validate.yaml

name: Validate

on:
  # Validate on push for Renovate auto merge without PR
  push:
    branches:
      - 'main'
      - 'renovate/**'
  pull_request:

jobs:
  validate:
    runs-on: ubuntu-latest
    # Exclude duplicate execution for PRs from renovate branches
    if: ${{ !(github.event_name == 'pull_request' && startsWith(github.event.pull_request.head.ref, 'renovate/')) }}
    steps:
      - uses: actions/checkout@v4

      # https://stackoverflow.com/a/73596568
      - name: Setup to skip ksops decryption
        run: sudo ln -s /bin/true /usr/local/bin/ksops

      - name: Cache CRDs
        id: crd
        uses: actions/cache@v4
        with:
          path: .crd
          key: crd-${{ hashFiles('./setup-crd.sh') }}
      - name: Prepare CRDs
        if: steps.crd.outputs.cache-hit != 'true'
        run: ./setup-crd.sh

      - name: Install kubeconform
        run: |
          # renovate:github-url
          wget https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz
          tar -zxvf kubeconform-linux-amd64.tar.gz kubeconform
          sudo install kubeconform /usr/local/bin && rm kubeconform kubeconform-linux-amd64.tar.gz

      - name: Build
        run: ./build.sh
      - name: Validate
        run: |
          for file in .built/*.yaml; do
            echo "Validating $file"
            <"$file" ./check.sh
          done