module/.github/workflows/validate.yml at main · GameplanePanel/module · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
name: validate modules

# Preflight-checks every modules/<name>/template.yaml against the ACTUAL
# OCI image config of the image(s) it declares, catching the bug classes
# that have shipped broken before (see validate.py's module docstring for
# the full rule list and the historical bugs each one repros). Runs on
# every PR and on pushes to main so a template change is checked before it
# ever reaches a real cluster.
#
# Network access to Docker Hub is required (the validator resolves each
# declared image's manifest + config blob anonymously). A registry that
# can't be reached is reported as a WARN by the script itself, not a hard
# failure — so a real transient network blip degrades to "couldn't
# verify", not a red build. Only a confirmed problem (missing image,
# missing spec.command, missing security.runAsUser, a mount that shadows
# the image's own launcher, ...) fails the job.

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install PyYAML
        run: pip install --disable-pip-version-check --user pyyaml

      - name: Run module preflight validator
        run: python3 validate.py

      # build.sh's --sign path only ever executes in the release/republish
      # workflows, so a mistake in the manifest-digest parser would sign the
      # wrong object in production with nothing to catch it. These tests need
      # no registry and no cosign.
      - name: Test build.sh signing preconditions
        run: ./test-build-sh.sh

      - name: Test validate.py directory layout rules
        run: ./test-validate-py.sh

      - uses: actions/setup-go@v5
        with:
          go-version: "1.26"

      - name: Check module locales
        run: |
          set -euo pipefail
          for dir in */; do
            dir="${dir%/}"
            [ -d "$dir/locales" ] || continue
            echo ">> i18n-check $dir"
            go run github.com/GameplanePanel/gameplane/i18n/cmd/i18n-check@master \
              --module "$dir/template.yaml" "$dir/locales"
          done

  devcontainer:
    strategy:
      fail-fast: false
      matrix:
        arch: [amd64, arm64]
    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
        with:
          push: never
          configFile: .devcontainer/devcontainer.json
          runCmd: bash -n build.sh && python3 -m py_compile validate.py