merge-check-paths.yml

name: flux check pipeline # Merge Check Workflow for Terraform and Flux Files if changed

on:
  workflow_dispatch:
  pull_request:
    paths:
      - '**.tf'
      - 'infrastructure/cluster/flux-v2/**'
  push:
    branches:
      - main
    paths:
      - '**.tf'
      - 'infrastructure/cluster/flux-v2/**'

jobs:
  terraform-validate:
    name: "Validate Terraform files"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Terraform Setup
        uses: hashicorp/setup-terraform@v1

      - name: Terraform Format
        id: fmt
        run: terraform fmt -check

      - name: Terraform Validate
        id: validate
        run: terraform validate -no-color

  flux-validate:
    name: "Validate Flux files"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        
      - name: Setup custom Action
        uses: ./.github/actions/tools

      - name: Validate Flux Manifests
        working-directory: infrastructure/cluster/flux-v2
        run: |
          #!/usr/bin/env bash
          
          # This script downloads the Flux OpenAPI schemas, then it validates the
          # Flux custom resources and the kustomize overlays using kubeconform.
          # This script is meant to be run locally and in CI before the changes
          # are merged on the main branch that's synced by Flux.

          # Copyright 2022 The Flux authors. All rights reserved.
          #
          # Licensed under the Apache License, Version 2.0 (the "License");
          # you may not use this file except in compliance with the License.
          # You may obtain a copy of the License at
          #
          #     http://www.apache.org/licenses/LICENSE-2.0
          #
          # Unless required by applicable law or agreed to in writing, software
          # distributed under the License is distributed on an "AS IS" BASIS,
          # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
          # See the License for the specific language governing permissions and
          # limitations under the License.

          # This script is meant to be run locally and in CI to validate the Kubernetes
          # manifests (including Flux custom resources) before changes are merged into
          # the branch synced by Flux in-cluster.

          # Prerequisites
          # - yq v4.30
          # - kustomize v4.5
          # - kubeconform v0.5.0

          set -o errexit

          echo "INFO - Downloading Flux OpenAPI schemas"
          mkdir -p /tmp/flux-crd-schemas/master-standalone-strict
          curl -sL https://github.com/fluxcd/flux2/releases/latest/download/crd-schemas.tar.gz | tar zxf - -C /tmp/flux-crd-schemas/master-standalone-strict

          find . -type f -name '*.yaml' -print0 | while IFS= read -r -d $'\0' file;
            do
              echo "INFO - Validating $file"
              yq e 'true' "$file" > /dev/null
          done

          kubeconform_config=("-strict" "-ignore-missing-schemas" "-schema-location" "default" "-schema-location" "/tmp/flux-crd-schemas" "-verbose")

          echo "INFO - Validating clusters"
          find ./clusters -maxdepth 2 -type f -name '*.yaml' -print0 | while IFS= read -r -d $'\0' file;
            do
              kubeconform "${kubeconform_config[@]}" "${file}"
              if [[ ${PIPESTATUS[0]} != 0 ]]; then
                exit 1
              fi
          done

          # mirror kustomize-controller build options
          kustomize_flags=("--load-restrictor=LoadRestrictionsNone")
          kustomize_config="kustomization.yaml"

          echo "INFO - Validating kustomize overlays"
          find . -type f -name $kustomize_config -print0 | while IFS= read -r -d $'\0' file;
            do
              echo "INFO - Validating kustomization ${file/%$kustomize_config}"
              kustomize build "${file/%$kustomize_config}" "${kustomize_flags[@]}" | \
                kubeconform "${kubeconform_config[@]}"
              if [[ ${PIPESTATUS[0]} != 0 ]]; then
                exit 1
              fi
          done