402 lines
10 KiB
Bash
Executable File
402 lines
10 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -Eeuo pipefail
|
|
|
|
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "${repo_root}"
|
|
|
|
errors=0
|
|
|
|
pass() {
|
|
printf '[pass] %s\n' "$1"
|
|
}
|
|
|
|
fail() {
|
|
printf '[fail] %s\n' "$1" >&2
|
|
errors=$((errors + 1))
|
|
}
|
|
|
|
required_files=(
|
|
README.md
|
|
SECURITY.md
|
|
infrastructure/.iac-engine.example
|
|
)
|
|
|
|
required_directories=(
|
|
bootstrap/foundation
|
|
bootstrap/gitops
|
|
infrastructure/components/_template
|
|
infrastructure/stacks/_template
|
|
infrastructure/live/_template
|
|
gitops/clusters/_template
|
|
gitops/platform/_template
|
|
gitops/policies/_template
|
|
gitops/tenants/_template
|
|
gitops/apps/_template
|
|
docs/architecture
|
|
docs/decisions
|
|
docs/runbooks
|
|
examples/minimal
|
|
scripts
|
|
tests
|
|
)
|
|
|
|
stage_errors="${errors}"
|
|
for path in "${required_files[@]}"; do
|
|
if [[ ! -f "${path}" || -L "${path}" ]]; then
|
|
fail "required regular file is missing or has the wrong type: ${path}"
|
|
fi
|
|
done
|
|
|
|
for path in "${required_directories[@]}"; do
|
|
if [[ ! -d "${path}" || -L "${path}" ]]; then
|
|
fail "required directory is missing or has the wrong type: ${path}"
|
|
fi
|
|
done
|
|
|
|
if ((errors == stage_errors)); then
|
|
pass "required repository structure"
|
|
fi
|
|
|
|
stage_errors="${errors}"
|
|
while IFS= read -r directory; do
|
|
name="${directory##*/}"
|
|
if [[ "${name}" == "_template" ]]; then
|
|
continue
|
|
fi
|
|
|
|
if [[ ! "${name}" =~ ^[a-z0-9][a-z0-9-]*$ ]]; then
|
|
fail "directory must use lowercase kebab-case: ${directory}"
|
|
fi
|
|
done < <(
|
|
find bootstrap docs examples gitops infrastructure scripts tests \
|
|
\( \
|
|
-name .build -o \
|
|
-name .cache -o \
|
|
-name .git -o \
|
|
-name .terraform -o \
|
|
-name .terragrunt-cache -o \
|
|
-name dist -o \
|
|
-name rendered -o \
|
|
-name tmp \
|
|
\) -prune -o \
|
|
-type d -print |
|
|
sort
|
|
)
|
|
|
|
if ((errors == stage_errors)); then
|
|
pass "directory naming"
|
|
fi
|
|
|
|
collect_source_files() {
|
|
if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
|
|
git ls-files --cached --others --exclude-standard -z
|
|
else
|
|
find . \
|
|
\( \
|
|
-type d \
|
|
\( \
|
|
-name .build -o \
|
|
-name .cache -o \
|
|
-name .git -o \
|
|
-name .terraform -o \
|
|
-name .terragrunt-cache -o \
|
|
-name dist -o \
|
|
-name rendered -o \
|
|
-name tmp \
|
|
\) -prune \
|
|
\) -o \
|
|
-type f -print0
|
|
fi
|
|
}
|
|
|
|
source_files=()
|
|
while IFS= read -r -d '' file; do
|
|
file="${file#./}"
|
|
if [[ -f "${file}" ]]; then
|
|
source_files+=("${file}")
|
|
fi
|
|
done < <(collect_source_files)
|
|
|
|
is_sensitive_filename() {
|
|
local file="$1"
|
|
local name="${file##*/}"
|
|
|
|
case "${file}" in
|
|
*/.decrypted/*)
|
|
return 0
|
|
;;
|
|
esac
|
|
|
|
case "${name}" in
|
|
.env | .env.*)
|
|
[[ "${name}" == ".env.example" ]] && return 1
|
|
return 0
|
|
;;
|
|
*.dec.yaml | *.decrypted.yaml | *.jks | *.key | *.kubeconfig | *.p12 | *.pem | *.pfx | \
|
|
*.tfplan | *.tfstate | *.tfstate.* | credentials | credentials.* | id_dsa | id_ecdsa | \
|
|
id_ed25519 | id_rsa | kubeconfig | kubeconfig.* | plan.out | service-account.json | \
|
|
service_account.json)
|
|
return 0
|
|
;;
|
|
esac
|
|
|
|
return 1
|
|
}
|
|
|
|
stage_errors="${errors}"
|
|
for file in "${source_files[@]}"; do
|
|
if is_sensitive_filename "${file}"; then
|
|
fail "sensitive/local artifact must not be stored: ${file}"
|
|
fi
|
|
|
|
if grep -Eq -- '-----BEGIN (DSA |EC |OPENSSH |RSA )?PRIVATE KEY-----' "${file}" 2>/dev/null; then
|
|
fail "private key material must not be stored: ${file}"
|
|
fi
|
|
done
|
|
|
|
if ((errors == stage_errors)); then
|
|
pass "sensitive/local artifact checks"
|
|
fi
|
|
|
|
yaml_secret_kind_pattern="^['\"]?kind['\"]?[[:space:]]*:[[:space:]]*['\"]?Secret['\"]?([[:space:]]*(#.*)?)?$"
|
|
json_secret_kind_pattern="['\"]kind['\"][[:space:]]*:[[:space:]]*['\"]Secret['\"]"
|
|
yaml_sops_metadata_pattern='^sops:[[:space:]]*(#.*)?$'
|
|
json_sops_metadata_pattern='^[[:space:]]*"sops"[[:space:]]*:'
|
|
yaml_sops_mac_pattern='^[[:space:]]*mac:[[:space:]]*ENC\[AES256_GCM,'
|
|
json_sops_mac_pattern='^[[:space:]]*"mac"[[:space:]]*:[[:space:]]*"ENC\[AES256_GCM,'
|
|
|
|
stage_errors="${errors}"
|
|
for file in "${source_files[@]}"; do
|
|
case "${file}" in
|
|
bootstrap/*.yaml | bootstrap/*.yml | bootstrap/*.json | \
|
|
gitops/*.yaml | gitops/*.yml | gitops/*.json | \
|
|
examples/*.yaml | examples/*.yml | examples/*.json)
|
|
secret_manifest=0
|
|
case "${file}" in
|
|
*.json)
|
|
grep -Eq "${json_secret_kind_pattern}" "${file}" && secret_manifest=1
|
|
;;
|
|
*)
|
|
grep -Eq "${yaml_secret_kind_pattern}" "${file}" && secret_manifest=1
|
|
;;
|
|
esac
|
|
|
|
if ((secret_manifest == 1)); then
|
|
case "${file}" in
|
|
*.sops.yaml | *.sops.yml)
|
|
if ! grep -Eq "${yaml_sops_metadata_pattern}" "${file}" ||
|
|
! grep -Eq "${yaml_sops_mac_pattern}" "${file}"; then
|
|
fail "SOPS Secret is missing encrypted metadata/MAC: ${file}"
|
|
fi
|
|
;;
|
|
*.sops.json)
|
|
if ! grep -Eq "${json_sops_metadata_pattern}" "${file}" ||
|
|
! grep -Eq "${json_sops_mac_pattern}" "${file}"; then
|
|
fail "SOPS Secret is missing encrypted metadata/MAC: ${file}"
|
|
fi
|
|
;;
|
|
*)
|
|
fail "plain Kubernetes Secret is not allowed; use an external reference or a *.sops.yaml file: ${file}"
|
|
;;
|
|
esac
|
|
fi
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if ((errors == stage_errors)); then
|
|
pass "plain Kubernetes Secret manifests"
|
|
fi
|
|
|
|
stage_errors="${errors}"
|
|
for file in "${source_files[@]}"; do
|
|
case "${file}" in
|
|
*/_template/*)
|
|
continue
|
|
;;
|
|
esac
|
|
|
|
if grep -Eq '__REPLACE_ME_[A-Z0-9_]+__' "${file}"; then
|
|
fail "unresolved replacement token: ${file}"
|
|
fi
|
|
done
|
|
|
|
if ((errors == stage_errors)); then
|
|
pass "replacement tokens outside _template"
|
|
fi
|
|
|
|
stage_errors="${errors}"
|
|
while IFS= read -r script; do
|
|
if ! bash -n "${script}"; then
|
|
fail "shell syntax: ${script}"
|
|
fi
|
|
done < <(find scripts -type f -name '*.sh' | sort)
|
|
|
|
if ((errors == stage_errors)); then
|
|
pass "shell syntax"
|
|
fi
|
|
|
|
kustomizations=()
|
|
for file in "${source_files[@]}"; do
|
|
case "${file}" in
|
|
bootstrap/*/kustomization.yaml | bootstrap/*/kustomization.yml | \
|
|
gitops/*/kustomization.yaml | gitops/*/kustomization.yml | \
|
|
examples/*/kustomization.yaml | examples/*/kustomization.yml)
|
|
kustomizations+=("${file}")
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if ((${#kustomizations[@]} > 0)); then
|
|
stage_errors="${errors}"
|
|
if ! command -v kubectl >/dev/null 2>&1; then
|
|
fail "kubectl is required to render Kustomize roots"
|
|
else
|
|
for file in "${kustomizations[@]}"; do
|
|
rendered=""
|
|
if ! rendered="$(kubectl kustomize "$(dirname "${file}")")"; then
|
|
fail "Kustomize render: ${file}"
|
|
continue
|
|
fi
|
|
|
|
case "${file}" in
|
|
gitops/clusters/_template/*)
|
|
;;
|
|
gitops/clusters/*)
|
|
if [[ -z "${rendered}" ]]; then
|
|
fail "actual cluster root renders no resources: ${file}"
|
|
fi
|
|
;;
|
|
esac
|
|
done
|
|
fi
|
|
|
|
if ((errors == stage_errors)); then
|
|
pass "Kustomize render (${#kustomizations[@]} roots)"
|
|
fi
|
|
fi
|
|
|
|
charts=()
|
|
for file in "${source_files[@]}"; do
|
|
if [[ "${file##*/}" == "Chart.yaml" ]]; then
|
|
charts+=("${file}")
|
|
fi
|
|
done
|
|
|
|
if ((${#charts[@]} > 0)); then
|
|
stage_errors="${errors}"
|
|
if ! command -v helm >/dev/null 2>&1; then
|
|
fail "Helm is required because Chart.yaml files exist"
|
|
else
|
|
for chart in "${charts[@]}"; do
|
|
if ! helm lint "$(dirname "${chart}")"; then
|
|
fail "Helm lint: ${chart}"
|
|
fi
|
|
done
|
|
fi
|
|
|
|
if ((errors == stage_errors)); then
|
|
pass "Helm lint (${#charts[@]} charts)"
|
|
fi
|
|
fi
|
|
|
|
iac_files=()
|
|
iac_directories=()
|
|
has_tofu_syntax=0
|
|
for file in "${source_files[@]}"; do
|
|
case "${file}" in
|
|
bootstrap/*.tofu | bootstrap/*.tofu.json | infrastructure/*.tofu | infrastructure/*.tofu.json)
|
|
iac_files+=("${file}")
|
|
has_tofu_syntax=1
|
|
;;
|
|
bootstrap/*.tf | bootstrap/*.tf.json | infrastructure/*.tf | infrastructure/*.tf.json)
|
|
iac_files+=("${file}")
|
|
;;
|
|
esac
|
|
done
|
|
|
|
for file in "${iac_files[@]}"; do
|
|
directory="${file%/*}"
|
|
directory_seen=0
|
|
for existing_directory in "${iac_directories[@]}"; do
|
|
if [[ "${directory}" == "${existing_directory}" ]]; then
|
|
directory_seen=1
|
|
break
|
|
fi
|
|
done
|
|
|
|
if ((directory_seen == 0)); then
|
|
iac_directories+=("${directory}")
|
|
fi
|
|
done
|
|
|
|
if ((${#iac_files[@]} > 0)); then
|
|
stage_errors="${errors}"
|
|
iac_engine=""
|
|
|
|
if [[ ! -f infrastructure/.iac-engine || -L infrastructure/.iac-engine ]]; then
|
|
fail "select terraform or tofu in the tracked infrastructure/.iac-engine file"
|
|
else
|
|
iac_engine_values=()
|
|
while IFS= read -r line; do
|
|
case "${line}" in
|
|
"" | \#*)
|
|
continue
|
|
;;
|
|
esac
|
|
iac_engine_values+=("${line}")
|
|
done < infrastructure/.iac-engine
|
|
|
|
if ((${#iac_engine_values[@]} != 1)); then
|
|
fail "infrastructure/.iac-engine must contain exactly one uncommented value"
|
|
else
|
|
iac_engine="${iac_engine_values[0]}"
|
|
case "${iac_engine}" in
|
|
terraform | tofu)
|
|
;;
|
|
*)
|
|
fail "infrastructure/.iac-engine must contain exactly terraform or tofu"
|
|
iac_engine=""
|
|
;;
|
|
esac
|
|
fi
|
|
fi
|
|
|
|
if [[ "${iac_engine}" == "terraform" && "${has_tofu_syntax}" == "1" ]]; then
|
|
fail "Terraform cannot format .tofu/.tofu.json files; select tofu or use compatible .tf files"
|
|
fi
|
|
|
|
if [[ -n "${iac_engine}" ]]; then
|
|
if ! command -v "${iac_engine}" >/dev/null 2>&1; then
|
|
fail "${iac_engine} is selected but is not installed"
|
|
elif ((errors == stage_errors)); then
|
|
for directory in "${iac_directories[@]}"; do
|
|
if ! "${iac_engine}" fmt -check "${directory}"; then
|
|
fail "${iac_engine} format check: ${directory}"
|
|
fi
|
|
done
|
|
fi
|
|
fi
|
|
|
|
if ((errors == stage_errors)); then
|
|
pass "${iac_engine} format (${#iac_files[@]} files)"
|
|
fi
|
|
fi
|
|
|
|
stage_errors="${errors}"
|
|
if ! ./scripts/project-validate.sh; then
|
|
fail "project-specific validation"
|
|
fi
|
|
|
|
if ((errors == stage_errors)); then
|
|
pass "project-specific validation"
|
|
fi
|
|
|
|
if ((errors > 0)); then
|
|
printf '\nValidation failed with %d error(s).\n' "${errors}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
printf '\nValidation passed.\n'
|