validate-examples.yml

# © 2026 NetApp, Inc. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0
# See the NOTICE file in the repo root for trademark and attribution details.

name: Validate Examples

on:
  push:
    branches: [main]
    paths:
      - "ansible/**"
      - "terraform/**"
      - "go/**"
  pull_request:
    branches: [main]
    paths:
      - "ansible/**"
      - "terraform/**"
      - "go/**"

permissions:
  contents: read

jobs:
  ansible-lint:
    name: Ansible — syntax & lint
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      # Pinned for the same reason as requirements-dev.txt: an ansible-lint
      # release should not be able to fail main on its own. Bumped by Dependabot.
      - name: Install Ansible toolchain
        run: pip install ansible==14.3.0 ansible-lint==26.8.0

      - name: Install collections for every product
        run: |
          for req in $(find ansible -name requirements.yml | sort); do
            echo "Installing from $req …"
            ansible-galaxy collection install -r "$req"
          done

      # Playbooks live under ansible/<product>/ (and ansible/<product>/<deployment>/),
      # so each playbook is checked against the inventory of its own product.
      - name: Syntax check playbooks
        run: |
          FOUND=0
          for inv in $(find ansible -path '*/inventory/hosts.yml' | sort); do
            root=$(dirname "$(dirname "$inv")")
            echo "=== $root ==="
            for f in $(find "$root" -maxdepth 1 -name '*.yml' ! -name requirements.yml | sort); do
              FOUND=$((FOUND + 1))
              echo "Checking $f …"
              ansible-playbook --syntax-check "$f" -i "$inv"
            done
          done
          if [ "$FOUND" -eq 0 ]; then
            echo "::error::No playbooks found under ansible/ — check the directory layout"
            exit 1
          fi

      - name: Run ansible-lint
        run: |
          ansible-lint --profile min $(find ansible -name '*.yml' ! -name requirements.yml \
            ! -path '*/inventory/*' ! -path '*/group_vars/*' | sort)

  terraform-validate:
    name: Terraform — fmt, validate & lint
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
        with:
          terraform_version: "1.7"

      - name: Install tflint
        run: |
          curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash

      # Modules are discovered by looking for .tf files, so product folders
      # without modules yet are skipped rather than failing init/validate.
      - name: Validate Terraform modules
        run: |
          ERRORS=0
          FOUND=0
          for dir in $(find terraform -name '*.tf' -exec dirname {} \; | sort -u); do
            FOUND=$((FOUND + 1))
            echo "=== $dir ==="

            echo "  fmt check …"
            if ! terraform -chdir="$dir" fmt -check; then
              echo "  FAIL: terraform fmt"
              ERRORS=$((ERRORS + 1))
            fi

            echo "  init …"
            terraform -chdir="$dir" init -backend=false -input=false > /dev/null 2>&1 || true

            echo "  validate …"
            if ! terraform -chdir="$dir" validate; then
              echo "  FAIL: terraform validate"
              ERRORS=$((ERRORS + 1))
            fi

            echo "  tflint …"
            if ! tflint --chdir="$dir" --no-color; then
              echo "  WARN: tflint reported issues"
            fi

            echo ""
          done

          if [ "$FOUND" -eq 0 ]; then
            echo "::error::No Terraform modules found — check the directory layout"
            exit 1
          fi
          [ "$ERRORS" -eq 0 ] || exit 1

  go-vet:
    name: Go — vet & build-check
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # No go.sum exists - the examples are standard-library only - so the cache
      # is keyed on go.mod instead. See the matching note in ci.yml.
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go/go.mod
          cache-dependency-path: go/go.mod

      - name: go vet
        working-directory: go
        run: go vet ./...

      # Programs live under go/<product>/<use_case>/, so main.go is found
      # recursively from the module root.
      - name: Build-check all programs
        working-directory: go
        run: |
          ERRORS=0
          FOUND=0
          for dir in $(find . -name main.go -exec dirname {} \; | sort); do
            FOUND=$((FOUND + 1))
            echo "Building ${dir} …"
            (cd "${dir}" && go build -o /dev/null .) || ERRORS=$((ERRORS + 1))
          done
          if [ "$FOUND" -eq 0 ]; then
            echo "::error::No Go programs found — check the directory layout"
            exit 1
          fi
          [ "$ERRORS" -eq 0 ] || exit 1