
-      - name: Helm Install
-        run: |
-          ./continuous_integration/kubernetes/helm-install.sh
-
       - name: Install Python test requirements
         run: |
           cd tests
           DASK_GATEWAY_SERVER__NO_PROXY=true pip install -r requirements.txt
+          pip list
 
-      - name: List Python packages
+      - name: Generate values.schema.json from YAML equivalent
+        run: resources/helm/tools/generate-json-schema.py
+
+      - name: helm lint
         run: |
-          pip list
+          helm lint resources/helm/dask-gateway \
+              --values=resources/helm/testing/chart-install-values.yaml
 
-      - name: Kubernetes Tests
+      - name: helm template
+        run: |
+          helm template test-dask-gateway resources/helm/dask-gateway \
+              --include-crds \
+              --values=resources/helm/testing/chart-install-values.yaml
+
+      - working-directory: resources/helm
+        run: chartpress
+
+      - name: helm install
+        run: |
+          helm install \
+              test-dask-gateway \
+              resources/helm/dask-gateway \
+              --values=resources/helm/testing/chart-install-values.yaml \
+              --wait \
+              --timeout 3m0s
+
+      - name: pytest
         run: |
           TEST_DASK_GATEWAY_KUBE=true \
           TEST_DASK_GATEWAY_KUBE_ADDRESS=http://localhost:30200/services/dask-gateway/ \
-          pytest -v tests/kubernetes/
+          pytest -v tests/kubernetes
 
       # ref: https://github.com/jupyterhub/action-k8s-namespace-report
       - name: Kubernetes namespace report

continuous_integration/kubernetes/build-publish-helm-chart.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+# This script publishes the Helm chart to the Dask Helm chart repo and pushes
+# associated built docker images to our container registry using chartpress.
+# --------------------------------------------------------------------------
+
+# Exit on errors, assert env vars, log commands
+set -eux
+
+PUBLISH_ARGS="--push --publish-chart \
+    --builder=docker-buildx \
+    --platform=linux/amd64 \
+    --platform=linux/arm64 \
+"
+
+# chartpress needs to run next to resources/helm/chartpress.yaml
+cd resources/helm
+
+# chartpress use git to push to our Helm chart repository, which is the gh-pages
+# branch of dask/helm-chart. We assume permissions to the docker registry are
+# already configured.
+if [[ $GITHUB_REF != refs/tags/* ]]; then
+    # Using --extra-message, we help readers of merged PRs to know what version
+    # they need to bump to in order to make use of the PR. This is enabled by a
+    # GitHub notificaiton in the PR like "Github Action user pushed a commit to
+    # dask/helm-chart that referenced this pull request..."
+    #
+    # ref: https://github.com/jupyterhub/chartpress#usage
+    #
+    # NOTE: GitHub merge commits contain a PR reference like #123. `sed` is used
+    #       to extract a PR reference like #123 or a commit hash reference like
+    #       @123abcd. Combined with GITHUB_REPOSITORY we craft a commit message
+    #       like dask/dask-gateway#123 or dask/dask-gateway@123abcd.
+    PR_OR_HASH=$(git log -1 --pretty=%h-%B | head -n1 | sed 's/^.*\(#[0-9]*\).*/\1/' | sed 's/^\([0-9a-f]*\)-.*/@\1/')
+    LATEST_COMMIT_TITLE=$(git log -1 --pretty=%B | head -n1)
+    EXTRA_MESSAGE="${GITHUB_REPOSITORY}${PR_OR_HASH} ${LATEST_COMMIT_TITLE}"
+
+    # shellcheck disable=SC2086
+    chartpress $PUBLISH_ARGS --extra-message "${EXTRA_MESSAGE}"
+else
+    # Setting a tag explicitly enforces a rebuild if this tag had already been
+    # built and we wanted to override it.
+
+    # shellcheck disable=SC2086
+    chartpress $PUBLISH_ARGS --tag "${GITHUB_REF:10}"
+fi
+
+# Let us log the changes chartpress did, it should include replacements for
+# fields in values.yaml, such as what tag for various images we are using.
+git --no-pager diff --color