Nik Afiq
7435b7583f
Stage 9 of REFACTOR_PLAN.md. - New .gitea/workflows/validate.yaml: runs yamllint/ansible-lint/ ansible-playbook --syntax-check/kubeconform on push and PR via the self-hosted act_runner. Read-only lint pass, no cluster access, no apply/deploy step. This is a new automation surface -- review before relying on it; it only takes effect once pushed and the runner picks it up. - Widen secrets-leak-scanner.md's stated scope to explicitly cover config/** -- the Dashy API key (finding #4) slipped through previously because the scanner's description read as manifests/Ansible/Helm-values-centric and didn't call out app config directories. - Add a "Validation commands" section to CLAUDE.md with the exact yamllint/ansible-lint/kubeconform invocations, so future sessions run them before claiming a change is done instead of just asserting success. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
45 lines
1.4 KiB
YAML
45 lines
1.4 KiB
YAML
# Config for: Gitea Actions CI
|
|
# Applied by: the self-hosted act_runner (ansible/roles/gitea-runner) on push
|
|
# Description: Read-only lint/validate pass -- no cluster access, no apply/deploy.
|
|
name: validate
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
|
|
jobs:
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install validation tools
|
|
run: |
|
|
pip install yamllint ansible-lint
|
|
curl -L https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz \
|
|
| tar xz kubeconform
|
|
sudo mv kubeconform /usr/local/bin/
|
|
|
|
- name: yamllint
|
|
run: yamllint -c .yamllint.yml .
|
|
|
|
- name: ansible-lint
|
|
run: |
|
|
ansible-galaxy collection install -r ansible/requirements.yml
|
|
ansible-lint ansible/
|
|
|
|
- name: ansible-playbook --syntax-check
|
|
run: |
|
|
for pb in ansible/playbooks/*.yaml; do
|
|
ansible-playbook --syntax-check -i ansible/inventory.yaml "$pb"
|
|
done
|
|
|
|
- name: kubeconform
|
|
run: |
|
|
kubeconform -summary -ignore-missing-schemas -kubernetes-version 1.32.0 \
|
|
-schema-location default \
|
|
-schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
|
|
$(find manifests -name "*.yaml" -not -name "*-sealed.yaml") argocd/apps/*.yaml
|