run_b12aa791c60b89ba

input

{
  "request": "Triage Jira ticket MZCLD-3821: evaulate_helm_chart_automerge fails when a chart has no per-environment values files",
  "references": [
    "https://mozilla-hub.atlassian.net/browse/MZCLD-3821"
  ],
  "sourceContext": {
    "issue": "MZCLD-3821"
  }
}

summary

MZCLD-3821 is a well-documented, self-contained bug report describing a real failure mode in the `evaulate_helm_chart_automerge` job of `.github/workflows/diff-rendered-charts.yml`. The reporter has already root-caused the issue, confirmed it against GNU findutils 4.9.0 (matching the CI runner image), identified two concrete trigger scenarios, and proposed a one-line fix that mirrors an existing fix in the sibling `diff_helm_charts` job (from MZCLD-3077). The ticket is currently in Backlog with no comments. Triage recommendation: accept as a confirmed, low-risk, well-scoped bug fix and prioritize it, since it currently causes false-negative CI failures that block Dependabot automerge on affected charts.

findings

• Root cause is a missing `-r`/`--no-run-if-empty` flag on an `xargs --null basename -a` call in the structured-diff step of the automerge workflow.
• Because the step runs under `set -euo pipefail`, the spurious basename failure aborts the entire CI job instead of producing an empty config list.
• Two realistic triggers identified: (1) a chart with only values.yaml and no per-environment values files, since the render step's values_files lookup excludes values.yaml/values.yml, so no config directories are ever created; (2) a path-filter match on a directory that isn't a chart root, because get_changed_helm_charts derives the chart path via `cut -d'/' -f1,2,3` and the render step only fires if Chart.yaml exists at that path.
• This is not merely a workflow bug but has a real product/user impact: it produces a failing `conftest test` commit status on Dependabot PRs, which blocks automerge — the very feature the job exists to support.
• The fix is well precedented: the equivalent `diff_helm_charts` job already includes the `-r` flag, added under MZCLD-3077. The reporter deliberately excluded the automerge path from that earlier fix to keep it untouched, and is now proposing to bring both jobs into alignment.
• Reporter flags a secondary, open design question worth resolving alongside the fix: whether a chart that renders nothing should be skipped outright rather than diffed as two empty manifests (which conftest would pass trivially, masking the underlying no-op).
• Attempted to pull related ticket MZCLD-3077 for corroborating context but access was blocked by policy (read blocked by policy: resource not in run subject); no Confluence runbook/design doc was referenced in this ticket, so no additional external context was retrievable.

proposed actions

tool calls

[
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "MZCLD-3821"
    },
    "result": {
      "key": "MZCLD-3821",
      "summary": "evaulate_helm_chart_automerge fails when a chart has no per-environment values files",
      "status": "Backlog",
      "description_text": "Problem The  structured diff  step of  evaulate_helm_chart_automerge  in  .github/workflows/diff-rendered-charts.yml  builds its config list with: CONFIGS=`find \"shared/base-charts/${chart}\" \"shared/head-charts/${chart}\" -mindepth 1 -maxdepth 1 -type d -print0 | xargs --null basename -a | sort | uniq` xargs  is missing  -r  ( --no-run-if-empty ). GNU xargs runs the command once even when its input is empty, so when  find  matches no directories this invokes  basename -a  with no operands. Confirmed against GNU findutils 4.9.0 on  ubuntu:24.04 , matching the runner image: $ printf '' | xargs --null basename -a\nbasename: missing operand\nexit=123 The step runs under  set -euo pipefail , so this fails the whole job rather than yielding an empty config list. Trigger find  returns nothing whenever  render_charts  produced no config directories for a chart, because the automerge job creates the chart directories itself with  mkdir -p  just beforehand. Two realistic ways to get there: A chart with only a  values.yaml  and no per-environment values files. The render step's  values_files  lookup explicitly excludes  values.yaml / values.yml , so the render loop body never executes and no  <config>  directory is ever created. A path-filter match on a directory that is not a chart root.   get_changed_helm_charts  derives the chart path with  cut -d'/' -f1,2,3 , and the render step is guarded by  if [ -f \"${MATRIX_CHART}/Chart.yaml\" ] . A changed file whose first three path components do not contain a  Chart.yaml  yields a \"chart\" that renders nothing. Because the job is gated on  inputs.automerge_test , this surfaces as a failing  conftest test  commit status on Dependabot PRs, which blocks automerge. Fix Add  -r  to the  xargs  call. The equivalent line in the  diff_helm_charts  job already carries it (added in MZCLD-3077), so this brings the two into line. Worth checking at the same time whether a chart that renders nothing should be skipped outright rather than compared as two empty manifests, since the latter produces an empty diff that conftest will pass. Notes Found while implementing MZCLD-3077. Deliberately left out of that change to keep the automerge path untouched, since it gates Dependabot automerge via  helm-ci.yaml  in webservices-infra.",
      "comment_count": 0,
      "comments": []
    }
  },
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "MZCLD-3077"
    },
    "result": {
      "error": "read blocked by policy: resource not in run subject",
      "args": {
        "key": "MZCLD-3077"
      }
    },
    "blocked": true
  }
]

log