[ENG-715] feat: Update workflows and add SAML SSO support

.github/ci/dependencies.yaml

@@ -0,0 +1,137 @@
+# Ephemeral MongoDB (single-node replica set) + ClickHouse for the chart-testing
+# install gate. Applied into the `currents-ci` namespace by lint-test.yaml; the
+# chart's pods reach them via cluster DNS. NOT for production use — no auth on
+# MongoDB, throwaway ClickHouse credentials.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mongodb
+  labels:
+    app: mongodb
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mongodb
+  template:
+    metadata:
+      labels:
+        app: mongodb
+    spec:
+      containers:
+        - name: mongodb
+          image: mongo:8
+          args: ["--replSet", "rs0", "--bind_ip_all"]
+          ports:
+            - containerPort: 27017
+          readinessProbe:
+            exec:
+              command: ["mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mongodb
+spec:
+  selector:
+    app: mongodb
+  ports:
+    - port: 27017
+      targetPort: 27017
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: clickhouse
+  labels:
+    app: clickhouse
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: clickhouse
+  template:
+    metadata:
+      labels:
+        app: clickhouse
+    spec:
+      containers:
+        - name: clickhouse
+          image: clickhouse/clickhouse-server:25.6
+          env:
+            - name: CLICKHOUSE_USER
+              value: currents
+            - name: CLICKHOUSE_PASSWORD
+              value: currents
+            - name: CLICKHOUSE_DB
+              value: currents
+            - name: CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT
+              value: "1"
+          ports:
+            - containerPort: 8123
+            - containerPort: 9000
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: 8123
+            initialDelaySeconds: 5
+            periodSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: clickhouse
+spec:
+  selector:
+    app: clickhouse
+  ports:
+    - name: http
+      port: 8123
+      targetPort: 8123
+    - name: native
+      port: 9000
+      targetPort: 9000
+---
+# redis-stack-server (the app uses RedisJSON). Pre-started here — instead of the
+# Bitnami subchart — so it is Ready before the app pods start, avoiding the
+# crash-loop race while the app retries an unavailable Redis.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  labels:
+    app: redis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+        - name: redis
+          image: redis/redis-stack-server:7.4.0-v8
+          ports:
+            - containerPort: 6379
+          readinessProbe:
+            exec:
+              command: ["redis-cli", "ping"]
+            initialDelaySeconds: 3
+            periodSeconds: 3
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+spec:
+  selector:
+    app: redis
+  ports:
+    - port: 6379
+      targetPort: 6379

.github/workflows/docs-check.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Ensure documentation is updated

.github/workflows/lint-test.yaml

@@ -5,24 +5,27 @@ on: pull_request
 jobs:
   lint-test:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write   # Required for OIDC (assume the ECR pull role)
+      contents: read    # Required for checkout
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v4.2.0
+        uses: azure/setup-helm@v5.0.1
         with:
-          version: v3.17.0
+          version: v3.21.2
 
-      - uses: actions/setup-python@v5.3.0
+      - uses: actions/setup-python@v6.3.0
         with:
           python-version: '3.x'
           check-latest: true
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.7.0
+        uses: helm/chart-testing-action@v2.8.0
         with:
           yamale_version: "6.0.0"
 
@@ -38,10 +41,70 @@ jobs:
         if: steps.list-changed.outputs.changed == 'true'
         run: ct lint --check-version-increment=false --target-branch ${{ github.event.repository.default_branch }}
 
+      - name: Configure AWS credentials
+        if: steps.list-changed.outputs.changed == 'true'
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: arn:aws:iam::761136292957:role/GitHubActions-CurrentsDevDocker-ECRPull
+          aws-region: us-east-1
+
       - name: Create kind cluster
         if: steps.list-changed.outputs.changed == 'true'
-        uses: helm/kind-action@v1.12.0
+        uses: helm/kind-action@v1.14.0
+
+      # The chart expects an external MongoDB (replica set — change streams need it)
+      # and ClickHouse. Stand up throwaway ones in-cluster so `ct install` can bring
+      # the app pods to readiness. They live in the `currents-ci` namespace that
+      # `ct install --namespace` targets, reachable via cluster DNS.
+      - name: Deploy test dependencies (MongoDB + ClickHouse)
+        if: steps.list-changed.outputs.changed == 'true'
+        run: |
+          kubectl create namespace currents-ci
+          kubectl apply -n currents-ci -f .github/ci/dependencies.yaml
+          kubectl -n currents-ci rollout status deploy/mongodb --timeout=180s
+          kubectl -n currents-ci rollout status deploy/clickhouse --timeout=180s
+          kubectl -n currents-ci rollout status deploy/redis --timeout=180s
+          # Initialise the single-node replica set (|| true: idempotent on re-run)
+          kubectl -n currents-ci exec deploy/mongodb -- mongosh --quiet --eval \
+            'rs.initiate({_id:"rs0",members:[{_id:0,host:"mongodb.currents-ci.svc.cluster.local:27017"}]})' || true
+          echo "Waiting for the replica set to elect a PRIMARY..."
+          primary=false
+          for i in $(seq 1 30); do
+            if kubectl -n currents-ci exec deploy/mongodb -- mongosh --quiet --eval 'db.hello().isWritablePrimary' 2>/dev/null | grep -q true; then
+              primary=true; echo "MongoDB replica set is PRIMARY"; break
+            fi
+            echo "  attempt $i/30..."; sleep 3
+          done
+          if [ "$primary" != true ]; then
+            echo "::error::MongoDB replica set did not reach PRIMARY after 30 attempts"
+            kubectl -n currents-ci exec deploy/mongodb -- mongosh --quiet --eval 'rs.status()' || true
+            exit 1
+          fi
+
+      # The chart reads these via secretKeyRef; they must exist in the install
+      # namespace. Values are throwaway CI credentials.
+      - name: Create chart secrets
+        if: steps.list-changed.outputs.changed == 'true'
+        run: |
+          kubectl -n currents-ci create secret generic mongodb-currents-currents-user \
+            --from-literal=connectionString.standardSrv='mongodb://mongodb.currents-ci.svc.cluster.local:27017/currents?replicaSet=rs0'
+          kubectl -n currents-ci create secret generic clickhouse-currents-pass \
+            --from-literal=password=currents
+          kubectl -n currents-ci create secret generic currents-better-auth \
+            --from-literal=secret="$(openssl rand -hex 32)"
+          kubectl -n currents-ci create secret generic currents-root-user \
+            --from-literal=password="$(openssl rand -hex 16)"
+          kubectl -n currents-ci create secret generic currents-api-internal-token \
+            --from-literal=token="$(openssl rand -hex 32)"
+          kubectl -n currents-ci create secret generic currents-gitlab-key \
+            --from-literal=gitlab-key.pem="$(openssl genrsa 2048 2>/dev/null)"
+          # Short-lived ECR pull token (valid ~12h) so kind's kubelet pulls the
+          # private images directly, instead of duplicating a runner pull + kind load.
+          kubectl -n currents-ci create secret docker-registry ecr-creds \
+            --docker-server=513558712013.dkr.ecr.us-east-1.amazonaws.com \
+            --docker-username=AWS \
+            --docker-password="$(aws ecr get-login-password --region us-east-1)"
 
       - name: Run chart-testing (install)
         if: steps.list-changed.outputs.changed == 'true'
-        run: ct install --target-branch ${{ github.event.repository.default_branch }} || true
+        run: ct install --target-branch ${{ github.event.repository.default_branch }} --namespace currents-ci --helm-extra-args "--timeout 600s"

.github/workflows/release.yaml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 

.github/workflows/sync-docs.yaml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 

charts/currents/Chart.yaml

@@ -5,7 +5,7 @@ home: https://currents.dev
 type: application
 # The chart version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.6.0
+version: 0.7.0
 # Version number of the application being deployed.
 # Versions are not expected to follow Semantic Versioning. They should reflect the version the application is using.
 appVersion: "2026-01-26-001"

charts/currents/ci/lint-values.yaml

@@ -1,8 +1,55 @@
+# Values used by chart-testing for BOTH `ct lint` and the `ct install` gate.
+# The install gate (.github/workflows/lint-test.yaml) deploys MongoDB + ClickHouse
+# and creates the referenced secrets in the `currents-ci` namespace before running
+# `ct install --namespace currents-ci`, so these point at those in-cluster deps.
 currents:
+  # The API validates SMTP config exists; a dummy host is enough to boot.
+  email:
+    smtp:
+      host: localhost
+  rootUser:
+    password:
+      secretName: currents-root-user
+      key: password
+  betterAuth:
+    secretName: currents-better-auth
+    key: secret
+  apiInternalToken:
+    secretName: currents-api-internal-token
+    key: token
+  # The director validates GITLAB_STATE_SECRET is present at boot.
+  gitlab:
+    state:
+      secretName: currents-gitlab-key
+      secretKey: gitlab-key.pem
   mongoConnection:
     secretName: mongodb-currents-currents-user
     key: connectionString.standardSrv
   clickhouse:
+    host: clickhouse.currents-ci.svc.cluster.local
+    port: 8123
+    tls:
+      enabled: false
     user:
+      username: currents
       secretName: clickhouse-currents-pass
       secretPasswordKey: password
+  # Use the pre-started in-cluster Redis (see .github/ci/dependencies.yaml) rather
+  # than the Bitnami subchart, so Redis is Ready before the app pods start.
+  redis:
+    host: redis.currents-ci.svc.cluster.local
+
+# Reaches every component (all deployments append global.env); the chart only sets
+# MONGODB_URI, so name the database explicitly.
+global:
+  # kind pulls the private ECR images directly using this pre-created secret
+  # (see the "Create chart secrets" step in .github/workflows/lint-test.yaml).
+  imagePullSecrets:
+    - name: ecr-creds
+  env:
+    - name: MONGODB_DATABASE
+      value: currents
+
+# Subchart Redis disabled — we run our own (deployed and waited-for before install).
+redis:
+  enabled: false

charts/currents/templates/_common.tpl

@@ -232,4 +232,33 @@ Create the name of the service account to use
 - name: EMAIL_LINKS_BASE_URL
   value: {{ .Values.currents.email.linksBaseUrl }}
 {{- end }}
+{{- end -}}
+
+{{- define "currents.samlSSOEnv" -}}
+{{- if .Values.currents.sso.saml.enabled }}
+- name: SSO_SAML_IDP_METADATA_FILE
+  value: {{ printf "/etc/currents/sso/%s" .Values.currents.sso.saml.metadataKey | quote }}
+- name: SSO_SAML_ISSUER
+  value: {{ required "currents.sso.saml.issuer is required when currents.sso.saml.enabled is true" .Values.currents.sso.saml.issuer | quote }}
+{{- if .Values.currents.sso.saml.providerId }}
+- name: SSO_SAML_PROVIDER_ID
+  value: {{ .Values.currents.sso.saml.providerId | quote }}
+{{- end }}
+{{- if .Values.currents.sso.saml.defaultRole }}
+- name: SSO_SAML_DEFAULT_ROLE
+  value: {{ .Values.currents.sso.saml.defaultRole | quote }}
+{{- end }}
+{{- if .Values.currents.sso.saml.allowedDomains }}
+- name: SSO_ALLOWED_DOMAINS
+  value: {{ .Values.currents.sso.saml.allowedDomains | quote }}
+{{- end }}
+{{- if .Values.currents.sso.saml.authnRequestsSigned }}
+- name: SSO_SAML_AUTHN_REQUESTS_SIGNED
+  value: "true"
+- name: SSO_SAML_SP_CERT_FILE
+  value: {{ printf "/etc/currents/sso/%s" .Values.currents.sso.saml.spCertKey | quote }}
+- name: SSO_SAML_SP_KEY_FILE
+  value: {{ printf "/etc/currents/sso/%s" .Values.currents.sso.saml.spKeyKey | quote }}
+{{- end }}
+{{- end }}
 {{- end -}}