validate-claims.yaml

name: Validate Crossplane Claims

on:
  pull_request:
    paths:
      - "crossplane/claims/**/*.yaml"
      - "crossplane/claims/**/*.yml"
      - "kyverno/**/*.yaml"
      - "kyverno/**/*.yml"

jobs:
  validate-claims:
    name: Validate Claims YAML with Kyverno
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Kyverno CLI
        run: |
          curl -LO https://github.com/kyverno/kyverno/releases/download/v1.12.0/kyverno-cli_v1.12.0_linux_x86_64.tar.gz
          mkdir -p /tmp/kyverno-cli
          tar -xvf kyverno-cli_v1.12.0_linux_x86_64.tar.gz -C /tmp/kyverno-cli
          sudo mv /tmp/kyverno-cli/kyverno /usr/local/bin/
          kyverno version

      - name: Run Kyverno policy checks on claims
        run: |
          echo "## 🛡️ Kyverno Policy Validation Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY

          set +e
          verno apply ./kyverno --resource ./crossplane/claims -t --remove-color 2>&1 | tee result.txt
          KYVERNO_EXIT_CODE=${PIPESTATUS[0]}
          set -e

          cat result.txt >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY

          if [[ $KYVERNO_EXIT_CODE -ne 0 ]]; then
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "❌ One or more Kyverno policies failed. Please fix the issues above." >> $GITHUB_STEP_SUMMARY
            exit 1
          else
            echo "✅ All policies passed." >> $GITHUB_STEP_SUMMARY
          fi