1.8 KiB
GitOps validation
The orb owns .github/workflows/gitops.yml. The consumer keeps only the immutable caller generated by generate_auxiliary_workflow.py gitops --ref <orb-commit> at .github/workflows/validate.yml.
One native job downloads Kustomize 5.7.1 with its pinned official SHA-256 and renders every Kustomization, including bases, overlays and proxy declarations. Missing configurations or a failed render fail the job. Rendered resources are discarded rather than logged or uploaded because they may contain Secrets. This checks rendering, not Kubernetes schema compatibility or cluster health. No cluster access or publication credentials are required.
The caller runs on main pushes and pull requests without path filters, so a required check always reports. Superseded PR runs are canceled. Feature pushes do not create duplicate jobs. Remove the old Circle pipeline only after the native job passes on the consumer, then disable obsolete Circle build requests and require the observed native check with no human review.
For marketing-website-cd, the prior Circle job only printed Hello World. Its former production role moved to KofTwentyTwo/cluster-gitops; validation does not re-enable that retired deployment path.
The shared registry includes marketing-website-cd and voyage-cd. Daily enrollment recognizes their canonical main-branch caller without creating Circle configuration. Recognition requires a signed immutable worker pin matching the supported worker, a complete source tree, and no additional Circle or GitHub workflows. Enforcement requires the GitHub Actions app-bound gitops / validate gate and preserves existing branch rules. Unavailable private-repository protections remain an explicit enforcement failure; recognition alone is not enforcement.