SilexConsulting/.github

Org-shared GitHub configuration and reusable CI workflows for the GitOps repos (gitops-control-plane, gitops-addons, gitops-workloads, gitops-private).

Reusable CI — .github/workflows/gitops-ci.yml (GIT-24)

Each repo has a thin caller workflow that invokes this one:

# .github/workflows/ci.yml
name: ci
on:
  pull_request:
  push:
    branches: [main]
jobs:
  ci:
    uses: SilexConsulting/.github/.github/workflows/gitops-ci.yml@main
    with:
      kubernetes: true
      terraform: false            # true only for gitops-control-plane
      terraform_dirs: ""          # e.g. "terraform/on-prem terraform/hub-spoke/hub terraform/hub-spoke/spokes"

Blocking gates: yamllint (relaxed), SOPS-encrypted check on *.enc.yaml, gitleaks, kustomize build of every overlay, kubeconform (with the community CRD catalogue for Argo CD / CNPG / External Secrets), and terraform fmt + validate.

Advisory (non-blocking in v1): tflint, checkov — tighten to blocking once the backlog is clean.

Run the same checks locally with pre-commit (.pre-commit-config.yaml in each repo).