ci.yaml

name: CI
on:
  push:
permissions:
  id-token: write
  contents: read
  pull-requests: read
jobs:
  filter:
    runs-on: ubuntu-latest
    outputs:
      kube: ${{ steps.path-filter.outputs.kube }}
      gcp: ${{ steps.path-filter.outputs.gcp }}
      aws: ${{ steps.path-filter.outputs.aws }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: path-filter
        with:
          filters: |
            kube:
              - "kubernetes/**"
              - ".github/workflows/ci.yaml"
              - ".github/actions/**"
            gcp:
              - "gcp/**"
              - ".github/workflows/ci.yaml"
              - ".github/actions/**"
            aws:
              - "aws/**"
              - ".github/workflows/ci.yaml"
              - ".github/actions/**"
  kubeconform:
    runs-on: ubuntu-latest
    needs: filter
    if: needs.filter.outputs.kube == 'true'
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: /tmp/pkustomize/cache
          key: pkustomize-${{ hashFiles('kubernetes/scripts/pkustomize/main.go') }}
      - uses: ./.github/actions/setup-aqua
      - run: cd kubernetes && bash scripts/kubeconform.sh
  kube-yamlfmt:
    runs-on: ubuntu-latest
    needs: filter
    if: needs.filter.outputs.kube == 'true'
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-aqua
      - name: Yamlfmt
        run: cd kubernetes && yamlfmt -lint
  kube-cluster-tls:
    runs-on: ubuntu-latest
    needs: filter
    if: needs.filter.outputs.kube == 'true'
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-aqua
      - name: Ytt
        run: cd kubernetes && bash scripts/cluster-tls.sh
      - run: if [ -n "$(git status --porcelain)" ]; then git diff; exit 1; fi
  kube-ytt:
    runs-on: ubuntu-latest
    needs: filter
    if: needs.filter.outputs.kube == 'true'
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-aqua
      - name: Ytt
        run: cd kubernetes && bash scripts/ytt.sh
      - run: if [ -n "$(git status --porcelain)" ]; then git diff; exit 1; fi

  kube-flux:
    runs-on: ubuntu-latest
    needs: filter
    if: needs.filter.outputs.kube == 'true'
    steps:
      - uses: actions/checkout@v4
      - run: cd kubernetes && bash scripts/flux-kustomize.sh
      - run: if [ -n "$(git status --porcelain)" ]; then git diff; exit 1; fi

  tf-format:
    runs-on: ubuntu-latest
    needs: filter
    if: needs.filter.outputs.aws == 'true' || needs.filter.outputs.gcp == 'true'
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.9.5
      - name: Terraform fmt
        run: terraform fmt -check -recursive