feat(ci): add pluto scanning

.github/scripts/templateHelmChartRecursivelyToFolder.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+[[ "$RUNNER_DEBUG" == 1 ]] && set -x
+[[ -o xtrace ]] && export RUNNER_DEBUG=1
+
+set -eu
+set -o pipefail
+
+chart=${1?You need to provide the chart name}
+targetDir=${2?You need to provide the target directory}
+
+if yq -e '.type == "library"' "$chart/Chart.yaml" >/dev/null; then
+  echo "Skipping library chart '$chart'" >/dev/stderr
+  exit 0
+fi
+
+[[ ! -d "$targetDir" ]] && mkdir -p "$targetDir"
+
+for values in "$chart/values.yaml" "$chart/ci/"*-values.yaml; do
+  [[ -f "$values" ]] || continue
+  (
+    newResourcesDir="$targetDir/$(basename -s .yaml "$values")"
+
+    mkdir "$newResourcesDir"
+
+    "$(dirname "$0")/templateLocalHelmChart" -1 "$chart" "$values" | yq -y -S >"$newResourcesDir.yaml"
+    "$(dirname "$0")/splitYamlIntoDir" "$newResourcesDir.yaml" "$newResourcesDir"
+  ) &
+done
+wait

.github/workflows/linter.yaml

@@ -11,8 +11,8 @@ on:
 jobs:
   getChangedCharts:
     uses: ./.github/workflows/get-changed-charts.yaml
-  lint-helm-chart:
-    name: lint helm chart
+  prepare-helm-chart:
+    name: prepare helm chart
     runs-on: ubuntu-latest
     needs: getChangedCharts
     strategy:
@@ -57,5 +57,8 @@ jobs:
           CT_CHART_REPOS: ${{ steps.helm-repos.outputs.repos }}
           CT_CHARTS: charts/${{ matrix.chart }}
 
-      - name: enforce trusted registries
-        run: ./.github/scripts/enforce-trusted-registries.sh "charts/$CHART"
+      - run: ./.github/scripts/enforce-trusted-registries.sh "charts/$CHART"
+      - name: Download Pluto
+        uses: FairwindsOps/pluto/github-action@master
+      - run: ./.github/scripts/templateHelmChartRecursivelyToFolder.sh "charts/$CHART" /tmp/templated
+      - run: pluto detect-files -d /tmp/templated -o custom --columns 'FILEPATH,NAME,KIND,VERSION,REPLACEMENT,REMOVED,DEPRECATED,REPL AVAIL'