validation.yml

name: Code Validation & Security

on:
  pull_request:
    branches: [main, maintenance]
  push:
    branches: [main, maintenance]

permissions:
  contents: read
  pull-requests: write
  security-events: write

jobs:
  lint:
    name: Lint & Syntax Validation
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install pre-commit
        run: pip install pre-commit

      - name: Run pre-commit
        run: pre-commit run --all-files

      - name: YAML Lint
        uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3.1.1
        with:
          file_or_dir: .
          config_file: .yamllint.yml

      - name: Helm Lint
        run: |
          for chart in */helm; do
            echo "Validating $chart"
            helm lint "$chart" 2>&1 | tee helm-lint.log
            if grep -q "ERROR" helm-lint.log; then
              echo "::error::Helm lint failed for $chart"
              exit 1
            fi
          done

      - name: Shell Script Lint
        uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # v2.0.0
        with:
          scandir: '.'
          severity: error

  security:
    name: Security Scanning
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Secret Detection (Gitleaks)
        run: |
          curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.18.4/gitleaks_8.18.4_linux_x64.tar.gz | tar xz -C /usr/local/bin gitleaks
          gitleaks detect --source . --redact --no-git -v

      - name: Trivy Config Scan
        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # v0.24.0
        continue-on-error: true  # report only; findings reviewed via Security tab SARIF upload
        with:
          scan-type: 'config'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-config.sarif'
          severity: 'HIGH,CRITICAL'
          exit-code: '1'

      - name: Upload Trivy Results
        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
        if: always()
        with:
          sarif_file: 'trivy-config.sarif'

  kubernetes:
    name: Kubernetes Validation
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Helm Template Validation
        run: |
          for chart in */helm; do
            echo "Validating $chart"
            helm template test "./$chart" --debug
          done

      - name: Kubeconform Validation
        run: |
          curl -sSL https://github.com/yannh/kubeconform/releases/download/v0.7.0/kubeconform-linux-amd64.tar.gz | tar xz -C /usr/local/bin kubeconform
          for chart in */helm; do
            echo "Validating $chart"
            helm template test "./$chart" | kubeconform -strict -summary -ignore-missing-schemas -
          done

  compliance:
    name: Compliance Validation
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: SOC2 Checklist Validation
        run: |
          # 1. NetworkPolicy exists
          if ! find . -name "networkpolicy.yaml" -o -name "network-policy.yaml" | grep -q .; then
            echo "::error::Missing NetworkPolicy - SOC2 requirement"
            exit 1
          fi

          # 2. No hardcoded secrets (basic check)
          # Exclusions (case-insensitive):
          #   placeholder/PLACEHOLDER  – intentional sentinel values in values.yaml
          #   example/sample           – documentation / example files
          #   valueFrom/secretKeyRef/envFrom – proper K8s secret references
          #   b64enc / {{              – Helm template expressions in secrets.yaml
          #   \$                       – shell env-var references (e.g. $MARIADB_PASSWORD)
          #   ""                       – empty-string sentinels (auto-generated at deploy time)
          if grep -RInE '^[[:space:]]*[^#]*password[^:]*[:=][[:space:]]*[^[:space:]#]+' --include="*.yaml" --include="*.yml" . | grep -Eiv 'valueFrom|secretKeyRef|envFrom:|example|sample|placeholder|b64enc|\$|\{\{|""|:[[:space:]]*(false|true)[[:space:]]*$'; then
            echo "::error::Hardcoded secrets detected - SOC2 violation"
            exit 1
          fi

          # 3. RBAC configured
          if ! find . \( -name "rbac.yaml" -o -name "role.yaml" -o -name "rolebinding.yaml" \) | grep -q .; then
            echo "::error::Missing RBAC - SOC2 requirement"
            exit 1
          fi

  documentation:
    name: Documentation Validation
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check Required Files
        run: |
          required_files=(
            "README.md"
            "CHANGELOG.md"
          )

          for file in "${required_files[@]}"; do
            if [ ! -f "$file" ]; then
              echo "::error::Missing required file: $file"
              exit 1
            fi
          done

      - name: Markdown Lint
        uses: nosborn/github-action-markdown-cli@9b5e871c11cc0649c5ac2526af22e23525fa344d # v3.3.0
        with:
          files: .
          config_file: .markdownlint.json

      - name: Version Consistency Check
        run: |
          shopt -s nullglob
          chart_files=( */helm/Chart.yaml )

          if [ ${#chart_files[@]} -eq 0 ]; then
            echo "No Chart.yaml files found, skipping version check."
            exit 0
          fi

          failed=0
          for chart_file in "${chart_files[@]}"; do
            chart_dir=$(dirname "$chart_file")
            service_dir=$(dirname "$chart_dir")
            changelog_file="$service_dir/CHANGELOG.md"

            if [ ! -f "$changelog_file" ]; then
              echo "::error::Missing CHANGELOG.md for $chart_file"
              failed=1
              continue
            fi

            chart_version=$(grep "^version:" "$chart_file" | awk '{print $2}' | head -1)
            if [ -z "$chart_version" ]; then
              echo "::error::Unable to determine version from $chart_file"
              failed=1
              continue
            fi

            # Latest CHANGELOG entry header (Keep-a-Changelog convention: newest-on-top).
            # Matching `^## [X.Y.Z]` is strict on purpose — `grep -qi $version`
            # would pass even when Chart.yaml has drifted away from the latest
            # entry (e.g. chart=3.2.6, latest changelog entry=3.3.8 — `3.2.6`
            # still appears in older entries, so a loose presence check is silent).
            latest_changelog_version=$(grep -m1 -oE '^## \[[0-9]+\.[0-9]+\.[0-9]+\]' "$changelog_file" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || true)
            if [ -z "$latest_changelog_version" ]; then
              echo "::error::$changelog_file has no '## [X.Y.Z]' entry header; cannot verify Chart version alignment"
              failed=1
              continue
            fi
            if [ "$chart_version" != "$latest_changelog_version" ]; then
              msg="$chart_file declares version $chart_version, but the latest entry in"
              msg="$msg $changelog_file is [$latest_changelog_version]."
              msg="$msg Bump Chart.yaml to match, or add a new '## [$chart_version] - YYYY-MM-DD' entry at the top."
              echo "::error::$msg"
              failed=1
            fi
          done

          if [ "$failed" -ne 0 ]; then
            exit 1
          fi

  versioning:
    name: WeOwnVer Validation
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Validate WeOwnVer Format
        run: |
          # Extract version from Chart.yaml
          version=$(grep "^version:" */helm/Chart.yaml | head -1 | awk '{print $2}')

          # Validate format: SEASON.WEEK[.DAY[.VERSION]]
          if ! echo "$version" | grep -Eq '^[0-9]+\.[0-9]+(\.[0-9]+)?(\.[0-9]+)?$'; then
            echo "::error::Invalid WeOwnVer format: $version"
            echo "Expected: SEASON.WEEK[.DAY[.VERSION]]"
            exit 1
          fi

          # Validate season/week/day ranges
          season=$(echo "$version" | cut -d. -f1)
          week=$(echo "$version" | cut -d. -f2)
          day=$(echo "$version" | cut -d. -f3)

          if [ "$season" -lt 1 ] || [ "$season" -gt 9999 ]; then
            echo "::error::Season $season out of range (1-9999)"
            exit 1
          fi

          if [ "$week" -lt 1 ] || [ "$week" -gt 17 ]; then
            echo "::error::Week $week out of range (1-17)"
            exit 1
          fi

          if [ -n "$day" ]; then
            if [ "$day" -lt 0 ] || [ "$day" -gt 7 ]; then
              echo "::error::Day $day out of range (0-7)"
              exit 1
            fi
          fi

          version_num=$(echo "$version" | cut -d. -f4)
          if [ -n "$version_num" ] && [ "$version_num" -lt 0 ]; then
            echo "::error::Version $version_num out of range (0+)"
            exit 1
          fi

  summary:
    name: Validation Summary
    runs-on: ubuntu-latest
    needs: [lint, security, kubernetes, compliance, documentation, versioning]
    if: always()
    steps:
      - name: Generate Summary
        run: |
          echo "## Validation Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Lint | \`${{ needs.lint.result }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Security | \`${{ needs.security.result }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Kubernetes | \`${{ needs.kubernetes.result }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Compliance | \`${{ needs.compliance.result }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Documentation | \`${{ needs.documentation.result }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Versioning | \`${{ needs.versioning.result }}\` |" >> $GITHUB_STEP_SUMMARY