feat(anythingllm-docker): rebuild INT-S004 (s004.ccc.bot), re-rendered from template + Infisical bootstrap + fail-loud JWT guard #155
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Code Validation & Security | |
| on: | |
| pull_request: | |
| branches: [main, maintenance] | |
| push: | |
| branches: [main, maintenance] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| security-events: write | |
| jobs: | |
| lint: | |
| name: Lint & Syntax Validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install pre-commit | |
| run: pip install pre-commit | |
| - name: Run pre-commit | |
| run: pre-commit run --all-files | |
| - name: YAML Lint | |
| uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3.1.1 | |
| with: | |
| file_or_dir: . | |
| config_file: .yamllint.yml | |
| - name: Helm Lint | |
| run: | | |
| for chart in */helm; do | |
| echo "Validating $chart" | |
| helm lint "$chart" 2>&1 | tee helm-lint.log | |
| if grep -q "ERROR" helm-lint.log; then | |
| echo "::error::Helm lint failed for $chart" | |
| exit 1 | |
| fi | |
| done | |
| - name: Shell Script Lint | |
| uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # v2.0.0 | |
| with: | |
| scandir: '.' | |
| severity: error | |
| security: | |
| name: Security Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Secret Detection (Gitleaks) | |
| run: | | |
| curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.18.4/gitleaks_8.18.4_linux_x64.tar.gz | tar xz -C /usr/local/bin gitleaks | |
| gitleaks detect --source . --redact --no-git -v | |
| - name: Trivy Config Scan | |
| uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # v0.24.0 | |
| continue-on-error: true # report only; findings reviewed via Security tab SARIF upload | |
| with: | |
| scan-type: 'config' | |
| scan-ref: '.' | |
| format: 'sarif' | |
| output: 'trivy-config.sarif' | |
| severity: 'HIGH,CRITICAL' | |
| exit-code: '1' | |
| - name: Upload Trivy Results | |
| uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-config.sarif' | |
| kubernetes: | |
| name: Kubernetes Validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Helm Template Validation | |
| run: | | |
| for chart in */helm; do | |
| echo "Validating $chart" | |
| helm template test "./$chart" --debug | |
| done | |
| - name: Kubeconform Validation | |
| run: | | |
| curl -sSL https://github.com/yannh/kubeconform/releases/download/v0.7.0/kubeconform-linux-amd64.tar.gz | tar xz -C /usr/local/bin kubeconform | |
| for chart in */helm; do | |
| echo "Validating $chart" | |
| helm template test "./$chart" | kubeconform -strict -summary -ignore-missing-schemas - | |
| done | |
| compliance: | |
| name: Compliance Validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: SOC2 Checklist Validation | |
| run: | | |
| # 1. NetworkPolicy exists | |
| if ! find . -name "networkpolicy.yaml" -o -name "network-policy.yaml" | grep -q .; then | |
| echo "::error::Missing NetworkPolicy - SOC2 requirement" | |
| exit 1 | |
| fi | |
| # 2. No hardcoded secrets (basic check) | |
| # Exclusions (case-insensitive): | |
| # placeholder/PLACEHOLDER – intentional sentinel values in values.yaml | |
| # example/sample – documentation / example files | |
| # valueFrom/secretKeyRef/envFrom – proper K8s secret references | |
| # b64enc / {{ – Helm template expressions in secrets.yaml | |
| # \$ – shell env-var references (e.g. $MARIADB_PASSWORD) | |
| # "" – empty-string sentinels (auto-generated at deploy time) | |
| if grep -RInE '^[[:space:]]*[^#]*password[^:]*[:=][[:space:]]*[^[:space:]#]+' --include="*.yaml" --include="*.yml" . | grep -Eiv 'valueFrom|secretKeyRef|envFrom:|example|sample|placeholder|b64enc|\$|\{\{|""'; then | |
| echo "::error::Hardcoded secrets detected - SOC2 violation" | |
| exit 1 | |
| fi | |
| # 3. RBAC configured | |
| if ! find . \( -name "rbac.yaml" -o -name "role.yaml" -o -name "rolebinding.yaml" \) | grep -q .; then | |
| echo "::error::Missing RBAC - SOC2 requirement" | |
| exit 1 | |
| fi | |
| documentation: | |
| name: Documentation Validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Check Required Files | |
| run: | | |
| required_files=( | |
| "README.md" | |
| "CHANGELOG.md" | |
| ) | |
| for file in "${required_files[@]}"; do | |
| if [ ! -f "$file" ]; then | |
| echo "::error::Missing required file: $file" | |
| exit 1 | |
| fi | |
| done | |
| - name: Markdown Lint | |
| uses: nosborn/github-action-markdown-cli@9b5e871c11cc0649c5ac2526af22e23525fa344d # v3.3.0 | |
| with: | |
| files: . | |
| config_file: .markdownlint.json | |
| - name: Version Consistency Check | |
| run: | | |
| shopt -s nullglob | |
| chart_files=( */helm/Chart.yaml ) | |
| if [ ${#chart_files[@]} -eq 0 ]; then | |
| echo "No Chart.yaml files found, skipping version check." | |
| exit 0 | |
| fi | |
| failed=0 | |
| for chart_file in "${chart_files[@]}"; do | |
| chart_dir=$(dirname "$chart_file") | |
| service_dir=$(dirname "$chart_dir") | |
| changelog_file="$service_dir/CHANGELOG.md" | |
| if [ ! -f "$changelog_file" ]; then | |
| echo "::error::Missing CHANGELOG.md for $chart_file" | |
| failed=1 | |
| continue | |
| fi | |
| chart_version=$(grep "^version:" "$chart_file" | awk '{print $2}' | head -1) | |
| if [ -z "$chart_version" ]; then | |
| echo "::error::Unable to determine version from $chart_file" | |
| failed=1 | |
| continue | |
| fi | |
| # Latest CHANGELOG entry header (Keep-a-Changelog convention: newest-on-top). | |
| # Matching `^## [X.Y.Z]` is strict on purpose — `grep -qi $version` | |
| # would pass even when Chart.yaml has drifted away from the latest | |
| # entry (e.g. chart=3.2.6, latest changelog entry=3.3.8 — `3.2.6` | |
| # still appears in older entries, so a loose presence check is silent). | |
| latest_changelog_version=$(grep -m1 -oE '^## \[[0-9]+\.[0-9]+\.[0-9]+\]' "$changelog_file" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || true) | |
| if [ -z "$latest_changelog_version" ]; then | |
| echo "::error::$changelog_file has no '## [X.Y.Z]' entry header; cannot verify Chart version alignment" | |
| failed=1 | |
| continue | |
| fi | |
| if [ "$chart_version" != "$latest_changelog_version" ]; then | |
| msg="$chart_file declares version $chart_version, but the latest entry in" | |
| msg="$msg $changelog_file is [$latest_changelog_version]." | |
| msg="$msg Bump Chart.yaml to match, or add a new '## [$chart_version] - YYYY-MM-DD' entry at the top." | |
| echo "::error::$msg" | |
| failed=1 | |
| fi | |
| done | |
| if [ "$failed" -ne 0 ]; then | |
| exit 1 | |
| fi | |
| versioning: | |
| name: WeOwnVer Validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Validate WeOwnVer Format | |
| run: | | |
| # Extract version from Chart.yaml | |
| version=$(grep "^version:" */helm/Chart.yaml | head -1 | awk '{print $2}') | |
| # Validate format: SEASON.WEEK[.DAY[.VERSION]] | |
| if ! echo "$version" | grep -Eq '^[0-9]+\.[0-9]+(\.[0-9]+)?(\.[0-9]+)?$'; then | |
| echo "::error::Invalid WeOwnVer format: $version" | |
| echo "Expected: SEASON.WEEK[.DAY[.VERSION]]" | |
| exit 1 | |
| fi | |
| # Validate season/week/day ranges | |
| season=$(echo "$version" | cut -d. -f1) | |
| week=$(echo "$version" | cut -d. -f2) | |
| day=$(echo "$version" | cut -d. -f3) | |
| if [ "$season" -lt 1 ] || [ "$season" -gt 9999 ]; then | |
| echo "::error::Season $season out of range (1-9999)" | |
| exit 1 | |
| fi | |
| if [ "$week" -lt 1 ] || [ "$week" -gt 17 ]; then | |
| echo "::error::Week $week out of range (1-17)" | |
| exit 1 | |
| fi | |
| if [ -n "$day" ]; then | |
| if [ "$day" -lt 0 ] || [ "$day" -gt 7 ]; then | |
| echo "::error::Day $day out of range (0-7)" | |
| exit 1 | |
| fi | |
| fi | |
| version_num=$(echo "$version" | cut -d. -f4) | |
| if [ -n "$version_num" ] && [ "$version_num" -lt 0 ]; then | |
| echo "::error::Version $version_num out of range (0+)" | |
| exit 1 | |
| fi | |
| summary: | |
| name: Validation Summary | |
| runs-on: ubuntu-latest | |
| needs: [lint, security, kubernetes, compliance, documentation, versioning] | |
| if: always() | |
| steps: | |
| - name: Generate Summary | |
| run: | | |
| echo "## Validation Results" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY | |
| echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY | |
| echo "| Lint | \`${{ needs.lint.result }}\` |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Security | \`${{ needs.security.result }}\` |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Kubernetes | \`${{ needs.kubernetes.result }}\` |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Compliance | \`${{ needs.compliance.result }}\` |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Documentation | \`${{ needs.documentation.result }}\` |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Versioning | \`${{ needs.versioning.result }}\` |" >> $GITHUB_STEP_SUMMARY |