harness-code-integration

Harness Code Integration Skill

Manage Harness Code repositories, triggers, PR pipelines, and GitOps workflows.

Use For

• Repository setup, branch protection, PR validation pipelines
• Triggers (push, PR, tag), GitOps workflows, code policies

Repository Structure for EKS Deployments

my-app/                          # Harness Code repository
├── src/                         # Application source
├── charts/
│   └── my-service/
│       ├── Chart.yaml
│       ├── values.yaml
│       ├── values-dev.yaml
│       ├── values-staging.yaml
│       ├── values-prod.yaml
│       └── templates/
├── .harness/
│   ├── pipelines/
│   │   ├── build.yaml
│   │   ├── deploy-dev.yaml
│   │   ├── deploy-staging.yaml
│   │   └── deploy-prod.yaml
│   └── inputsets/
│       ├── dev-inputs.yaml
│       └── prod-inputs.yaml
└── keycloak/
    └── realm-export.json

Harness Code Connector

connector:
  name: Harness Code
  identifier: harness_code
  type: HarnessCode
  spec:
    authentication:
      type: Http
      spec:
        type: UsernameToken
        spec:
          username: <+secrets.getValue("harness_code_user")>
          tokenRef: harness_code_token

Triggers

Push Trigger (Main Branch)

trigger:
  name: Main Branch Push
  identifier: main_push
  enabled: true
  encryptedWebhookSecretIdentifier: ""
  description: "Deploy on push to main"
  source:
    type: Webhook
    spec:
      type: HarnessCode
      spec:
        repoName: my-app
        events:
          - Push
        actions: []
        payloadConditions:
          - key: targetBranch
            operator: Equals
            value: main
  pipelineIdentifier: deploy_pipeline
  inputSetRefs:
    - main_inputs
  stagesToExecute: []

Pull Request Trigger

trigger:
  name: PR Validation
  identifier: pr_validation
  enabled: true
  source:
    type: Webhook
    spec:
      type: HarnessCode
      spec:
        repoName: my-app
        events:
          - PullRequest
        actions:
          - Open
          - Reopen
          - Edit
          - Synchronize
        payloadConditions:
          - key: targetBranch
            operator: In
            value: main, develop
  pipelineIdentifier: pr_validation_pipeline

Tag Trigger (Release)

trigger:
  name: Release Tag
  identifier: release_tag
  enabled: true
  source:
    type: Webhook
    spec:
      type: HarnessCode
      spec:
        repoName: my-app
        events:
          - Push
        payloadConditions:
          - key: ref
            operator: StartsWith
            value: refs/tags/v
  pipelineIdentifier: release_pipeline
  inputYaml: |
    pipeline:
      identifier: release_pipeline
      variables:
        - name: version
          type: String
          value: <+trigger.payload.ref>.replace("refs/tags/", "")

PR Validation Pipeline

pipeline:
  name: PR Validation
  identifier: pr_validation_pipeline
  stages:
    - stage:
        name: Validate
        type: CI
        spec:
          cloneCodebase: true
          infrastructure:
            type: KubernetesDirect
            spec:
              connectorRef: eks_connector
              namespace: ci-runners
          execution:
            steps:
              - step:
                  type: Run
                  name: Lint Helm Chart
                  spec:
                    shell: Bash
                    command: |
                      helm lint charts/my-service
                      helm template charts/my-service --debug
              - step:
                  type: Run
                  name: Security Scan
                  spec:
                    shell: Bash
                    command: |
                      trivy config charts/my-service
                      checkov -d charts/my-service
              - step:
                  type: Run
                  name: Unit Tests
                  spec:
                    shell: Bash
                    command: npm test
              - step:
                  type: Plugin
                  name: PR Comment
                  spec:
                    connectorRef: harness_code
                    image: plugins/github-comment
                    settings:
                      message: "✅ All checks passed!"

Branch Protection Rules

Configure via Harness Code UI or API:

branchProtection:
  pattern: main
  rules:
    - requirePullRequest: true
    - requireReviews:
        count: 1
        dismissStaleReviews: true
        requireCodeOwners: true
    - requireStatusChecks:
        strict: true
        contexts:
          - "pr_validation_pipeline"
    - requireSignedCommits: false
    - restrictPushes:
        allowedUsers: []
        allowedTeams:
          - platform-team
    - restrictDeletions: true
    - requireLinearHistory: false

GitOps Integration (ArgoCD via Harness)

Update Release Repo

- step:
    type: GitOpsUpdateReleaseRepo
    name: Update GitOps Repo
    identifier: update_gitops
    spec:
      connectorRef: harness_code
      repoName: gitops-config
      filePath: apps/<+service.name>/<+env.name>/values.yaml
      fileContent: |
        image:
          repository: <+artifact.image>
          tag: <+artifact.tag>
        keycloak:
          clientId: <+service.name>-client

GitOps Sync

- step:
    type: GitOpsSync
    name: Sync Application
    identifier: gitops_sync
    spec:
      applicationIdentifier: <+service.name>-<+env.name>
      prune: true
      dryRun: false

Manifest Sources from Harness Code

Helm Chart from Repo

manifests:
  - manifest:
      identifier: main_chart
      type: HelmChart
      spec:
        store:
          type: HarnessCode
          spec:
            repoName: my-app
            branch: <+pipeline.variables.branch>
            folderPath: charts/my-service
        chartName: my-service
        helmVersion: V3

Values Override

manifests:
  - manifest:
      identifier: values_override
      type: Values
      spec:
        store:
          type: HarnessCode
          spec:
            repoName: my-app
            branch: main
            paths:
              - charts/my-service/values-<+env.name>.yaml

Kustomize from Repo

manifests:
  - manifest:
      identifier: kustomize
      type: Kustomize
      spec:
        store:
          type: HarnessCode
          spec:
            repoName: my-app
            branch: main
            folderPath: k8s/overlays/<+env.name>

Code Quality Gates

- step:
    type: Run
    name: Quality Gate
    spec:
      shell: Bash
      command: |
        # Helm lint
        helm lint charts/my-service --strict

        # Security scan
        trivy config charts/my-service --severity HIGH,CRITICAL --exit-code 1

        # Keycloak realm validation
        if [ -f keycloak/realm-export.json ]; then
          jq -e '.realm' keycloak/realm-export.json > /dev/null
        fi
      envVariables:
        TRIVY_SEVERITY: HIGH,CRITICAL

Expressions for Harness Code

Expression	Purpose
<+trigger.payload.repository.name>	Repository name
<+trigger.payload.ref>	Git reference (branch/tag)
<+trigger.payload.pullRequest.number>	PR number
<+trigger.payload.pullRequest.sourceBranch>	PR source branch
<+trigger.payload.pullRequest.targetBranch>	PR target branch
<+trigger.payload.sender.login>	User who triggered
<+codebase.commitSha>	Full commit SHA
<+codebase.shortCommitSha>	Short commit SHA
<+codebase.branch>	Branch name
<+codebase.tag>	Tag name (if tagged)

Webhook Payload Examples

Push Event

{
  "ref": "refs/heads/main",
  "before": "abc123",
  "after": "def456",
  "repository": {
    "name": "my-app",
    "full_name": "org/my-app"
  },
  "commits": [
    {
      "id": "def456",
      "message": "feat: add new endpoint",
      "author": { "name": "Developer" }
    }
  ]
}

Pull Request Event

{
  "action": "opened",
  "number": 42,
  "pullRequest": {
    "title": "Add Keycloak integration",
    "sourceBranch": "feature/keycloak",
    "targetBranch": "main",
    "state": "open"
  }
}

Troubleshooting

Issue	Solution
Trigger not firing	Check webhook configuration, verify event type
Clone failed	Verify connector credentials, check repo access
Branch not found	Confirm branch exists, check payload conditions
PR comment failed	Verify connector has write permissions
GitOps sync timeout	Check ArgoCD health, verify manifest validity

References

• Harness Code Triggers
• GitOps with Harness