fix: skip values.yaml in ArgoCD validation and add -ignore-missing-sc… #53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Platform Validation | |
| on: | |
| push: | |
| paths: | |
| - "infra/**" | |
| - "platform/**" | |
| - "standardized-path/**" | |
| - "policy/**" | |
| - "buildspec.yaml" | |
| - ".github/workflows/platform-validate.yml" | |
| pull_request: | |
| paths: | |
| - "infra/**" | |
| - "platform/**" | |
| - "standardized-path/**" | |
| - "policy/**" | |
| - "buildspec.yaml" | |
| - ".github/workflows/platform-validate.yml" | |
| workflow_dispatch: | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| lfs: false | |
| - name: Setup Terraform | |
| uses: hashicorp/setup-terraform@v3 | |
| with: | |
| terraform_version: "1.6.6" | |
| - name: Setup Helm | |
| uses: azure/setup-helm@v4 | |
| with: | |
| version: "v3.14.4" | |
| - name: Terraform format check | |
| run: terraform -chdir=infra fmt -check -recursive | |
| - name: Terraform init | |
| run: terraform -chdir=infra init -backend=false | |
| - name: Terraform validate | |
| run: terraform -chdir=infra validate | |
| - name: Setup TFLint | |
| uses: terraform-linters/setup-tflint@v4 | |
| with: | |
| tflint_version: latest | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Run TFLint | |
| run: | | |
| cd infra | |
| tflint --init | |
| tflint --recursive | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Setup Trivy | |
| run: | | |
| wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add - | |
| echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list | |
| sudo apt-get update | |
| sudo apt-get install trivy | |
| - name: Scan Terraform with Trivy | |
| run: trivy config --severity HIGH,CRITICAL infra/ | |
| - name: Setup kubeconform | |
| run: | | |
| wget https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz | |
| tar xf kubeconform-linux-amd64.tar.gz | |
| sudo mv kubeconform /usr/local/bin/ | |
| - name: Install helm unittest plugin | |
| run: | | |
| rm -rf "${HOME}/.local/share/helm/plugins/helm-unittest.git" 2>/dev/null || true | |
| helm plugin install https://github.com/helm-unittest/helm-unittest.git --version 0.7.0 | |
| - name: Helm lint | |
| run: | | |
| helm lint standardized-path/app -f platform/apps/dev/values.yaml | |
| helm lint standardized-path/app -f platform/apps/stage/values.yaml | |
| helm lint standardized-path/app -f platform/apps/prod/values.yaml | |
| helm lint standardized-path/app -f platform/apps/app-b/dev/values.yaml | |
| helm lint standardized-path/app -f platform/apps/app-b/stage/values.yaml | |
| helm lint standardized-path/app -f platform/apps/app-b/prod/values.yaml | |
| - name: Helm unit tests | |
| run: helm unittest standardized-path/app | |
| - name: Render manifests | |
| run: | | |
| helm template simple-app-dev standardized-path/app -f platform/apps/dev/values.yaml > /tmp/simple-app-dev.yaml | |
| helm template simple-app-stage standardized-path/app -f platform/apps/stage/values.yaml > /tmp/simple-app-stage.yaml | |
| helm template simple-app-prod standardized-path/app -f platform/apps/prod/values.yaml > /tmp/simple-app-prod.yaml | |
| helm template app-b-dev standardized-path/app -f platform/apps/app-b/dev/values.yaml > /tmp/app-b-dev.yaml | |
| helm template app-b-stage standardized-path/app -f platform/apps/app-b/stage/values.yaml > /tmp/app-b-stage.yaml | |
| helm template app-b-prod standardized-path/app -f platform/apps/app-b/prod/values.yaml > /tmp/app-b-prod.yaml | |
| - name: Validate manifests with kubeconform | |
| run: | | |
| for f in /tmp/simple-app-*.yaml /tmp/app-b-*.yaml; do | |
| kubeconform -summary -ignore-missing-schemas -output json "$f" | |
| done | |
| - name: Validate Argo CD applications | |
| run: | | |
| for f in platform/apps/dev/*.yaml platform/apps/stage/*.yaml platform/apps/prod/*.yaml; do | |
| [[ "$(basename "$f")" == "values.yaml" ]] && continue | |
| kubeconform -summary -skip Application -ignore-missing-schemas "$f" | |
| done | |
| - name: Validate bootstrap manifests | |
| run: kubeconform -summary -ignore-missing-schemas platform/bootstrap/*.yaml | |
| - name: Setup conftest | |
| run: | | |
| CONFTEST_VERSION=$(curl -sL https://api.github.com/repos/open-policy-agent/conftest/releases/latest | grep tag_name | cut -d'"' -f4) | |
| wget -q "https://github.com/open-policy-agent/conftest/releases/download/${CONFTEST_VERSION}/conftest_${CONFTEST_VERSION#v}_Linux_x86_64.tar.gz" -O /tmp/conftest.tar.gz | |
| tar xzf /tmp/conftest.tar.gz -C /usr/local/bin/ conftest | |
| - name: Validate EKS manifests with OPA policies | |
| run: | | |
| helm template simple-app-dev standardized-path/app -f platform/apps/dev/values.yaml | tr -d '\r' | conftest test -p policy/eks/ --no-color - | |
| helm template simple-app-stage standardized-path/app -f platform/apps/stage/values.yaml | tr -d '\r' | conftest test -p policy/eks/ --no-color - | |
| helm template simple-app-prod standardized-path/app -f platform/apps/prod/values.yaml | tr -d '\r' | conftest test -p policy/eks/ --no-color - | |
| helm template app-b-dev standardized-path/app -f platform/apps/app-b/dev/values.yaml | tr -d '\r' | conftest test -p policy/eks/ --no-color - | |
| helm template app-b-stage standardized-path/app -f platform/apps/app-b/stage/values.yaml | tr -d '\r' | conftest test -p policy/eks/ --no-color - | |
| helm template app-b-prod standardized-path/app -f platform/apps/app-b/prod/values.yaml | tr -d '\r' | conftest test -p policy/eks/ --no-color - | |
| openshift-validate: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Helm | |
| uses: azure/setup-helm@v4 | |
| with: | |
| version: "v3.14.4" | |
| - name: Render with OpenShift flags | |
| run: | | |
| helm template test standardized-path/app \ | |
| --set openshift.enabled=true \ | |
| --set openshift.route.enabled=true \ | |
| --set ingress.enabled=false \ | |
| > /tmp/openshift.yaml | |
| - name: Verify Route is present | |
| run: | | |
| grep -q "kind: Route" /tmp/openshift.yaml && echo "PASS: Route found" || (echo "FAIL: Route missing"; exit 1) | |
| - name: Verify Ingress is absent | |
| run: | | |
| grep -q "kind: Ingress" /tmp/openshift.yaml && (echo "FAIL: Ingress should be absent"; exit 1) || echo "PASS: Ingress correctly omitted" | |
| - name: Verify securityContext is absent | |
| run: | | |
| grep -q "runAsNonRoot" /tmp/openshift.yaml && (echo "FAIL: securityContext should be absent on OpenShift"; exit 1) || echo "PASS: securityContext correctly omitted" | |
| - name: Setup conftest | |
| run: | | |
| CONFTEST_VERSION=$(curl -sL https://api.github.com/repos/open-policy-agent/conftest/releases/latest | grep tag_name | cut -d'"' -f4) | |
| wget -q "https://github.com/open-policy-agent/conftest/releases/download/${CONFTEST_VERSION}/conftest_${CONFTEST_VERSION#v}_Linux_x86_64.tar.gz" -O /tmp/conftest.tar.gz | |
| tar xzf /tmp/conftest.tar.gz -C /usr/local/bin/ conftest | |
| - name: Validate OpenShift manifests with OPA policies | |
| run: | | |
| helm template test standardized-path/app \ | |
| --set openshift.enabled=true \ | |
| --set openshift.route.enabled=true \ | |
| --set ingress.enabled=false \ | |
| | tr -d '\r' | conftest test -p policy/openshift/ --no-color - |