Helm diff workflow (jupyterhub/binderhub)

The Helm diff workflow from jupyterhub/binderhub, explained and optimized by Latchkey.

CI health: F - at risk

Point runs-on at Latchkey and get caching, run de-duplication, job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: jupyterhub/binderhub.github/workflows/diff.ymlLicense BSD-3-ClauseView source

What it does

This is the Helm diff workflow from the jupyterhub/binderhub repository, a real project running GitHub Actions. It is shown here with attribution under its BSD-3-Clause license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

# This workflow provides a diff of the rendered Helm chart's templates with the
# latest released dev version of the chart.
#
name: Helm diff

on:
  pull_request:
    paths:
      - ".github/workflows/diff.yml"
      - "helm-chart/binderhub/**"
  push:
    paths:
      - ".github/workflows/diff.yml"
      - "helm-chart/binderhub/**"
    branches-ignore:
      - "dependabot/**"
      - "pre-commit-ci-update-config"
      - "update-*"
  workflow_dispatch:

jobs:
  diff-rendered-templates:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: jupyterhub/action-k3s-helm@v4
        with:
          k3s-channel: stable
          metrics-enabled: false
          traefik-enabled: false
          docker-enabled: true

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install helm diff plugin, update local chart dependencies
        run: |
          helm plugin install https://github.com/databus23/helm-diff
          helm dependency update ./helm-chart/binderhub

      - name: "Install latest released dev chart"
        run: |
          UPGRADE_FROM_VERSION=$(curl -sSL https://jupyterhub.github.io/helm-chart/info.json | jq -er '.binderhub.dev')

          # NOTE: We change the directory so binderhub the chart name won't be
          #       misunderstood as the local folder name.
          # validation is disabled, because the config is for a different version!
          cd testing

          old_config="../testing/k8s-binder-k8s-hub/binderhub-chart-config-old.yaml"
          if [ -f "$old_config" ]; then
            echo "using old config"
          else
            old_config="../testing/k8s-binder-k8s-hub/binderhub-chart-config.yaml"
          fi

          helm install binderhub-test binderhub \
              --values "$old_config" \
              --repo https://jupyterhub.github.io/helm-chart/ \
              --disable-openapi-validation \
              --version=$UPGRADE_FROM_VERSION

      - name: "Helm diff latest released dev chart with local chart"
        run: |
          echo "NOTE: For the helm diff, we have not updated the Chart.yaml"
          echo "      version or image tags using chartpress."
          echo

          helm diff upgrade binderhub-test helm-chart/binderhub \
              --values testing/k8s-binder-k8s-hub/binderhub-chart-config.yaml \
              --context=3

The same workflow, on Latchkey

Estimated ~20% faster on cache hits, plus fewer wasted runs and a safer supply chain. Added and changed lines are highlighted.

# This workflow provides a diff of the rendered Helm chart's templates with the
# latest released dev version of the chart.
#
name: Helm diff
 
on:
  pull_request:
    paths:
      - ".github/workflows/diff.yml"
      - "helm-chart/binderhub/**"
  push:
    paths:
      - ".github/workflows/diff.yml"
      - "helm-chart/binderhub/**"
    branches-ignore:
      - "dependabot/**"
      - "pre-commit-ci-update-config"
      - "update-*"
  workflow_dispatch:
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  diff-rendered-templates:
    timeout-minutes: 30
    runs-on: latchkey-small
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
 
      - uses: jupyterhub/action-k3s-helm@v4
        with:
          k3s-channel: stable
          metrics-enabled: false
          traefik-enabled: false
          docker-enabled: true
 
      - uses: actions/setup-python@v6
        with:
          cache: 'pip'
          python-version: "3.12"
 
      - name: Install helm diff plugin, update local chart dependencies
        run: |
          helm plugin install https://github.com/databus23/helm-diff
          helm dependency update ./helm-chart/binderhub
 
      - name: "Install latest released dev chart"
        run: |
          UPGRADE_FROM_VERSION=$(curl -sSL https://jupyterhub.github.io/helm-chart/info.json | jq -er '.binderhub.dev')
 
          # NOTE: We change the directory so binderhub the chart name won't be
          #       misunderstood as the local folder name.
          # validation is disabled, because the config is for a different version!
          cd testing
 
          old_config="../testing/k8s-binder-k8s-hub/binderhub-chart-config-old.yaml"
          if [ -f "$old_config" ]; then
            echo "using old config"
          else
            old_config="../testing/k8s-binder-k8s-hub/binderhub-chart-config.yaml"
          fi
 
          helm install binderhub-test binderhub \
              --values "$old_config" \
              --repo https://jupyterhub.github.io/helm-chart/ \
              --disable-openapi-validation \
              --version=$UPGRADE_FROM_VERSION
 
      - name: "Helm diff latest released dev chart with local chart"
        run: |
          echo "NOTE: For the helm diff, we have not updated the Chart.yaml"
          echo "      version or image tags using chartpress."
          echo
 
          helm diff upgrade binderhub-test helm-chart/binderhub \
              --values testing/k8s-binder-k8s-hub/binderhub-chart-config.yaml \
              --context=3

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Cancel superseded runs when a branch or PR gets a newer push.
Cache dependency installs on the setup step so they are served from cache.
Add a job timeout so a hung step cannot burn hours of runner time.

1 third-party action is referenced by a movable tag. Pin it to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

actions/checkout actions/setup-python