[PR] Improve CI stability: make kubeconform schema validation resilient to transient download failures [pulsar-helm-chart]

["lhotari (via GitHub)" <gi...@apache.org>]

lhotari opened a new pull request, #705:
URL: https://github.com/apache/pulsar-helm-chart/pull/705

   ### Motivation
   
   The `chart-testing lint` job on master is failing intermittently because kubeconform cannot download JSON schemas from raw.githubusercontent.com:
   
   ```
   stdin - Role release-name-pulsar-broker-role failed validation: failed downloading schema at https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/v1.27.0-standalone-strict/role-rbac-v1.json: ... giving up after 3 attempt(s)
   ```
   
   Two consecutive attempts of https://github.com/apache/pulsar-helm-chart/actions/runs/28790178682 failed this way (different schema files each time), while all actual chart validation passed (`Invalid: 0`). The root cause is likely throttling of GitHub Actions runner requests to raw.githubusercontent.com, aggravated by the fact that each kubeconform invocation re-downloads the same schemas: the lint job validates ~21 values files × 10 k8s versions, so the same schema files get downloaded hundreds of times per run.
   
   ### Modifications
   
   - Cache downloaded schemas with kubeconform's `-cache` option (new `hack::kubeconform_with_retries` helper in `hack/common.sh`), so each schema is downloaded at most once per run.
   - Persist the schema cache across CI runs with `actions/cache` (restore + save split so the cache is saved even when validation fails, avoiding re-downloads on the next attempt).
   - Retry kubeconform up to 5 times when the failure is a schema download error. Already-cached schemas are not re-downloaded on retry, so each retry only fetches the missing ones. Genuine validation failures fail immediately without retrying.
   - Render `helm template` output to a file so the kubeconform validation can be retried without re-running helm.
   
   ### Verification
   
   Tested locally:
   - warm cache run performs zero downloads (0.3s vs 2.1s cold per validation)
   - unreachable schema host: 5 attempts with 5s backoff, then fails with exit code 1
   - invalid resource (`-strict` violation): fails immediately with no retries


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Improve CI stability: make kubeconform schema validation resilient to transient download failures [pulsar-helm-chart]

["lhotari (via GitHub)" <gi...@apache.org>]

lhotari merged PR #705:
URL: https://github.com/apache/pulsar-helm-chart/pull/705


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org