validate.yml

name: Validate ci-fleet prototype

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: validate-${{ github.ref }}
  cancel-in-progress: true

jobs:
  validate:
    name: Build without registering a runner
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Scan every proposed commit for secrets
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          scanner=scripts/scan_committed_secrets.py
          if [[ "$EVENT_NAME" == pull_request ]] && git cat-file -e "$BASE_SHA:$scanner" 2>/dev/null; then
            git show "$BASE_SHA:$scanner" >"$RUNNER_TEMP/trusted-secret-scanner.py"
            scanner="$RUNNER_TEMP/trusted-secret-scanner.py"
          fi
          if [[ -z "$BASE_SHA" || "$BASE_SHA" =~ ^0+$ ]]; then
            mapfile -t commits < <(git rev-list --reverse "$HEAD_SHA")
          else
            mapfile -t commits < <(git rev-list --reverse "$BASE_SHA..$HEAD_SHA")
          fi
          if [[ ! " ${commits[*]} " == *" $HEAD_SHA "* ]]; then
            commits+=("$HEAD_SHA")
          fi
          for commit in "${commits[@]}"; do
            python3 "$scanner" --repository "$GITHUB_WORKSPACE" --commit "$commit"
          done

      - name: Install static analysis tools
        run: sudo apt-get update && sudo apt-get install -y shellcheck

      - name: Check shell scripts
        run: shellcheck scripts/*.sh examples/project/scripts/ci/*.sh templates/config-repository/scripts/*.sh

      - name: Check documentation links
        run: python3 scripts/check_doc_links.py

      - name: Build and inspect inert prototype
        run: scripts/validate.sh

      - name: Validate public configuration template
        run: |
          cmp -s scripts/scan_committed_secrets.py templates/config-repository/scripts/scan_committed_secrets.py
          python3 templates/config-repository/scripts/test_policy.py
          python3 templates/config-repository/scripts/scan_committed_secrets.py
          templates/config-repository/scripts/validate.sh
          templates/config-repository/scripts/validate.sh --config templates/config-repository/examples/multi-host/fleet.json
          temporary_directory="$(mktemp -d)"
          if templates/config-repository/scripts/init.sh \
            --organization test-company \
            --project test-app \
            --output "${temporary_directory}/missing-engine.json"; then
            echo 'initializer accepted a missing engine revision' >&2
            exit 1
          fi
          test ! -e "${temporary_directory}/missing-engine.json"
          if templates/config-repository/scripts/init.sh \
            --organization test-company \
            --project test-app \
            --registry BAD \
            --engine-ref "$(git rev-parse HEAD)" \
            --output "${temporary_directory}/invalid.json"; then
            echo 'initializer accepted an invalid registry' >&2
            exit 1
          fi
          test ! -e "${temporary_directory}/invalid.json"
          templates/config-repository/scripts/init.sh \
            --organization test-company \
            --project test-app \
            --engine-ref "$(git rev-parse HEAD)" \
            --output "${temporary_directory}/fleet.json"
          test "$(stat -c '%a' "${temporary_directory}/fleet.json")" = 644