From 293a627f67bd45831e562126faf51b2c70c9c19a Mon Sep 17 00:00:00 2001
From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com>
Date: Thu, 22 Oct 2026 21:16:43 -0700
Subject: [PATCH] ci: parse staging chart render before merge

Co-authored-by: CI Doctor <WyJjaS1kb2N0b3IiLCJkZWZhdWx0Il0@agents.commonly.invalid>
Agent-Model: codex/gpt-6-sol/medium
---
 .github/workflows/tests.yml | 43 +++++++++++++++++++++++++++++++++++++
 package-lock.json           | 36 +++++++++++++++++++++++++++++--
 package.json                |  1 +
 3 files changed, 78 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 4550979246..39e41d9ef1 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -174,6 +174,8 @@ jobs:
             <(printf '%s\n' "$NEEDS_JSON" | jq -r 'keys[]' | sort)
       - name: Verify every check passed
         run: |
+          # Suite jobs run unconditionally; a skipped result is a failed gate.
+          # Revisit this predicate if a later PR adds path-based job skipping.
           echo "$NEEDS_JSON" | jq -e '
             [.[].result] | all(. == "success")
           '
@@ -260,6 +262,13 @@ jobs:
         with:
           version: v3.14.0
 
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: package-lock.json
+      - run: npm ci --ignore-scripts --include=dev
+
       - name: Install kubeconform
         run: |
           curl -sSL "https://github.com/yannh/kubeconform/releases/download/${KUBECONFORM_VERSION}/kubeconform-linux-amd64.tar.gz" -o kc.tgz
@@ -287,6 +296,40 @@ jobs:
             --schema-location default \
             /tmp/dev-rendered.yaml
 
+      # The dev render has kubeconform coverage, but staging is otherwise first
+      # rendered at deploy time. Parse both values combinations before merge.
+      - name: Strictly parse dev and staging chart renders
+        run: |
+          set -o pipefail
+          for environment in dev staging; do
+            error_file="/tmp/${environment}-helm.err"
+            if ! helm template "commonly-${environment}" k8s/helm/commonly \
+              -f k8s/helm/commonly/values.yaml \
+              -f "k8s/helm/commonly/values-${environment}.yaml" \
+              2>"$error_file" | node -e '
+                const yaml = require("js-yaml");
+                let rendered = "";
+                process.stdin.setEncoding("utf8");
+                process.stdin.on("data", chunk => { rendered += chunk; });
+                process.stdin.on("end", () => {
+                  try {
+                    let objects = 0;
+                    yaml.loadAll(rendered, object => { if (object !== undefined) objects++; });
+                    if (objects === 0) throw new Error("Helm rendered no objects");
+                    console.log(`Parsed ${objects} objects`);
+                  } catch (error) {
+                    console.error(error.reason || error.message);
+                    if (error.mark?.snippet) console.error(error.mark.snippet);
+                    process.exitCode = 1;
+                  }
+                });
+              '; then
+              cat "$error_file"
+              exit 1
+            fi
+            cat "$error_file"
+          done
+
       - name: Validate alerting config (offline)
         # k8s/monitoring/ is applied by hand with scripts/monitoring/apply-alerting.py
         # (docs/runbooks/alerting.md). --check makes no API call: it asserts every
diff --git a/package-lock.json b/package-lock.json
index ccf765d8f2..53af21df0b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,16 +1,18 @@
 {
   "name": "commonly",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "commonly",
-      "version": "1.0.0",
+      "version": "1.1.0",
+      "license": "Apache-2.0",
       "devDependencies": {
         "@playwright/test": "^1.57.0",
         "@types/node": "^25.0.10",
         "husky": "^9.0.11",
+        "js-yaml": "4.3.2",
         "lint-staged": "^16.0.0",
         "wait-on": "^9.0.4"
       }
@@ -141,6 +143,13 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "dev": true,
+      "license": "Python-2.0"
+    },
     "node_modules/asynckit": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
@@ -608,6 +617,29 @@
         "node": ">= 20"
       }
     },
+    "node_modules/js-yaml": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
     "node_modules/lilconfig": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-3.1.3.tgz",
diff --git a/package.json b/package.json
index e6b2a7b8cb..a8d0799ca9 100644
--- a/package.json
+++ b/package.json
@@ -24,6 +24,7 @@
     "@playwright/test": "^1.57.0",
     "@types/node": "^25.0.10",
     "husky": "^9.0.11",
+    "js-yaml": "4.3.2",
     "lint-staged": "^16.0.0",
     "wait-on": "^9.0.4"
   },