ci.yml

name: CI

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

permissions:
  contents: read

jobs:
  yamllint:
    name: YAML lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - run: pip install yamllint --quiet
      - run: yamllint -c .yamllint.yml .

  secrets:
    name: Secrets detection
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Install gitleaks
        run: |
          GITLEAKS_VERSION=$(curl -sf https://api.github.com/repos/gitleaks/gitleaks/releases/latest \
            | grep '"tag_name"' | cut -d'"' -f4)
          if [[ -z "$GITLEAKS_VERSION" ]]; then
            echo "ERROR: failed to resolve gitleaks version" >&2
            exit 1
          fi

          archive="$(mktemp)"
          trap 'rm -f "$archive"' EXIT
          url="https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_linux_x64.tar.gz"
          for attempt in 1 2 3; do
            if curl -sfL "$url" -o "$archive" && tar -tzf "$archive" >/dev/null 2>&1; then
              tar -xzf "$archive" -C /usr/local/bin gitleaks
              exit 0
            fi
            echo "Gitleaks archive download was incomplete (attempt ${attempt}/3)" >&2
            rm -f "$archive"
            sleep "$attempt"
          done
          echo "ERROR: failed to download a valid gitleaks archive" >&2
          exit 1
      - name: Detect secrets
        run: gitleaks detect --config .gitleaks.toml --source . --redact

  validate:
    name: Manifest validation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Helm
        uses: azure/setup-helm@v4
        with:
          version: "3.17.0"

      - name: Install kubeconform
        run: |
          version="0.8.0"
          checksum="9bc2bffbf71f261128533edaf912153948b7ff238f9a531ae6d34466ec287883"
          archive="$(mktemp)"
          trap 'rm -f "$archive"' EXIT
          curl -fsSL "https://github.com/yannh/kubeconform/releases/download/v${version}/kubeconform-linux-amd64.tar.gz" \
            -o "$archive"
          printf '%s  %s\n' "$checksum" "$archive" | sha256sum --check --status
          tar -xzf "$archive" -C /usr/local/bin kubeconform

      - name: Render and schema-check manifests
        run: |
          pip install pyyaml --quiet
          python3 scripts/validate.py

      - name: Check for version drift against versions.yaml
        run: |
          python3 scripts/check-version-drift.py --selftest
          python3 scripts/check-version-drift.py

  pluto:
    name: API deprecation check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Read target Kubernetes version
        id: k8s
        run: |
          # Desired version, from versions.yaml — NOT talos-image.yaml, which
          # is the build ledger and records what was last built. Reading the
          # ledger here checked deprecations against a version no cluster runs.
          K8S_VERSION=$(grep '^kubernetes:' omni/versions.yaml | awk '{print $2}')
          if [[ -z "$K8S_VERSION" ]]; then
            echo "ERROR: no kubernetes pin in omni/versions.yaml" >&2
            exit 1
          fi
          echo "version=${K8S_VERSION}" >> "$GITHUB_OUTPUT"
          echo "Checking against Kubernetes ${K8S_VERSION}"

      - name: Install pluto
        run: |
          PLUTO_VERSION=$(curl -sf https://api.github.com/repos/FairwindsOps/pluto/releases/latest \
            | grep '"tag_name"' | cut -d'"' -f4)
          if [[ -z "$PLUTO_VERSION" ]]; then
            echo "ERROR: failed to resolve pluto version" >&2
            exit 1
          fi
          curl -sfL "https://github.com/FairwindsOps/pluto/releases/download/${PLUTO_VERSION}/pluto_${PLUTO_VERSION#v}_linux_amd64.tar.gz" \
            | tar -xz -C /usr/local/bin pluto

      - name: Check for deprecated APIs
        run: |
          pluto detect-files \
            --directory . \
            --target-versions "k8s=${{ steps.k8s.outputs.version }}" \
            --ignore-deprecations \
            --output wide

  markdownlint:
    name: Markdown lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
      - run: npm install -g markdownlint-cli2
      - run: markdownlint-cli2 "**/*.md" "#node_modules"