platform-ci/source_tools/scripts/manifest-verify.sh

#!/usr/bin/env bash
# Render declared Kustomize deployment roots with `kubectl kustomize` and fail on any render error.
# Offline by construction: no kubectl apply, no kubeconfig, no service account, no cluster call.
#
# env: INPUT_ROOTS       comma or whitespace separated workspace-relative directories (required)
#      INPUT_ENABLE_HELM true|false (default false); true needs the pinned helm on PATH
#      MANIFEST_OUT      output directory (default ci-manifests)
#      KUBECTL, HELM     binaries (default from PATH; tests substitute fakes)
set -u
here=$(cd "$(dirname "$0")" && pwd)
# shellcheck disable=SC1091
. "$here/../tools.env"

roots_in=${INPUT_ROOTS:-}
helm=${INPUT_ENABLE_HELM:-false}
out=${MANIFEST_OUT:-ci-manifests}
kubectl_bin=${KUBECTL:-kubectl}

fail() { echo "manifest-verify: $*" >&2; exit 1; }

[ "$helm" = true ] || [ "$helm" = false ] || fail "enable-helm must be true or false"
[ -L "$out" ] && fail "$out is a symlink"
command -v "$kubectl_bin" >/dev/null 2>&1 || fail "kubectl is not installed"
helm_args=()
if [ "$helm" = true ]; then
  helm_bin=$(command -v "${HELM:-helm}") || fail "enable-helm is declared but helm is not installed"
  have=$("$helm_bin" version --template '{{.Version}}' 2>/dev/null) || fail "cannot read helm version"
  [ "$have" = "v${HELM_VERSION}" ] || fail "helm $have is not the pinned v${HELM_VERSION}"
  helm_args=(--enable-helm --helm-command "$helm_bin")
fi

workspace=$(pwd -P)
roots=()
set -f
for raw in ${roots_in//,/ }; do
  root=${raw#./}; root=${root%/}
  [[ $root =~ ^[A-Za-z0-9._/-]+$ ]] || fail "unsafe root '$raw'"
  [[ $root =~ ^/ || $root =~ (^|/)\.\.(/|$) ]] && fail "root '$raw' must be a relative path inside the workspace"
  roots+=("$root")
done
set +f
[ "${#roots[@]}" -gt 0 ] || fail "no manifest roots declared"

rm -rf -- "$out"
mkdir -p "$out"
failed=0
count=0
for root in $(printf '%s\n' "${roots[@]}" | sort -u); do
  dir=$(cd -- "$root" 2>/dev/null && pwd -P) || { echo "manifest-verify: $root: not a directory" >&2; failed=1; continue; }
  case "$dir" in "$workspace"/*) ;; *) echo "manifest-verify: $root: resolves outside the workspace" >&2; failed=1; continue ;; esac
  file=""
  for name in kustomization.yaml kustomization.yml Kustomization; do
    [ -f "$dir/$name" ] && { file="$dir/$name"; break; }
  done
  [ -n "$file" ] || { echo "manifest-verify: $root: no kustomization file" >&2; failed=1; continue; }
  if grep -Eq '^kind:[[:space:]]*Component[[:space:]]*$' "$file"; then
    echo "manifest-verify: $root: is a Component, not a deployment root" >&2; failed=1; continue
  fi
  target="$out/${root//\//__}.yaml"
  # No credentials reach the render: kubectl kustomize only reads the filesystem.
  if ! env -u KUBECONFIG -u KUBERNETES_SERVICE_HOST "$kubectl_bin" kustomize "$dir" ${helm_args[@]+"${helm_args[@]}"} > "$target"; then
    echo "manifest-verify: $root: kustomize render failed" >&2; failed=1; continue
  fi
  grep -Eq '^kind:' "$target" || { echo "manifest-verify: $root: render produced no resources" >&2; failed=1; continue; }
  count=$((count + 1))
  echo "manifest-verify: $root: rendered $(grep -c '^kind:' "$target") resources"
done
echo "manifest-verify: $count of ${#roots[@]} roots rendered"
exit "$failed"