platform-ci/source_tools/scripts/blueprint-lint.sh

#!/usr/bin/env bash
# Authentik blueprint lint (cluster-gitops authentik-blueprint-lint parity). Runs the CENTRAL copy of
# lint-authentik-blueprints.py shipped with platform-ci, never the repository's own, so a pull request cannot
# weaken the gate it is judged by. Reads files only: no network, no credentials.
#
# env: INPUT_PATHS      comma or whitespace separated workspace-relative directories (required)
#      PYTHON           interpreter (default python3, must be >= 3.9)
#      PYYAML_DIR       directory holding the pinned `yaml` package (install-tool.sh pyyaml DEST puts it in DEST/lib)
#      PYYAML_EXPECT    PyYAML version to require (default PYYAML_VERSION from tools.env)
set -u
here=$(cd "$(dirname "$0")" && pwd)
# shellcheck disable=SC1091
. "$here/../tools.env"

fail() { echo "blueprint-lint: $*" >&2; exit 1; }

py=${PYTHON:-python3}
expect=${PYYAML_EXPECT:-$PYYAML_VERSION}
workspace=$(pwd -P)
paths=()
set -f
for raw in $(printf '%s' "${INPUT_PATHS:-}" | tr ',' ' '); do
  p=${raw#./}; p=${p%/}
  [[ $p =~ ^[A-Za-z0-9._/-]+$ ]] || fail "unsafe path '$raw'"
  [[ $p =~ ^/ || $p =~ (^|/)\.\.(/|$) ]] && fail "path '$raw' must be a relative path inside the workspace"
  dir=$(cd -- "$p" 2>/dev/null && pwd -P) || fail "$p: not a directory"
  case "$dir" in "$workspace"/*) ;; *) fail "$p: resolves outside the workspace" ;; esac
  paths+=("$p")
done
set +f
[ "${#paths[@]}" -gt 0 ] || fail "no blueprint paths declared"

command -v "$py" >/dev/null 2>&1 || fail "python3 is required (runner image has none and no pinned python is installed)"
"$py" -I -c 'import sys; sys.exit(0 if sys.version_info >= (3, 11) else 1)' || fail "python >= 3.11 is required"

# -s -B: no user site, no bytecode. PYTHONPATH carries only the pinned PyYAML; the cwd (repository) is not on sys.path
# because the script lives outside it.
pypath=""
[ -n "${PYYAML_DIR:-}" ] && pypath="$PYYAML_DIR/lib"
run_py() { PYTHONPATH="$pypath" PYTHONSTARTUP= PYTHONDONTWRITEBYTECODE=1 "$py" -P -s -B "$@"; }

have=$(run_py -c 'import yaml; print(yaml.__version__)' 2>/dev/null) || fail "PyYAML is not importable"
[ "$have" = "$expect" ] || fail "PyYAML $have is not the pinned $expect"

run_py "$here/lint-authentik-blueprints.py" --self-test || fail "linter self-test failed"
run_py "$here/lint-authentik-blueprints.py" "${paths[@]}" || fail "blueprint violations"