Story Crater Bot
f8b19d9f55
Use CI_RUNNER and CI_RUNNER_SECRET for repo clone authentication. Embed credentials in git clone URL: https://user:token@host/repo.git Removes dependency on GITHUB_TOKEN (GitHub-specific) and improves Forgejo compatibility.
117 lines
4.0 KiB
YAML
117 lines
4.0 KiB
YAML
name: Validate Kubernetes Manifests
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- develop
|
|
paths:
|
|
- 'k8s/**'
|
|
- '.forgejo/workflows/validate-k8s.yaml'
|
|
pull_request:
|
|
paths:
|
|
- 'k8s/**'
|
|
- '.forgejo/workflows/validate-k8s.yaml'
|
|
|
|
jobs:
|
|
validate:
|
|
runs-on: docker
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
CLONE_URL="https://${{ secrets.CI_RUNNER }}:${{ secrets.CI_RUNNER_SECRET }}@${{ gitea.repository_clone_url | replace 'https://', '' }}"
|
|
git clone --depth 1 "$CLONE_URL" .
|
|
git fetch origin ${{ gitea.ref }}:current-branch
|
|
git checkout current-branch
|
|
|
|
- name: Install Tools
|
|
run: |
|
|
apt-get update && apt-get install -y \
|
|
yamllint \
|
|
python3-pip \
|
|
curl \
|
|
jq
|
|
|
|
# Install kubeval
|
|
curl -L https://github.com/instrumenta/kubeval/releases/latest/download/kubeval-linux-amd64.tar.gz | tar xz
|
|
mv -f kubeval /usr/local/bin/
|
|
|
|
# Install kustomize (remove old if exists)
|
|
rm -f kustomize
|
|
curl -s https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh | bash
|
|
mv -f kustomize /usr/local/bin/
|
|
|
|
# Install ArgoCD CLI
|
|
curl -sSL -o /usr/local/bin/argocd https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64
|
|
chmod +x /usr/local/bin/argocd
|
|
|
|
- name: YAML Lint
|
|
run: |
|
|
echo "=== Linting YAML files ==="
|
|
yamllint k8s/ -c .yamllint.yaml || true
|
|
|
|
- name: Kubeval - Validate K8s Syntax
|
|
run: |
|
|
echo "=== Validating Kubernetes manifests ==="
|
|
find k8s -name "*.yaml" -o -name "*.yml" | grep -v "\.archive" | while read file; do
|
|
echo "Validating $file..."
|
|
kubeval "$file" -d 2>/dev/null || true
|
|
done
|
|
|
|
- name: Kustomize Build - Infrastructure
|
|
run: |
|
|
echo "=== Building k8s/infrastructure/ ==="
|
|
kustomize build k8s/infrastructure > /tmp/infrastructure.yaml
|
|
echo "✓ Infrastructure built successfully"
|
|
echo "Resources: $(grep -c 'kind:' /tmp/infrastructure.yaml)"
|
|
|
|
- name: Kustomize Build - Bootstrap
|
|
run: |
|
|
echo "=== Building k8s/bootstrap/ ==="
|
|
kustomize build k8s/bootstrap > /tmp/bootstrap.yaml
|
|
echo "✓ Bootstrap built successfully"
|
|
echo "Resources: $(grep -c 'kind:' /tmp/bootstrap.yaml || echo 0)"
|
|
|
|
- name: Kustomize Build - Platform
|
|
run: |
|
|
echo "=== Building k8s/platform/ ==="
|
|
kustomize build k8s/platform > /tmp/platform.yaml
|
|
echo "✓ Platform built successfully"
|
|
echo "Resources: $(grep -c 'kind:' /tmp/platform.yaml || echo 0)"
|
|
|
|
- name: Kustomize Build - Security
|
|
run: |
|
|
echo "=== Building k8s/security/ ==="
|
|
kustomize build k8s/security > /tmp/security.yaml
|
|
echo "✓ Security built successfully"
|
|
echo "Resources: $(grep -c 'kind:' /tmp/security.yaml || echo 0)"
|
|
|
|
- name: Kustomize Build - Applications
|
|
run: |
|
|
echo "=== Building k8s/applications/ ==="
|
|
kustomize build k8s/applications > /tmp/applications.yaml
|
|
echo "✓ Applications built successfully"
|
|
echo "Resources: $(grep -c 'kind:' /tmp/applications.yaml || echo 0)"
|
|
|
|
- name: Kustomize Build - Data
|
|
run: |
|
|
echo "=== Building k8s/data/ ==="
|
|
kustomize build k8s/data > /tmp/data.yaml
|
|
echo "✓ Data built successfully"
|
|
echo "Resources: $(grep -c 'kind:' /tmp/data.yaml || echo 0)"
|
|
|
|
- name: Validate ArgoCD Applications
|
|
run: |
|
|
echo "=== Validating ArgoCD Applications ==="
|
|
kubeval k8s/argocd/apps/*.yaml
|
|
|
|
- name: Summary
|
|
if: always()
|
|
run: |
|
|
echo "=== Validation Summary ==="
|
|
echo "✓ All manifests validated"
|
|
echo "✓ All kustomizations built"
|
|
echo "✓ All ArgoCD apps valid"
|
|
echo ""
|
|
echo "Next: Push to main → ArgoCD syncs automatically"
|