From ff930da47e2025a4ebc507b3a635860a7a9ef25b Mon Sep 17 00:00:00 2001 From: Noel Sharpe Date: Sun, 9 Aug 2026 17:22:46 +0100 Subject: [PATCH 1/5] GIT-24: CI caller workflow + pre-commit + yamllint (uses shared reusable gitops-ci) --- .github/workflows/ci.yml | 11 +++++++++++ .pre-commit-config.yaml | 23 +++++++++++++++++++++++ .yamllint | 5 +++++ 3 files changed, 39 insertions(+) create mode 100644 .github/workflows/ci.yml create mode 100644 .pre-commit-config.yaml create mode 100644 .yamllint diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..12d7152 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,11 @@ +name: ci +on: + pull_request: + push: + branches: [main] +jobs: + ci: + uses: SilexConsulting/.github/.github/workflows/gitops-ci.yml@main + with: + kubernetes: true + terraform: false diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..7fbb7c4 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,23 @@ +# Local mirror of the shared CI (GIT-24). Run: pipx install pre-commit && pre-commit run -a +repos: + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v5.0.0 + hooks: + - id: trailing-whitespace + - id: end-of-file-fixer + - id: check-merge-conflict + - repo: https://github.com/adrienverge/yamllint + rev: v1.35.1 + hooks: + - id: yamllint + - repo: https://github.com/gitleaks/gitleaks + rev: v8.21.2 + hooks: + - id: gitleaks + - repo: local + hooks: + - id: sops-encrypted + name: "sops-encrypted (*.enc.yaml must be encrypted)" + entry: bash -c 'for f in "$@"; do grep -q "sops:" "$f" || grep -q "ENC\[" "$f" || { echo "not encrypted: $f"; exit 1; }; done' -- + language: system + files: '\.enc\.yaml$' diff --git a/.yamllint b/.yamllint new file mode 100644 index 0000000..d2756f8 --- /dev/null +++ b/.yamllint @@ -0,0 +1,5 @@ +extends: relaxed +rules: + line-length: disable + trailing-spaces: enable + new-line-at-end-of-file: enable From 0efbc20a7895a5ea37ce81a0fc9cdf1aa840c50a Mon Sep 17 00:00:00 2001 From: Noel Sharpe Date: Sun, 9 Aug 2026 17:30:25 +0100 Subject: [PATCH 2/5] GIT-24: fix pre-commit YAML + yamllint (ignore helm templates, cosmetic=warning) --- .pre-commit-config.yaml | 6 +++--- .yamllint | 13 +++++++++++-- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 7fbb7c4..96ef092 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -17,7 +17,7 @@ repos: - repo: local hooks: - id: sops-encrypted - name: "sops-encrypted (*.enc.yaml must be encrypted)" - entry: bash -c 'for f in "$@"; do grep -q "sops:" "$f" || grep -q "ENC\[" "$f" || { echo "not encrypted: $f"; exit 1; }; done' -- + name: "sops-encrypted (enc.yaml must be encrypted)" + entry: "bash -c 'for f in \"$@\"; do grep -Eq \"sops:|ENC\\[\" \"$f\" || { echo \"not-encrypted $f\"; exit 1; }; done' --" language: system - files: '\.enc\.yaml$' + files: "\\.enc\\.yaml$" diff --git a/.yamllint b/.yamllint index d2756f8..baea090 100644 --- a/.yamllint +++ b/.yamllint @@ -1,5 +1,14 @@ extends: relaxed rules: line-length: disable - trailing-spaces: enable - new-line-at-end-of-file: enable + document-start: disable + trailing-spaces: + level: warning + new-line-at-end-of-file: + level: warning +# Helm chart templates and encrypted files are not plain YAML. +ignore: | + **/charts/** + **/templates/** + *.enc.yaml + demo/** From f97b58e2e6191d8ae8b86250b2e0f7acb83e9a5b Mon Sep 17 00:00:00 2001 From: Noel Sharpe Date: Sun, 9 Aug 2026 17:36:17 +0100 Subject: [PATCH 3/5] GIT-24: gitleaks allowlist (example secrets.yaml template + SOPS *.enc.yaml) --- .gitleaks.toml | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 .gitleaks.toml diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 0000000..9b3f8d3 --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,11 @@ +# gitleaks config for CI (GIT-24). Extends the default ruleset; allowlists files that +# legitimately contain key-shaped placeholders or ciphertext (not real plaintext secrets). +[extend] +useDefault = true + +[allowlist] +description = "Documented example secret template + SOPS-encrypted files" +paths = [ + '''bootstrap/argocd/secrets\.yaml$''', # example (real secrets live in secrets.enc.yaml, SOPS) + '''.*\.enc\.yaml$''', # SOPS-encrypted +] From 840e9eb64137909cb8ed2f162ffd0ced0ea44741 Mon Sep 17 00:00:00 2001 From: Noel Sharpe Date: Sun, 9 Aug 2026 18:18:39 +0100 Subject: [PATCH 4/5] =?UTF-8?q?GIT-24:=20restore=20original=20pre-commit?= =?UTF-8?q?=20hooks=20(check-yaml,=20markdownlint,=20shellcheck,=20prettie?= =?UTF-8?q?r)=20=E2=80=94=20union,=20not=20replace?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .pre-commit-config.yaml | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 96ef092..b2bcf00 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,15 +1,32 @@ -# Local mirror of the shared CI (GIT-24). Run: pipx install pre-commit && pre-commit run -a +# Local checks (union of the repo's original hooks + GIT-24 additions). repos: - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v5.0.0 + rev: v4.6.0 hooks: - id: trailing-whitespace - id: end-of-file-fixer - id: check-merge-conflict + - id: check-yaml + args: [--allow-multiple-documents] - repo: https://github.com/adrienverge/yamllint rev: v1.35.1 hooks: - id: yamllint + - repo: https://github.com/igorshubovych/markdownlint-cli + rev: v0.41.0 + hooks: + - id: markdownlint + - repo: https://github.com/shellcheck-py/shellcheck-py + rev: v0.10.0.1 + hooks: + - id: shellcheck + - repo: https://github.com/pre-commit/mirrors-prettier + rev: v3.3.3 + hooks: + - id: prettier + additional_dependencies: + - prettier@3.3.3 + types_or: [yaml, markdown] - repo: https://github.com/gitleaks/gitleaks rev: v8.21.2 hooks: From 933dba82d42c9cf9a219836a9998e4c354fed238 Mon Sep 17 00:00:00 2001 From: Noel Sharpe Date: Sun, 9 Aug 2026 18:26:42 +0100 Subject: [PATCH 5/5] GIT-24: relaxed .markdownlint.json (disable pre-existing violations; tightened in follow-up) --- .markdownlint.json | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 .markdownlint.json diff --git a/.markdownlint.json b/.markdownlint.json new file mode 100644 index 0000000..b1cfa6d --- /dev/null +++ b/.markdownlint.json @@ -0,0 +1,17 @@ +{ + "default": true, + "MD001": false, + "MD009": false, + "MD012": false, + "MD013": false, + "MD022": false, + "MD025": false, + "MD026": false, + "MD031": false, + "MD032": false, + "MD033": false, + "MD034": false, + "MD040": false, + "MD041": false, + "MD060": false +}