helm lint: Validate Charts in CI

By Kaveh Alemi·Latchkey

Examine a chart for possible issues before installing or upgrading.

helm lint checks a chart for structural and best-practice problems without touching a cluster. In CI it is a fast pre-deploy gate that catches missing fields, bad templates, and invalid Chart.yaml early. Pair it with --strict to fail on warnings.

Common flags

PATH - chart directory to lint (positional)
-f values.yaml / --set key=value - lint against specific values
--strict - treat warnings as failures

Example in CI

Lint the chart strictly against production values.

shell

helm lint ./charts/api -f values.prod.yaml --strict

Common errors in CI

[ERROR] Chart.yaml: ... is required - missing required Chart.yaml fields
[ERROR] templates/: parse error ... - invalid Go template syntax
[WARNING] ... (fails build under --strict) - best-practice violation surfaced as warning

Using this in CI

Cloud CLIs behave differently on a runner than on your laptop. They assume no interactive terminal, no cached credentials, and no browser for device-code flows, so the same command that works locally can hang or fail on a runner.

Authenticate with a short-lived OIDC token rather than a long-lived static key. GitHub Actions can exchange id-token: write for cloud credentials with no stored secret.
Always pass the non-interactive flag. Most cloud CLIs will otherwise prompt and hang until the job times out.
Pin the CLI version. Cloud CLIs change output formats between minor releases, and any script parsing that output will break silently.
Set the output format explicitly (--output json) rather than relying on the default, which can differ by version and configuration profile.

Key takeaways

A cluster-free pre-deploy gate for chart correctness.
Use --strict to fail CI on warnings, not just errors.
Catches template and Chart.yaml mistakes before they reach a cluster.

Frequently asked questions

helm lint: Validate Charts in CI?

Example in CI?