# Config for: Gitea Actions CI
# Applied by: the self-hosted act_runner (ansible/roles/gitea-runner) on push
# Description: Read-only lint/validate pass -- no cluster access, no apply/deploy.
name: validate

on:
  push:
    branches:
      - main
  pull_request:

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install validation tools
        run: |
          pip install yamllint ansible-lint
          curl -L https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz \
            | tar xz kubeconform
          sudo mv kubeconform /usr/local/bin/

      - name: yamllint
        run: yamllint -c .yamllint.yml .

      - name: ansible-lint
        run: |
          ansible-galaxy collection install -r ansible/requirements.yml
          ansible-lint ansible/

      - name: ansible-playbook --syntax-check
        run: |
          for pb in ansible/playbooks/*.yaml; do
            ansible-playbook --syntax-check -i ansible/inventory.yaml "$pb"
          done

      - name: kubeconform
        run: |
          kubeconform -summary -ignore-missing-schemas -kubernetes-version 1.32.0 \
            -schema-location default \
            -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
            $(find manifests -name "*.yaml" -not -name "*-sealed.yaml") argocd/apps/*.yaml