Auto-PR: docs(rulesets): update ADR-004 for 2-rule structure, CONTRIBUTING.md signing options, CHANGELOG entry #36
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Code Validation & Security | |
| on: | |
| pull_request: | |
| branches: [main, maintenance] | |
| push: | |
| branches: [main, maintenance] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| security-events: write | |
| jobs: | |
| lint: | |
| name: Lint & Syntax Validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install pre-commit | |
| run: pip install pre-commit | |
| - name: Run pre-commit | |
| run: pre-commit run --all-files | |
| - name: YAML Lint | |
| uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3.1.1 | |
| with: | |
| file_or_dir: . | |
| config_file: .yamllint.yml | |
| - name: Helm Lint | |
| run: | | |
| for chart in */helm; do | |
| echo "Validating $chart" | |
| helm lint "$chart" 2>&1 | tee helm-lint.log | |
| if grep -q "ERROR" helm-lint.log; then | |
| echo "::error::Helm lint failed for $chart" | |
| exit 1 | |
| fi | |
| done | |
| - name: Shell Script Lint | |
| uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # v2.0.0 | |
| with: | |
| scandir: '.' | |
| severity: error | |
| security: | |
| name: Security Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Secret Detection (Gitleaks) | |
| run: | | |
| curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.18.4/gitleaks_8.18.4_linux_x64.tar.gz | tar xz -C /usr/local/bin gitleaks | |
| gitleaks detect --source . --redact --no-git -v | |
| - name: Trivy Config Scan | |
| uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # v0.24.0 | |
| continue-on-error: true # report only; findings reviewed via Security tab SARIF upload | |
| with: | |
| scan-type: 'config' | |
| scan-ref: '.' | |
| format: 'sarif' | |
| output: 'trivy-config.sarif' | |
| severity: 'HIGH,CRITICAL' | |
| exit-code: '1' | |
| - name: Upload Trivy Results | |
| uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-config.sarif' | |
| kubernetes: | |
| name: Kubernetes Validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Helm Template Validation | |
| run: | | |
| for chart in */helm; do | |
| echo "Validating $chart" | |
| helm template test "./$chart" --debug | |
| done | |
| - name: Kubeconform Validation | |
| run: | | |
| curl -sSL https://github.com/yannh/kubeconform/releases/download/v0.7.0/kubeconform-linux-amd64.tar.gz | tar xz -C /usr/local/bin kubeconform | |
| for chart in */helm; do | |
| echo "Validating $chart" | |
| helm template test "./$chart" | kubeconform -strict -summary -ignore-missing-schemas - | |
| done | |
| compliance: | |
| name: Compliance Validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: SOC2 Checklist Validation | |
| run: | | |
| # 1. NetworkPolicy exists | |
| if ! find . -name "networkpolicy.yaml" -o -name "network-policy.yaml" | grep -q .; then | |
| echo "::error::Missing NetworkPolicy - SOC2 requirement" | |
| exit 1 | |
| fi | |
| # 2. No hardcoded secrets (basic check) | |
| # Exclusions (case-insensitive): | |
| # placeholder/PLACEHOLDER – intentional sentinel values in values.yaml | |
| # example/sample – documentation / example files | |
| # valueFrom/secretKeyRef/envFrom – proper K8s secret references | |
| # b64enc / {{ – Helm template expressions in secrets.yaml | |
| # \$ – shell env-var references (e.g. $MARIADB_PASSWORD) | |
| # "" – empty-string sentinels (auto-generated at deploy time) | |
| if grep -RInE '^[[:space:]]*[^#]*password[^:]*[:=][[:space:]]*[^[:space:]#]+' --include="*.yaml" --include="*.yml" . | grep -Eiv 'valueFrom|secretKeyRef|envFrom:|example|sample|placeholder|b64enc|\$|\{\{|""'; then | |
| echo "::error::Hardcoded secrets detected - SOC2 violation" | |
| exit 1 | |
| fi | |
| # 3. RBAC configured | |
| if ! find . \( -name "rbac.yaml" -o -name "role.yaml" -o -name "rolebinding.yaml" \) | grep -q .; then | |
| echo "::error::Missing RBAC - SOC2 requirement" | |
| exit 1 | |
| fi | |
| documentation: | |
| name: Documentation Validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Check Required Files | |
| run: | | |
| required_files=( | |
| "README.md" | |
| "CHANGELOG.md" | |
| ) | |
| for file in "${required_files[@]}"; do | |
| if [ ! -f "$file" ]; then | |
| echo "::error::Missing required file: $file" | |
| exit 1 | |
| fi | |
| done | |
| - name: Markdown Lint | |
| uses: nosborn/github-action-markdown-cli@9b5e871c11cc0649c5ac2526af22e23525fa344d # v3.3.0 | |
| with: | |
| files: . | |
| config_file: .markdownlint.json | |
| - name: Version Consistency Check | |
| run: | | |
| shopt -s nullglob | |
| chart_files=( */helm/Chart.yaml ) | |
| if [ ${#chart_files[@]} -eq 0 ]; then | |
| echo "No Chart.yaml files found, skipping version check." | |
| exit 0 | |
| fi | |
| failed=0 | |
| for chart_file in "${chart_files[@]}"; do | |
| chart_dir=$(dirname "$chart_file") | |
| service_dir=$(dirname "$chart_dir") | |
| changelog_file="$service_dir/CHANGELOG.md" | |
| if [ ! -f "$changelog_file" ]; then | |
| echo "::error::Missing CHANGELOG.md for $chart_file" | |
| failed=1 | |
| continue | |
| fi | |
| chart_version=$(grep "^version:" "$chart_file" | awk '{print $2}' | head -1) | |
| if [ -z "$chart_version" ]; then | |
| echo "::error::Unable to determine version from $chart_file" | |
| failed=1 | |
| continue | |
| fi | |
| if ! grep -qi "$chart_version" "$changelog_file"; then | |
| echo "::error::Chart version $chart_version not documented in $changelog_file" | |
| failed=1 | |
| fi | |
| done | |
| if [ "$failed" -ne 0 ]; then | |
| exit 1 | |
| fi | |
| versioning: | |
| name: WeOwnVer Validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Validate WeOwnVer Format | |
| run: | | |
| # Extract version from Chart.yaml | |
| version=$(grep "^version:" */helm/Chart.yaml | head -1 | awk '{print $2}') | |
| # Validate format: SEASON.WEEK[.DAY[.VERSION]] | |
| if ! echo "$version" | grep -Eq '^[0-9]+\.[0-9]+(\.[0-9]+)?(\.[0-9]+)?$'; then | |
| echo "::error::Invalid WeOwnVer format: $version" | |
| echo "Expected: SEASON.WEEK[.DAY[.VERSION]]" | |
| exit 1 | |
| fi | |
| # Validate season/week/day ranges | |
| season=$(echo "$version" | cut -d. -f1) | |
| week=$(echo "$version" | cut -d. -f2) | |
| day=$(echo "$version" | cut -d. -f3) | |
| if [ "$season" -lt 1 ] || [ "$season" -gt 9999 ]; then | |
| echo "::error::Season $season out of range (1-9999)" | |
| exit 1 | |
| fi | |
| if [ "$week" -lt 1 ] || [ "$week" -gt 17 ]; then | |
| echo "::error::Week $week out of range (1-17)" | |
| exit 1 | |
| fi | |
| if [ -n "$day" ]; then | |
| if [ "$day" -lt 0 ] || [ "$day" -gt 7 ]; then | |
| echo "::error::Day $day out of range (0-7)" | |
| exit 1 | |
| fi | |
| fi | |
| version_num=$(echo "$version" | cut -d. -f4) | |
| if [ -n "$version_num" ] && [ "$version_num" -lt 0 ]; then | |
| echo "::error::Version $version_num out of range (0+)" | |
| exit 1 | |
| fi | |
| summary: | |
| name: Validation Summary | |
| runs-on: ubuntu-latest | |
| needs: [lint, security, kubernetes, compliance, documentation, versioning] | |
| if: always() | |
| steps: | |
| - name: Generate Summary | |
| run: | | |
| echo "## Validation Results" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY | |
| echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY | |
| echo "| Lint | \`${{ needs.lint.result }}\` |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Security | \`${{ needs.security.result }}\` |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Kubernetes | \`${{ needs.kubernetes.result }}\` |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Compliance | \`${{ needs.compliance.result }}\` |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Documentation | \`${{ needs.documentation.result }}\` |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Versioning | \`${{ needs.versioning.result }}\` |" >> $GITHUB_STEP_SUMMARY |