lint.yml

name: lint

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  shellcheck:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - name: ShellCheck all run.sh / cleanup.sh
        run: |
          set -e
          # SC2015: `[ cond ] && ok ... || ng ...` is intentional in assert lines
          # because both helpers are simple printf wrappers and ng exits anyway.
          fail=0
          while IFS= read -r f; do
            echo "::group::shellcheck $f"
            if ! shellcheck --exclude=SC2015 "$f"; then fail=1; fi
            echo "::endgroup::"
          done < <(find . -type f \( -name 'run.sh' -o -name 'cleanup.sh' -o -path './lib/*.sh' \))
          exit "$fail"

  yamllint:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - uses: ibiqlik/action-yamllint@v3
        with:
          config_file: .yamllint.yml

  markdownlint:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - uses: DavidAnson/markdownlint-cli2-action@v24
        with:
          globs: |
            **/*.md
          config: .markdownlint.jsonc

  kubeconform:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - name: Install kubeconform
        run: |
          curl -fsSL -o /tmp/kc.tgz \
            https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz
          tar -xzf /tmp/kc.tgz -C /tmp
          sudo install /tmp/kubeconform /usr/local/bin/
      - name: Validate manifests against bundled k8s schemas
        run: |
          # -strict catches unknown fields. -summary prints a final count.
          # -ignore-missing-schemas lets CRDs (Calico/Cilium/Istio/SPIRE/Gatekeeper)
          # pass without failing the build; we still validate core k8s objects.
          find . -type f -path '*/manifests/*.yaml' -print0 \
            | xargs -0 kubeconform -strict -summary -ignore-missing-schemas