Repository navigation
ci: config-key-coverage checker (catch overlay keys the chart renders nowhere) - #2208
Merged
Merged
Conversation
…s nowhere
Fails when a deployment overlay declares a config.{memex_portal,memex_migration,memex_postgres}
key that no chart template renders as a ConfigMap/Secret data key — the silent defect that dropped
all OpenRouter models in #2203 (and #1925/#1778/#1780 before it): the key reaches no container, no
error. Matches on the rendered KEY NAME (any values path), so a key rendered from a different path
(Hosting__Operator__Enabled <- .Values.hostingOperator.enabled) is not a false positive. Public
repo, so a config repo (Memex) runs it credential-free. Ratcheted via a caller-supplied allow-list.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new repository script to detect a specific Helm misconfiguration class: keys declared under config.memex_{portal,migration,postgres} in deployment overlays that are rendered by no chart template (silent drop → no container sees the config).
Changes:
- Introduces
scripts/check-config-key-coverage.pyto scan Helm templates for rendered ConfigMap/Secret key names and compare them against overlay-declaredconfig.*keys. - Adds allow-list support (
--allow) to ratchet pre-existing “rendered nowhere” keys while failing on new misses and stale allow-list entries. - Provides clear exit codes and human-readable output to support CI gating in downstream config repos.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+64
to
+67
| Collects the name from each YAML key line across all templates. Config keys are distinctive | ||
| (.NET `Foo__Bar` / `MEMEX_*` style), so scanning every key line — rather than only those inside | ||
| a `data:`/`stringData:` block, which is unreliable to parse in templated YAML — cannot collide | ||
| with a chart structural key (`name`, `image`, `replicas`) for the keys this gate checks. |
Comment on lines
+120
to
+121
| ap.add_argument("--overlays", nargs="*", default=None, | ||
| help="Overlay YAML paths. Default: deployments/aks/*/values.*.public.yaml") |
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
scripts/check-config-key-coverage.py, the checker behind the recurring silent-drop defect (#2203 dropped all OpenRouter models; #1925/#1778/#1780 before it). A deployment overlay key underconfig.{memex_portal,memex_migration,memex_postgres}that the chart renders as NO ConfigMap/Secret data key reaches no container with no error.Matches on the rendered ConfigMap key NAME, not the
.Values.config.{block}.{key}path — so a key rendered from a different values path (e.g.Hosting__Operator__Enabled<-.Values.hostingOperator.enabled) is correctly seen as rendered, not flagged. One-directional (overlay-declared-but-rendered-nowhere = FAIL); ratcheted via a caller-supplied--allowlist.Lives in the PUBLIC framework repo beside the chart it validates, so the config repo (Memex, private) runs it credential-free (Memex PR #110 is the thin caller — no token). Validated: green on Memex main (only client-i
Email__NoReplyAddressrenders nowhere, allow-listed); fails on an injectedconfig.memex_portal.FooBar__Test. For review before merge (false-positive traps).