feat: Commit initial

.forgejo/workflows/ci.yml

@@ -0,0 +1,140 @@
+name: CI - Validation
+
+on:
+  push:
+    branches: ['**']  # All branches
+  pull_request:
+
+jobs:
+  ci-terraform:
+    name: Terraform Validation
+    runs-on: self-hosted
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup OpenTofu
+        run: |
+          if ! command -v tofu &> /dev/null; then
+            curl -fsSL https://get.opentofu.org/install-opentofu.sh | bash
+          fi
+
+      - name: Terraform Format Check
+        run: |
+          cd terraform
+          tofu fmt -check -recursive
+        continue-on-error: false
+
+      - name: Terraform Validate
+        run: |
+          cd terraform
+          tofu init -backend=false
+          tofu validate
+
+      - name: Terraform Plan
+        if: github.event_name == 'push'
+        run: |
+          cd terraform
+          cp terraform.tfvars.example terraform.tfvars
+          tofu init
+          tofu plan -out=tfplan
+        env:
+          TF_VAR_proxmox_token_id: ${{ secrets.PROXMOX_TOKEN_ID }}
+          TF_VAR_proxmox_token_secret: ${{ secrets.PROXMOX_TOKEN_SECRET }}
+          TF_VAR_ssh_public_key: ${{ secrets.SSH_PUBLIC_KEY }}
+          TF_VAR_forgejo_token: ${{ secrets.FORGEJO_TOKEN }}
+
+      - name: Upload Terraform Plan
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@v4
+        with:
+          name: tfplan
+          path: terraform/tfplan
+          retention-days: 1
+
+  ci-ansible:
+    name: Ansible Validation
+    runs-on: self-hosted
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Ansible
+        run: |
+          if ! command -v ansible &> /dev/null; then
+            sudo apt-get update
+            sudo apt-get install -y ansible
+          fi
+
+      - name: Ansible Syntax Check
+        run: |
+          ansible-playbook ansible/site.yml --syntax-check
+
+      - name: Ansible Lint
+        run: |
+          if ! command -v ansible-lint &> /dev/null; then
+            pip3 install ansible-lint
+          fi
+          ansible-lint ansible/ || true
+        continue-on-error: true
+
+      - name: YAML Lint
+        run: |
+          if ! command -v yamllint &> /dev/null; then
+            pip3 install yamllint
+          fi
+          yamllint ansible/ || true
+        continue-on-error: true
+
+  ci-kubernetes:
+    name: Kubernetes Validation
+    runs-on: self-hosted
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install kubectl
+        run: |
+          if ! command -v kubectl &> /dev/null; then
+            curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
+            sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
+          fi
+
+      - name: Validate Kubernetes Manifests
+        run: |
+          kubectl apply --dry-run=client -f kubernetes/apps/ -R || true
+          kubectl apply --dry-run=client -f kubernetes/flux-system/ -R || true
+
+      - name: Install kubeconform
+        run: |
+          if ! command -v kubeconform &> /dev/null; then
+            wget https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz
+            tar xf kubeconform-linux-amd64.tar.gz
+            sudo mv kubeconform /usr/local/bin/
+          fi
+
+      - name: Kubeconform Validation
+        run: |
+          kubeconform -strict -ignore-missing-schemas kubernetes/ || true
+        continue-on-error: true
+
+  security-scan:
+    name: Security Scan
+    runs-on: self-hosted
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Trivy
+        run: |
+          if ! command -v trivy &> /dev/null; then
+            wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
+            echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
+            sudo apt-get update
+            sudo apt-get install -y trivy
+          fi
+
+      - name: Run Trivy IaC Scan
+        run: |
+          trivy config . --exit-code 0 --severity HIGH,CRITICAL
+        continue-on-error: true