Example: `nexa-deployments`

name: Deployment Configuration CI
on:
  pull_request:
  push:
    branches: [develop, main, 'release/**']

jobs:
  validate:
    uses: dataready-ai/nexa-ci/.github/workflows/kubernetes-ci.yml@v1
    with:
      kubernetes-version: '1.31'
      config-file: .nexa-ci.yml
    secrets: inherit

Example .nexa-ci.yml:

type: deployment
helm:
  - chart: charts/nexa-platform
    values:
      - environments/dev/values.yaml
      - environments/test/values.yaml
      - environments/prod/values.yaml
kustomize:
  overlays:
    - overlays/dev
    - overlays/test
    - overlays/prod
trivy:
  severity: HIGH,CRITICAL

The common workflow renders every declared combination, validates schema and security, and never contacts a cluster.

Required behavior

The repository lists all Helm charts, values files, and Kustomize overlays in .nexa-ci.yml. CI renders every supported Dev, Test, and Prod combination. A missing file, invalid patch, unsupported API, or insecure final workload blocks merge before Argo CD can consume the change.

Image Updater annotations are reviewed as deployment policy. Dev must not accidentally consume release or production tags, and Test must remain pinned to the active release stream. Secrets are represented only by references to the approved secret delivery mechanism.