boringstack/.github/workflows/infra-k3s-validate.yml at 74d655ae535a016a5f66de70eb9f0cecd6e71fd9 · boringstack-xyz/boringstack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
name: validate

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: infra-k3s-validate-${{ github.ref }}
  cancel-in-progress: true

jobs:
  validate:
    name: kustomize build
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Detect relevant changes
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        id: filter
        with:
          filters: |
            code:
              - 'infra/k3s/**'
              - '.github/workflows/infra-k3s-validate.yml'

      - name: Install kubectl (bundles kustomize)
        if: steps.filter.outputs.code == 'true'
        uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0

      # `kubectl kustomize` renders base + prod overlay offline. Catches the
      # realistic breakage: bad resource refs, malformed YAML, broken patches,
      # and the swappable secrets component wiring. CRDs (CNPG, Traefik,
      # cert-manager, VSO, ServiceMonitor) need no schema here; render is enough.
      - name: Build base
        if: steps.filter.outputs.code == 'true'
        run: kubectl kustomize infra/k3s/base > /dev/null

      - name: Build prod overlay
        if: steps.filter.outputs.code == 'true'
        run: kubectl kustomize infra/k3s/overlays/prod > /dev/null

      # The alternative secrets backends must also stay renderable. `plain`
      # needs a secret.env (gitignored), so seed a throwaway one for the check.
      - name: Build sealed secrets component
        if: steps.filter.outputs.code == 'true'
        run: kubectl kustomize infra/k3s/overlays/prod/secrets/sealed > /dev/null

      - name: Build plain secrets component
        if: steps.filter.outputs.code == 'true'
        run: |
          set -euo pipefail
          printf 'JWT_SECRET=x\nVALKEY_PASSWORD=x\n' > infra/k3s/overlays/prod/secrets/plain/secret.env
          trap 'rm -f infra/k3s/overlays/prod/secrets/plain/secret.env' EXIT
          kubectl kustomize infra/k3s/overlays/prod/secrets/plain > /dev/null