ci.yaml

name: ci

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - "*"

jobs:
  lint-commit-messages:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - uses: actions/setup-python@v6
        with:
          python-version: "3.x"

      - name: Show logs
        run: git log

      - name: Install gitlint
        run: pip install requests gitlint

      - name: Lint commit messages added to main
        run: gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD

  lint-helmfile:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Install helm
        run: |
          wget -O - https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

      - name: Install helmfile
        run: |
          cd /tmp/
          wget https://github.com/helmfile/helmfile/releases/download/v1.1.2/helmfile_1.1.2_linux_amd64.tar.gz
          tar -xzf helmfile_1.1.2_linux_amd64.tar.gz
          sudo mv helmfile /usr/local/bin/helmfile

      - name: Initilize helmfile dependecies
        run: |
          helmfile init --force

      - name: Lint helmfile
        run: |
          helmfile -e production lint
          helmfile -e demo lint
          helmfile lint
        env:
          MIJNBUREAU_MASTER_PASSWORD: ${{ secrets.MIJNBUREAU_MASTER_PASSWORD || 'dependabot' }}
          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY || 'dependabot'  }}

  render-helmfile:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Install helm
        run: |
          wget -O - https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

      - name: Install helmfile
        run: |
          cd /tmp/
          wget https://github.com/helmfile/helmfile/releases/download/v1.1.2/helmfile_1.1.2_linux_amd64.tar.gz
          tar -xzf helmfile_1.1.2_linux_amd64.tar.gz
          sudo mv helmfile /usr/local/bin/helmfile

      - name: Initilize helmfile dependecies
        run: |
          helmfile init --force

      - name: Render helmfile for all environments
        run: |
          helmfile -e production template --output-dir=/tmp/manifest/production
          helmfile -e demo template --output-dir=/tmp/manifest/demo
          helmfile template --output-dir=/tmp/manifest/default
        env:
          MIJNBUREAU_MASTER_PASSWORD: ${{ secrets.MIJNBUREAU_MASTER_PASSWORD || 'dependabot' }}
          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY || 'dependabot'  }}

      - name: Upload rendered manifests
        uses: actions/upload-artifact@v4
        with:
          name: rendered-manifests
          path: /tmp/manifest/
          if-no-files-found: error
          retention-days: 3

  verify-policies:
    runs-on: ubuntu-latest
    needs: [render-helmfile]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - uses: actions/download-artifact@v5
        with:
          name: rendered-manifests
          path: /tmp/manifest

      - name: Install conftest
        run: |
          wget https://github.com/open-policy-agent/conftest/releases/download/v0.61.2/conftest_0.61.2_linux_amd64.deb
          sudo dpkg -i conftest_0.61.2_linux_amd64.deb

      - name: Run conftest against rendered manifests
        run: |
          conftest test /tmp/manifest/production --output=github --parser yaml --quiet
          conftest test /tmp/manifest/demo --output=github --parser yaml --quiet
          conftest test /tmp/manifest/default --output=github --parser yaml --quiet

  test-values:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Install helm
        run: |
          wget -O - https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

      - name: Install helmfile
        run: |
          cd /tmp/
          wget https://github.com/helmfile/helmfile/releases/download/v1.1.2/helmfile_1.1.2_linux_amd64.tar.gz
          tar -xzf helmfile_1.1.2_linux_amd64.tar.gz
          sudo mv helmfile /usr/local/bin/helmfile

      - name: Initilize helmfile dependecies
        run: |
          helmfile init --force

      - name: Install conftest
        run: |
          wget https://github.com/open-policy-agent/conftest/releases/download/v0.61.2/conftest_0.61.2_linux_amd64.deb
          sudo dpkg -i conftest_0.61.2_linux_amd64.deb

      - name: Run setup tests in demo environment
        run: |
          ./scripts/test.sh -e demo

      - name: Run setup tests in production environment
        run: |
          ./scripts/test.sh -e production

  check-format-rules:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: "22"

      - uses: actions/setup-python@v6
        with:
          python-version: "3.x"

      - name: Install prettier
        run: npm install -g prettier

      - name: Install pre-commit
        run: pip install pre-commit

      - name: Run formatters
        run: ./scripts/format.sh

      - name: Check for changes
        run: |
          if [[ -n "$(git status --porcelain)" ]]; then
            echo "Error: Detected uncommitted changes after formatting. Please run the formatter locally and commit the results."
            git status
            git diff
            exit 1
          fi

      - name: run pre-commit
        run: pre-commit run --all-files

  check-kubernetes-conformance:
    runs-on: ubuntu-latest
    needs: [render-helmfile]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - uses: actions/download-artifact@v5
        with:
          name: rendered-manifests
          path: /tmp/manifest

      - name: Install kubeconform
        run: |
          wget https://github.com/yannh/kubeconform/releases/download/v0.7.0/kubeconform-linux-amd64.tar.gz -O /tmp/kubeconform.tar.gz
          tar -xzf /tmp/kubeconform.tar.gz -C /tmp/
          mv /tmp/kubeconform /usr/local/bin/kubeconform
          chmod +x /usr/local/bin/kubeconform

      - name: Run kubeconform against rendered manifests
        run: |
          kubeconform -strict -summary /tmp/manifest/production/
          kubeconform -strict -summary /tmp/manifest/demo/
          kubeconform -strict -summary /tmp/manifest/default/

  diff:
    runs-on: ubuntu-latest
    needs: [render-helmfile]
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/download-artifact@v5
        with:
          name: rendered-manifests
          path: /tmp/manifest

      - uses: actions/checkout@v5
        with:
          ref: main

      - name: Install helm
        run: |
          wget -O - https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

      - name: Install helmfile
        run: |
          cd /tmp/
          wget https://github.com/helmfile/helmfile/releases/download/v1.1.2/helmfile_1.1.2_linux_amd64.tar.gz
          tar -xzf helmfile_1.1.2_linux_amd64.tar.gz
          sudo mv helmfile /usr/local/bin/helmfile

      - name: Initilize helmfile dependecies
        run: |
          helmfile init --force

      - name: Render helmfile for all environments
        run: |
          helmfile -e demo template --output-dir=/tmp/manifest/demo-main
        env:
          MIJNBUREAU_MASTER_PASSWORD: ${{ secrets.MIJNBUREAU_MASTER_PASSWORD || 'dependabot' }}
          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY || 'dependabot'  }}

      - name: diff manifests
        run: diff -burN /tmp/manifest/demo-main/ /tmp/manifest/demo/ > diff.txt || true

      - name: get file size
        run: |
          file_size=$(stat -c%s diff.txt)
          echo "file_size=$file_size" >> $GITHUB_OUTPUT
        id: diff

      - name: format diff
        if: ${{ steps.diff.outputs.file_size != '0' }}
        run: |
          echo -e 'DIFF\n```\n' > formatted_diff.txt
          cat diff.txt >> formatted_diff.txt
          echo -e '\n```' >> "formatted_diff.txt"

      - name: Find Comment
        if: ${{ steps.diff.outputs.file_size != '0' }}
        uses: peter-evans/find-comment@v3
        id: fc
        with:
          issue-number: ${{ github.event.pull_request.number }}
          comment-author: "github-actions[bot]"
          body-includes: DIFF

      # comment on pr with diff
      - name: Comment on PR with diff
        if: ${{ steps.diff.outputs.file_size != '0' }}
        uses: peter-evans/create-or-update-comment@v4
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body-path: formatted_diff.txt
          edit-mode: replace
          comment-id: ${{ steps.fc.outputs.comment-id }}

  notify-mattermost:
    runs-on: ubuntu-latest
    needs:
      [
        lint-commit-messages,
        check-format-rules,
        render-helmfile,
        verify-policies,
        check-kubernetes-conformance,
        lint-helmfile,
        test-values,
      ]
    if: ${{ always() && contains(needs.*.result, 'failure') }}
    steps:
      - uses: mattermost/action-mattermost-notify@master
        if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
        with:
          MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK }}
          MATTERMOST_CHANNEL: github-actions
          TEXT: |
            ## 🚨 CI Pipeline Failed

            **Repository:** `${{ github.repository }}`
            **Branch/Tag:** `${{ github.head_ref }}`
            **Triggered by:** @${{ github.actor }}
            **Event:** ${{ github.event_name }}

            ### Failed Jobs:
            ${{ needs.lint-commit-messages.result == 'failure' && '❌ Commit Message Linting' || '' }}
            ${{ needs.check-format-rules.result == 'failure' && '❌ Format & Pre-commit Checks' || '' }}

            ### Quick Actions:
            - 🔍 [View Pipeline Details](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
            - 📝 [View Commit](${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }})
            ${{ github.event_name == 'pull_request' && format('- 🔄 [View Pull Request]({0}/{1}/pull/{2})', github.server_url, github.repository, github.event.number) || '' }}