2.1.2 version

.github/actions/setup-helm/action.yml

@@ -0,0 +1,29 @@
+name: Setup Helm
+description: Install a SHA-pinned Helm release via the upstream get-helm-3 script
+
+inputs:
+  version:
+    description: Helm CLI release tag (e.g. v4.1.4)
+    required: false
+    default: v4.1.4
+  sha256:
+    description: Expected SHA-256 of the upstream get-helm-3 script for the pinned version
+    required: false
+    default: 38b65f882d9cae3891755bdb03becc6a01ae6f9cb24826c191f219ddfee70a5d
+
+runs:
+  using: composite
+  steps:
+    - name: Install Helm (${{ inputs.version }})
+      shell: bash
+      run: |
+        set -euo pipefail
+        script=$(mktemp)
+        curl -fsSL -o "$script" "https://raw.githubusercontent.com/helm/helm/${{ inputs.version }}/scripts/get-helm-3"
+        actual=$(sha256sum "$script" | cut -d' ' -f1)
+        if [ "$actual" != "${{ inputs.sha256 }}" ]; then
+          echo "::error::helm install script hash mismatch (expected ${{ inputs.sha256 }}, got $actual)"
+          exit 1
+        fi
+        bash "$script" --version "${{ inputs.version }}"
+        helm version --short

.github/workflows/README.md

@@ -1,5 +1,17 @@
 # Workflows
 
+## dependency-checks
+
+Validates PRs touching `docs-source/site/` or `data-refactoring-advisor/`, including
+Dependabot updates. Each project runs only when its files change; changes to the
+workflow itself and manual runs validate both projects.
+
+The docs job uses Node 22 for a locked install, typecheck, and production build.
+The advisor job uses Python 3.12 to install requirements, check dependency
+compatibility, compile source, and run unit tests covering SQL parsing, community
+detection, configuration loading, and the Streamlit landing page. Database and
+LLM integration require separate testing with live services.
+
 ## obaas-base-image
 
 This workflow takes the GraalVM image from Oracle Container Registry, scans for vulnerabilities, applies the latest OS patches, and stages the new image in ghcr.io for use with the OBaaS Platform.

.github/workflows/helm.yml

@@ -0,0 +1,181 @@
+# Workflow for validating the Helm chart and its contract tests
+# spell-checker: disable
+name: Helm Tests
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+    paths:
+      - "helm/**"
+      - ".github/actions/setup-helm/**"
+      - ".github/workflows/helm.yml"
+
+  # Allows running this workflow manually
+  workflow_dispatch:
+
+concurrency:
+  group: helm-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check-helm:
+    if: github.event.pull_request.draft == false || github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      CHART_DIR: helm/infra-charts/obaas
+      PREREQS_CHART_DIR: helm/infra-charts/obaas-prereqs
+      HELM_KUBE_VERSION: "1.36.0"
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install Python tooling
+        run: pip install yamllint pytest pyyaml requests
+
+      - uses: ./.github/actions/setup-helm
+
+      - name: Run yamllint
+        run: yamllint helm/
+
+      # Cache the packaged subchart tarballs in both infrastructure charts.
+      # Key on Chart.lock so the cache is invalidated exactly when the
+      # locked dependency version changes (the only time we want a miss).
+      - name: Cache helm subcharts
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            helm/infra-charts/obaas/charts
+            helm/infra-charts/obaas-prereqs/charts
+          key: helm-charts-${{ hashFiles('helm/infra-charts/obaas/Chart.lock', 'helm/infra-charts/obaas-prereqs/Chart.lock') }}
+
+      - name: Build chart dependencies
+        # Pulls subchart tarballs into each chart's charts/ directory. The repo-add is
+        # required because `helm dependency build` resolves by repository
+        # URL via `helm repo list`, not by fetching the URL directly.
+        run: |
+          helm repo add --force-update ingress-nginx https://kubernetes.github.io/ingress-nginx
+          helm repo add --force-update signoz https://charts.signoz.io
+          helm repo add --force-update apisix https://apache.github.io/apisix-helm-chart
+          helm repo add --force-update ai-optimizer https://oracle.github.io/ai-optimizer/helm
+          helm repo add --force-update external-secrets https://charts.external-secrets.io
+          helm repo add --force-update metrics-server https://kubernetes-sigs.github.io/metrics-server/
+          helm repo add --force-update prometheus-community https://prometheus-community.github.io/helm-charts
+          helm repo add --force-update strimzi https://strimzi.io/charts/
+          helm repo add --force-update coherence https://oracle.github.io/coherence-operator/charts
+          helm repo add --force-update opentelemetry https://open-telemetry.github.io/opentelemetry-helm-charts
+          helm dependency build "$CHART_DIR"
+          operator_archive="$PREREQS_CHART_DIR/charts/oracle-database-operator-0.2.0.tgz"
+          if [ ! -f "$operator_archive" ]; then
+            echo "::error::oracle-database-operator chart archive is missing"
+            exit 1
+          fi
+          rm -rf "$PREREQS_CHART_DIR/charts/oracle-database-operator"
+          tar -xzf "$operator_archive" -C "$PREREQS_CHART_DIR/charts"
+          helm dependency build "$PREREQS_CHART_DIR"
+
+      - name: Run Helm Lint (strict, with required values)
+        run: >-
+          helm lint --strict "$CHART_DIR"
+          --kube-version "$HELM_KUBE_VERSION"
+          --set global.api.apiKey=test-api-key
+          --set client.cookieSecret=test-cookie-32-char-test-key-padding
+
+      - name: Run Helm Lint for prerequisites
+        run: helm lint --strict "$PREREQS_CHART_DIR" --kube-version "$HELM_KUBE_VERSION"
+
+      - name: Run Helm Package (validate chart builds)
+        run: |
+          helm package "$CHART_DIR" --destination "$RUNNER_TEMP/helm-package"
+          helm package "$PREREQS_CHART_DIR" --destination "$RUNNER_TEMP/helm-package"
+        env:
+          RUNNER_TEMP: ${{ runner.temp }}
+
+      # Render every example values file. CI overrides make examples that
+      # document external secrets self-contained for Helm's offline renderer.
+      - name: helm template against examples
+        run: |
+          shopt -s nullglob
+          failed=0
+          for f in "$CHART_DIR"/examples/*.yaml; do
+            ci_overrides=()
+            case "$f" in
+              *values-ai-optimizer.yaml)
+                ci_overrides=(
+                  --set "ai-optimizer.global.api.secretName="
+                  --set "ai-optimizer.global.api.secretKey="
+                  --set "database.type=SIDB-FREE"
+                  --set "database.privAuthN.secretName="
+                  --set "database.privAuthN.secretNamespace="
+                  --set "ai-optimizer.server.database.type=SIDB-FREE"
+                  --set "ai-optimizer.server.database.adb.useExisting=false"
+                  --set "ai-optimizer.server.database.privAuthN.secretName="
+                )
+                ;;
+              *values-byodb.yaml)
+                ci_overrides=(
+                  --set "database.type=SIDB-FREE"
+                  --set "database.privAuthN.secretName="
+                  --set "database.privAuthN.secretNamespace="
+                )
+                ;;
+              *values-existing-adb.yaml)
+                ci_overrides=(
+                  --set "database.type=SIDB-FREE"
+                  --set "database.privAuthN.secretName="
+                  --set "database.privAuthN.secretNamespace="
+                  --set "database.image.repository=container-registry.oracle.com/database/free"
+                  --set "database.image.tag=23.26.3.0"
+                )
+                ;;
+            esac
+            echo "::group::$f"
+            if ! helm template ci "$CHART_DIR" \
+                --kube-version "$HELM_KUBE_VERSION" \
+                --values "$f" \
+                --set global.api.apiKey=ci-test \
+                --set client.cookieSecret=ci-cookie-32-char-test-key-padding \
+                --set server.database.adb.skipCrdCheck=true \
+                "${ci_overrides[@]}" >/dev/null; then
+              failed=1
+            fi
+            echo "::endgroup::"
+          done
+          exit "$failed"
+
+      # Render at the supported Kubernetes minimum.
+      - name: helm template at minimum kubeVersion
+        run: >-
+          helm template ci "$CHART_DIR" --kube-version "$HELM_KUBE_VERSION"
+          --set global.api.apiKey=ci-test
+          --set client.cookieSecret=ci-cookie-32-char-test-key-padding
+
+      - name: helm template prerequisites at minimum kubeVersion
+        run: helm template ci "$PREREQS_CHART_DIR" --namespace ci --kube-version "$HELM_KUBE_VERSION"
+
+      # Negative test: the schema must reject an invalid enum value.
+      # Inverts the exit code so the step passes only when helm fails.
+      - name: values.schema.json rejects invalid enum
+        run: |
+          if helm template ci "$CHART_DIR" \
+              --kube-version "$HELM_KUBE_VERSION" \
+              --set signozUpgrade.stage=invalid \
+              --set global.api.apiKey=ci-test \
+              --set client.cookieSecret=ci-cookie-32-char-test-key-padding \
+              >/dev/null 2>&1; then
+            echo "::error::values.schema.json no longer rejects signozUpgrade.stage=invalid"
+            exit 1
+          fi
+
+      - name: Run Helm contract tests
+        run: pytest helm/tests/ -v

.github/workflows/opentofu.yml

@@ -0,0 +1,129 @@
+# Workflow for validating Infrastructure as Code
+#
+# This workflow validates syntax, formatting, schema, and security.
+# It does NOT validate infrastructure logic or resource creation.
+# Manual testing with real OCI credentials is REQUIRED before merging.
+# See opentofu/README.md for instructions.
+
+name: Validate Infrastructure as Code
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+    paths:
+      - "opentofu/tests/**"
+      - "opentofu/**"
+      - ".github/workflows/opentofu.yml"
+
+  workflow_dispatch:
+
+# Optimize: Cache terraform providers across all jobs
+env:
+  TF_PLUGIN_CACHE_DIR: ${{ github.workspace }}/.terraform.d/plugin-cache
+
+jobs:
+  # Job 1: Static analysis (validation, formatting, schema)
+  verify-iac-static:
+    name: Static Analysis
+    if: github.event.pull_request.draft == false || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/opentofu/opentofu:1.12.6
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Verify app_version is 0.0.0
+        working-directory: ./opentofu
+        run: |
+          if ! grep -qE '^\s*app_version\s*=\s*"0\.0\.0"\s*$' versions.tf; then
+            echo "::error file=opentofu/versions.tf::app_version must be \"0.0.0\" outside of the release workflow"
+            grep -nE '^\s*app_version\s*=' versions.tf || true
+            exit 1
+          fi
+
+      # Terraform validation steps
+      - name: Install Cache Dependencies
+        run: apk add --no-cache tar zstd
+
+      - name: Cache Terraform Providers
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ env.TF_PLUGIN_CACHE_DIR }}
+          key: ${{ runner.os }}-terraform-${{ hashFiles('opentofu/provider.tf', 'opentofu/.terraform.lock.hcl') }}
+          restore-keys: |
+            ${{ runner.os }}-terraform-
+
+      - name: Create Plugin Cache Directory
+        run: mkdir -p ${{ env.TF_PLUGIN_CACHE_DIR }}
+
+      - name: Initialize Infrastructure as Code
+        working-directory: ./opentofu
+        run: tofu init -backend=false
+
+      - name: Validate Infrastructure as Code
+        working-directory: ./opentofu
+        run: tofu validate
+
+      - name: Check Terraform Formatting
+        working-directory: ./opentofu
+        run: tofu fmt -recursive -check
+
+      # Schema validation
+      - name: Install Python and Dependencies
+        run: |
+          apk add --no-cache python3 py3-pip
+          pip3 install --break-system-packages pyyaml jsonschema referencing
+
+      - name: Validate Oracle Resource Manager Schema
+        working-directory: ./opentofu/tests
+        run: python3 validate_omr_schema.py OMRMetaSchema.yaml ../schema.yaml
+
+  # Job 2: Security scanning (runs on host for Docker access)
+  verify-iac-security:
+    name: Security Scan
+    if: github.event.pull_request.draft == false || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Trivy
+        uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567 # v0.3.1
+        with:
+          cache: true
+
+      - name: Run Trivy Security Scan for IaC
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: config
+          scan-ref: opentofu
+          format: sarif
+          output: trivy-results.sarif
+          exit-code: '0'
+          cache: false
+          skip-setup-trivy: true
+
+  verify-iac-summary:
+    name: Validation Summary
+    if: github.event.pull_request.draft == false || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions: {}
+    needs: [verify-iac-static, verify-iac-security]
+
+    steps:
+      - name: All Validations Passed
+        run: |
+          echo "✅ Syntax, formatting, schema, security validated"
+          echo "⚠️  Does NOT validate infrastructure logic"
+          echo "📖 See opentofu/README.md for manual testing requirements"