use ghcr.io/yannh/kubeconform:v0.7.0-alpine image

.gitea/workflows/kubeconform.yml

@@ -8,17 +8,21 @@ jobs:
   kubeconform:
     runs-on: ubuntu-latest
     container:
-      image: docker.io/archlinux/archlinux:latest
+      image: ghcr.io/yannh/kubeconform:v0.7.0-alpine
     steps:
-      - name: Setup environment
-        run: |
-          pacman -Syu --noconfirm kubeconform git yq nodejs npm
-      
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
+      - name: Install dependencies
+        run: |
+          apk add --no-cache \
+            yq \
+            findutils \
+            curl \
+            jq
+
       - name: Create kubeconform configuration
         run: |
           cat > /tmp/kubeconform-config.yaml << 'EOF'
@@ -29,52 +33,58 @@ jobs:
 
       - name: Validate Manifests
         run: |
-          # Create a cache directory for schemas
+          # Define schema mappings
-          mkdir -p /tmp/kubeconform-cache
+          declare -A SCHEMA_MAP=(
+            ["HelmRelease"]="helm.toolkit.fluxcd.io/helmrelease_v2.json"
+            ["HelmRepository"]="source.toolkit.fluxcd.io/helmrepository_v1.json"
+            ["L2Advertisement"]="metallb.io/l2advertisement_v1beta1.json"
+            ["IPAddressPool"]="metallb.io/ipaddresspool_v1beta1.json"
+            ["SealedSecret"]="bitnami.com/sealedsecret_v1alpha1.json"
+          )
           
-          # Validate manifests with proper schema resolution
+          # Create cache directory
-          find . -type f \( -name "*.yml" \) \
+          export KUBECONFORM_CACHE_DIR="/tmp/kubeconform-cache"
-            -not -path "./.gitea/*" \
+          mkdir -p "$KUBECONFORM_CACHE_DIR"
-            -not -path "./clusters/default/system-upgrade/*" \
+          
-            -exec sh -c '
+          # Exit code tracking
-              for file do
+          EXIT_CODE=0
-                echo "=== Validating: $file ==="
+          
-                if yq -e "select(.kind == \"HelmRelease\")" "$file" >/dev/null 2>&1; then
+          # Process all YAML files
-                  echo "Found HelmRelease - using fluxcd schema"
+          while IFS= read -r file; do
-                  kubeconform \
+            echo "=== Validating: $file ==="
-                    -schema-location "https://raw.githubusercontent.com/datreeio/CRDs-catalog/refs/heads/main/helm.toolkit.fluxcd.io/helmrelease_v2.json" \
+            
-                    -output json \
+            # Skip excluded paths
-                    "$file"
+            if [[ "$file" == *".gitea/"* ]] || [[ "$file" == *"clusters/default/system-upgrade/"* ]]; then
-                elif yq -e "select(.kind == \"HelmRepository\")" "$file" >/dev/null 2>&1; then
+              echo "Skipping excluded file"
-                  echo "Found HelmRepository - using fluxcd schema"
+              continue
-                  kubeconform \
+            fi
-                    -schema-location "https://raw.githubusercontent.com/datreeio/CRDs-catalog/refs/heads/main/source.toolkit.fluxcd.io/helmrepository_v1.json" \
+            
-                    -output json \
+            # Detect resource kind
-                    "$file"
+            KIND=$(yq -r '.kind // ""' "$file" 2>/dev/null || echo "")
-                elif yq -e "select(.kind == \"L2Advertisement\")" "$file" >/dev/null 2>&1; then
+            
-                  echo "Found L2Advertisement - using metallb schema"
+            if [[ -n "$KIND" && -n "${SCHEMA_MAP[$KIND]}" ]]; then
-                  kubeconform \
+              echo "Found $KIND - using custom schema"
-                    -schema-location "https://raw.githubusercontent.com/datreeio/CRDs-catalog/refs/heads/main/metallb.io/l2advertisement_v1beta1.json" \
+              SCHEMA_URL="https://raw.githubusercontent.com/datreeio/CRDs-catalog/refs/heads/main/${SCHEMA_MAP[$KIND]}"
-                    -output json \
+              
-                    "$file"
+              if ! kubeconform \
-                elif yq -e "select(.kind == \"IPAddressPool\")" "$file" >/dev/null 2>&1; then
+                -schema-location "$SCHEMA_URL" \
-                  echo "Found IPAddressPool - using metallb schema"
+                -cache "$KUBECONFORM_CACHE_DIR" \
-                  kubeconform \
+                -output json \
-                    -schema-location "https://raw.githubusercontent.com/datreeio/CRDs-catalog/refs/heads/main/metallb.io/ipaddresspool_v1beta1.json" \
+                "$file"; then
-                    -output json \
+                EXIT_CODE=1
-                    "$file"
+              fi
-                elif yq -e "select(.kind == \"SealedSecret\")" "$file" >/dev/null 2>&1; then
+            else
-                  echo "Found SealedSecret - using bitnami schema"
+              echo "Validating with default schemas"
-                  kubeconform \
+              if ! kubeconform \
-                    -schema-location "https://raw.githubusercontent.com/datreeio/CRDs-catalog/refs/heads/main/bitnami.com/sealedsecret_v1alpha1.json" \
+                -schema-location default \
-                    -output json \
+                -cache "$KUBECONFORM_CACHE_DIR" \
-                    "$file"
+                -output json \
-                else
+                "$file"; then
-                  echo "Validating with default schemas"
+                EXIT_CODE=1
-                  kubeconform \
+              fi
-                    -schema-location default \
+            fi
-                    -output json \
+            
-                    "$file"
+            echo ""
-                fi
+          done < <(find . -type f \( -name "*.yml" \) -print)
-              done
+          
-            ' sh {} +
+          exit $EXIT_CODE