ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: read

jobs:
  validate:
    name: Validate Docker Configs
    # GitHub-hosted: hadolint-action pulls ghcr.io/hadolint/hadolint which needs
    # authenticated GHCR access; GitHub-hosted runners have ambient auth, self-hosted ARM do not.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Validate docker-compose.yml
        env:
          DAKERA_ROOT_API_KEY: ci-validation-placeholder
          GRAFANA_PASSWORD: ci-validation-placeholder
        run: docker compose -f docker/docker-compose.yml config --quiet

      - name: Validate docker-compose.dev.yml
        run: docker compose -f docker/docker-compose.dev.yml config --quiet

      - name: Lint Dockerfiles
        uses: hadolint/hadolint-action@v3.3.0
        with:
          dockerfile: docker/Dockerfile
          failure-threshold: warning

  kustomize-validate:
    name: Kustomize Validate
    runs-on: [self-hosted, linux, arm64]
    steps:
      - uses: actions/checkout@v7

      - name: Set up kubectl (includes kustomize)
        uses: azure/setup-kubectl@v5

      - name: kustomize build (validate raw manifests)
        run: kustomize build k8s/ > /tmp/kustomize-output.yaml

      - name: Check rendered manifest summary
        run: |
          echo "Rendered $(wc -l < /tmp/kustomize-output.yaml) lines"
          grep "^kind:" /tmp/kustomize-output.yaml | sort | uniq -c | sort -rn