111 lines
3.9 KiB
YAML
111 lines
3.9 KiB
YAML
name: validate
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
# The repository uses the sha256 git object format. Git < 2.42 cannot speak
|
|
# the sha256 wire protocol, and actions/checkout@v4 does `git init` without
|
|
# --object-format=sha256, which produces `fatal: mismatched algorithms:
|
|
# client sha1; server sha256`. We therefore skip actions/checkout entirely
|
|
# and clone manually from a trixie-based container (git 2.47+).
|
|
jobs:
|
|
json-schema:
|
|
name: JSON Schema (ajv)
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: node:24-trixie-slim
|
|
steps:
|
|
- name: Install git + curl in container
|
|
run: |
|
|
set -euo pipefail
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends git curl ca-certificates
|
|
git --version
|
|
|
|
- name: Clone repository (sha256-aware)
|
|
run: |
|
|
set -euo pipefail
|
|
git clone --depth=1 --branch="${GITHUB_REF_NAME}" \
|
|
"https://x-access-token:${GITHUB_TOKEN}@forgejo.basicstack.de/${GITHUB_REPOSITORY}.git" "${GITHUB_WORKSPACE}"
|
|
cd "${GITHUB_WORKSPACE}"
|
|
git log -1 --oneline
|
|
|
|
- name: Install ajv-cli + ajv-formats
|
|
working-directory: ${{ github.workspace }}
|
|
run: |
|
|
set -euo pipefail
|
|
npm install --prefix /tmp/ajv ajv-cli@5 ajv-formats@3
|
|
|
|
- name: Validate every JSON Schema parses as JSON
|
|
working-directory: ${{ github.workspace }}
|
|
run: |
|
|
set -euo pipefail
|
|
find schemas -type f -name '*.json' -print | while read -r f; do
|
|
echo "--- parse: $f"
|
|
node -e "require('./$f')"
|
|
done
|
|
|
|
- name: Meta-validate each schema against JSON Schema 2020-12
|
|
working-directory: ${{ github.workspace }}
|
|
run: |
|
|
set -euo pipefail
|
|
export NODE_PATH=/tmp/ajv/node_modules
|
|
find schemas -type f -name '*.json' -print | while read -r f; do
|
|
echo "--- meta-validate: $f"
|
|
node /tmp/ajv/node_modules/.bin/ajv compile --spec=draft2020 -c=ajv-formats -s "$f"
|
|
done
|
|
|
|
- name: Validate example payloads against their schemas (if any)
|
|
working-directory: ${{ github.workspace }}
|
|
run: |
|
|
set -euo pipefail
|
|
export NODE_PATH=/tmp/ajv/node_modules
|
|
shopt -s nullglob
|
|
for schema in $(find schemas -type f -name '*.json'); do
|
|
dir="$(dirname "$schema")/examples"
|
|
[ -d "$dir" ] || continue
|
|
for example in "$dir"/*.json; do
|
|
echo "--- validate example $example against $schema"
|
|
node /tmp/ajv/node_modules/.bin/ajv validate --spec=draft2020 -c=ajv-formats -s "$schema" -d "$example"
|
|
done
|
|
done
|
|
|
|
rego:
|
|
name: Rego (opa fmt + opa test)
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: debian:trixie-slim
|
|
steps:
|
|
- name: Install git + curl in container
|
|
run: |
|
|
set -euo pipefail
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends git curl ca-certificates
|
|
git --version
|
|
|
|
- name: Clone repository (sha256-aware)
|
|
run: |
|
|
set -euo pipefail
|
|
git clone --depth=1 --branch="${GITHUB_REF_NAME}" \
|
|
"https://x-access-token:${GITHUB_TOKEN}@forgejo.basicstack.de/${GITHUB_REPOSITORY}.git" "${GITHUB_WORKSPACE}"
|
|
cd "${GITHUB_WORKSPACE}"
|
|
git log -1 --oneline
|
|
|
|
- name: Install OPA
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p "$HOME/.local/bin"
|
|
curl -sSL -o "$HOME/.local/bin/opa" https://openpolicyagent.org/downloads/v1.9.0/opa_linux_amd64_static
|
|
chmod +x "$HOME/.local/bin/opa"
|
|
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
|
|
"$HOME/.local/bin/opa" version
|
|
|
|
- name: opa fmt (fail on any diff)
|
|
working-directory: ${{ github.workspace }}
|
|
run: opa fmt --list --diff policies/
|
|
|
|
- name: opa test
|
|
working-directory: ${{ github.workspace }}
|
|
run: opa test policies/ -v
|