homelab/.gitea/tests/deploy-validation.sh

#!/usr/bin/env bash
# Local regressions only: kubectl is mocked and Docker is used for config parsing.
set -euo pipefail
repo="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
scratch="$(mktemp -d)"
trap 'rm -rf "$scratch"' EXIT

mkdir -p "$scratch/repo/app" "$scratch/repo/postgres" "$scratch/repo/netbird" "$scratch/repo/renovate"
git -C "$scratch/repo" init -q
for file in app/compose.yaml postgres/shared-compose.yaml netbird/client.compose.yaml renovate/renovate-compose.yaml; do
  touch "$scratch/repo/$file"
done
git -C "$scratch/repo" add .
# shellcheck source=../workflows/compose-lint.sh
source "$repo/.gitea/workflows/compose-lint.sh"
actual="$(cd "$scratch/repo" && compose_files)"
expected=$'app/compose.yaml\nnetbird/client.compose.yaml\npostgres/shared-compose.yaml\nrenovate/renovate-compose.yaml'
[ "$actual" = "$expected" ] || { echo 'Compose discovery missed a file' >&2; exit 1; }

cat >"$scratch/compose.yaml" <<'YAML'
services:
  example:
    image: busybox:1.37.0
    environment:
      REQUIRED: ${HOMELAB_TEST_REQUIRED:?required for this regression}
YAML
unset HOMELAB_TEST_REQUIRED
if validate_compose_file "$scratch/compose.yaml" >"$scratch/config.log" 2>&1; then
  echo 'Full Compose validation accepted a missing variable' >&2
  exit 1
fi
grep -q 'required for this regression' "$scratch/config.log"
HOMELAB_TEST_REQUIRED=present validate_compose_file "$scratch/compose.yaml"

cat >"$scratch/resources.json" <<'JSON'
{"kind":"List","items":[
  {"kind":"Deployment","metadata":{"namespace":"app"},"spec":{"template":{"spec":{
    "containers":[{"envFrom":[{"secretRef":{"name":"credentials"}},{"secretRef":{"name":"optional","optional":true}}],"env":[{"valueFrom":{"secretKeyRef":{"name":"credentials","key":"password"}}}]}],
    "initContainers":[{"envFrom":[{"secretRef":{"name":"init"}}]}],
    "imagePullSecrets":[{"name":"registry"}],
    "volumes":[{"secret":{"secretName":"mounted"}},{"projected":{"sources":[{"secret":{"name":"projected"}},{"secret":{"name":"optional-projected","optional":true}}]}}]
  }}}},
  {"kind":"CronJob","metadata":{},"spec":{"jobTemplate":{"spec":{"template":{"spec":{"containers":[{"envFrom":[{"secretRef":{"name":"cron"}}]}]}}}}}},
  {"kind":"IngressRoute","metadata":{"namespace":"app"},"spec":{"tls":{"secretName":"controller-issued-tls"}}}
]}
JSON
actual="$(jq -r -f "$repo/.gitea/workflows/secret-references.jq" "$scratch/resources.json" | sort)"
expected=$'app credentials\napp init\napp mounted\napp projected\napp registry\ndefault cron'
[ "$actual" = "$expected" ] || { echo "Unexpected Secret references: $actual" >&2; exit 1; }

REPO="$repo"
# shellcheck source=../workflows/deploy-lib.sh
source "$repo/.gitea/workflows/deploy-lib.sh"
K8S_MANIFESTS=("$scratch/resources.json")
KUSTOMIZE_APPS=()
# No live cluster access. Reject credentials in app even if they exist elsewhere.
kubectl() {
  case "$1" in
    create) cat "$scratch/resources.json" ;;
    get)
      if [ "$3" = credentials ] && [ "$5" = app ]; then
        return 1
      fi
      return 0
      ;;
    *) echo "Unexpected kubectl invocation: $*" >&2; return 1 ;;
  esac
}
if check_referenced_secrets >"$scratch/secrets.log"; then
  echo 'Namespace-scoped Secret check accepted a missing Secret' >&2
  exit 1
fi
grep -q 'MISSING OR UNREADABLE: app/credentials' "$scratch/secrets.log"
# API/rendering errors must not produce an empty reference list and pass.
kubectl() { return 1; }
if ! skip_uninstalled_vmagent_crd "$REPO/prometheus-stack/k8s/vmagent.yaml"; then
  echo 'VMAgent preflight did not skip an uninstalled CRD' >&2
  exit 1
fi
kubectl() { return 0; }
if skip_uninstalled_vmagent_crd "$REPO/prometheus-stack/k8s/vmagent.yaml"; then
  echo 'VMAgent preflight skipped an installed CRD' >&2
  exit 1
fi
if skip_uninstalled_vmagent_crd "$REPO/prometheus-stack/k8s/victoria.yaml"; then
  echo 'VMAgent preflight skipped an unrelated manifest' >&2
  exit 1
fi
kubectl() { return 1; }
if check_referenced_secrets >"$scratch/secrets.log"; then
  echo 'Secret check accepted a failed manifest render' >&2
  exit 1
fi

# New declared namespaces defer only their own resources during preflight.
render_selected_resources() {
  cat <<'JSON'
{"apiVersion":"v1","kind":"List","items":[
 {"apiVersion":"v1","kind":"Namespace","metadata":{"name":"new"}},
 {"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"new-config","namespace":"new"}},
 {"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"existing-config","namespace":"default"}}
]}
JSON
}
kubectl() {
  case "$1" in
    get) printf '%s\n' '{"items":[{"metadata":{"name":"default"}}]}' ;;
    apply) cat >"$scratch/server-input.json" ;;
    *) return 1 ;;
  esac
}
validate_server_resources true
jq -e '.items | length == 2 and all(.metadata.name != "new-config")' "$scratch/server-input.json" >/dev/null
if validate_server_resources false 2>"$scratch/deferred.log"; then
  echo 'Post-namespace validation accepted a missing namespace' >&2
  exit 1
fi
kubectl() {
  case "$1" in
    get) printf '%s\n' '{"items":[{"metadata":{"name":"default"}},{"metadata":{"name":"new"}}]}' ;;
    apply) cat >"$scratch/server-input.json" ;;
    *) return 1 ;;
  esac
}
validate_server_resources false
jq -e '.items | length == 3' "$scratch/server-input.json" >/dev/null
render_selected_resources() {
  printf '%s\n' '{"items":[{"kind":"ConfigMap","metadata":{"name":"bad","namespace":"undeclared"}}]}'
}
if validate_server_resources true 2>"$scratch/undeclared.log"; then
  echo 'Preflight accepted an undeclared missing namespace' >&2
  exit 1
fi
# Count services, not characters in the newline-separated service names.
compose() {
  case "$*" in
    *'config --format json') printf '%s\n' '{"services":{"headscale":{},"headplane":{},"web":{},"init":{"restart":"no"}}}' ;;
    *'ps --status running --services') printf '%s\n' headscale headplane web ;;
    *) return 1 ;;
  esac
}
verify_compose_stack example.yaml >"$scratch/compose-count.log"
grep -qF 'all 3 service(s) running' "$scratch/compose-count.log"
compose() {
  case "$*" in
    *'config --format json') printf '%s\n' '{"services":{"headscale":{},"headplane":{},"web":{}}}' ;;
    *'ps --status running --services') printf '%s\n' headscale headplane ;;
    *) return 0 ;;
  esac
}
if verify_compose_stack example.yaml >"$scratch/compose-missing.log"; then
  echo 'Compose verification accepted a missing service' >&2
  exit 1
fi
grep -qF 'NOT RUNNING: web' "$scratch/compose-missing.log"
printf '%s\n' 'Deploy validation regressions passed.'