validate.yaml

---
name: Validate

# yamllint disable-line rule:truthy
on:
  pull_request:
    branches:
    - "*"
  push:
    branches:
    - main

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        overlay:
        - examples/simple-web-service
        - resources/external-secret/docker-hub
        - resources/external-secret-store/aws
        - resources/namespace
        - resources/network/ingress
        - resources/network/service
        - resources/workload/cronjob
        - resources/workload/daemonset
        - resources/workload/deployment
        - resources/workload/job
        - resources/workload/pod
        - resources/workload/replicaset
        - resources/workload/statefulset
      fail-fast: false
    steps:
    - name: Login to Github Packages
      run: echo "${{ github.token }}" | docker login https://ghcr.io -u ${GITHUB_ACTOR} --password-stdin
    - uses: actions/checkout@v3
    - name: Kustomize Build
      run: kustomize build ${{ matrix.overlay }} > ${{ matrix.overlay }}/rendered.yaml
    - name: Run Kubeconform (Default Schemas)
      uses: docker://ghcr.io/yannh/kubeconform:v0.6.1
      with:
        entrypoint: '/kubeconform'
        args: "-strict -ignore-missing-schemas -schema-location default -summary ${{ matrix.overlay }}/rendered.yaml"
    - name: Run Kubeconform (CRDs)
      uses: docker://ghcr.io/yannh/kubeconform:v0.6.1
      with:
        entrypoint: '/kubeconform'
        args: "-strict -ignore-missing-schemas -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' -summary ${{ matrix.overlay }}/rendered.yaml"
    - name: Run Checkov
      uses: bridgecrewio/checkov-action@v12
      with:
        file: "${{ matrix.overlay }}/rendered.yaml"
        framework: kubernetes

  security-gha:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Run Checkov
      uses: bridgecrewio/checkov-action@v12
      with:
        directory: .github
        framework: github_actions

  secrets-scan:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v3
      with:
        fetch-depth: 0
    - name: TruffleHog OSS
      uses: trufflesecurity/trufflehog@main
      with:
        path: ./
        base: ${{ github.event.repository.default_branch }}
        head: HEAD