lint.yml

name: Lint
on:
  pull_request:
  push:
    branches:
      - master
permissions:
  contents: read

jobs:
  rubocop:
    name: Rubocop
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: ruby/setup-ruby@5f19ec79cedfadb78ab837f95b87734d0003c899 # v1.173.0
        with:
          bundler-cache: true
      - name: Rubocop
        run: bundle exec rubocop
  brakeman:
    name: Brakeman
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: ruby/setup-ruby@5f19ec79cedfadb78ab837f95b87734d0003c899 # v1.173.0
        with:
          bundler-cache: true
      - name: Brakeman
        run: bundle exec brakeman
  importmap:
    name: Importmap Verify
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: ruby/setup-ruby@5f19ec79cedfadb78ab837f95b87734d0003c899 # v1.173.0
        with:
          bundler-cache: true
      - name: Importmap Verify
        run: bundle exec rake importmap:verify
  kubeconform:
    name: Kubeconform
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        kubernetes_version: ["1.22.0"]
        environment:
          - staging
          - production
    steps:
      - name: login to Github Packages
        run: echo "${{ github.token }}" | docker login https://ghcr.io -u ${GITHUB_ACTOR} --password-stdin
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: ruby/setup-ruby@5f19ec79cedfadb78ab837f95b87734d0003c899 # v1.173.0
        with:
          bundler-cache: true
      - name: krane render
        run: |
          gem exec --silent krane render -f config/deploy/$ENVIRONMENT --bindings=environment=$ENVIRONMENT --current-sha=$REVISION > config/deploy/$ENVIRONMENT.rendered.yaml
        env:
          ENVIRONMENT: "${{ matrix.environment }}"
          REVISION: "${{ github.sha }}"
      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
        with:
          name: "${{ matrix.environment }}.rendered.yaml"
          path: "config/deploy/${{ matrix.environment }}.rendered.yaml"
      - name: kubeconform
        uses: docker://ghcr.io/yannh/kubeconform:v0.6.3
        with:
          entrypoint: "/kubeconform"
          args: "-strict -summary -output json --kubernetes-version ${{ matrix.kubernetes_version }} config/deploy/${{ matrix.environment }}.rendered.yaml"