krel-release-notes-validate.yaml

# Copyright 2025 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Yaml Lint Release Notes
on:
  pull_request:
    paths:
      - releases/**/release-notes/**.yaml
      - releases/**/release-notes/**.yml
  # Allow manual triggering
  workflow_dispatch: { }

permissions: { }

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  krel_release_notes_validate_action:
    name: Validate release notes with krel
    runs-on: ubuntu-latest
    if: ${{ !github.event.pull_request.draft }}
    steps:
      - name: Check out code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          fetch-depth: 0
      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version: '1.23'
          check-latest: true
      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
        with:
          use-sudo: false
      - id: install-krel
        shell: bash
        run: |
          #!/bin/bash
          set -euo pipefail
          
          # Get the latest release version from GitHub API
          KREL_VERSION=$(curl -s https://api.github.com/repos/kubernetes/release/releases/latest | grep '"tag_name":' | cut -d'"' -f4)
          ARTIFACT_NAME=krel-amd64-linux
          TEMP_DIR=$(mktemp -d)
          cd "${TEMP_DIR}"

          echo "Downloading latest krel version ${KREL_VERSION}..."
          if ! curl -sL "https://github.com/kubernetes/release/releases/download/${KREL_VERSION}/${ARTIFACT_NAME}" -o krel; then
              echo "Failed to download krel"
              exit 1
          fi

          RELEASE_URL="https://github.com/kubernetes/release/releases/download/${KREL_VERSION}"
          COSIGN_IDENTITY="https://github.com/kubernetes/release/.github/workflows/release.yml@refs/tags/${KREL_VERSION}"
          COSIGN_ISSUER="https://token.actions.githubusercontent.com"

          echo "Using cosign to verify signature of krel version ${KREL_VERSION}"
          # Try new bundle format first (.sigstore.json), fall back to legacy .sig/.pem
          # Use curl -f to fail on HTTP 404 (GitHub returns HTML for missing assets)
          if curl -sfL "${RELEASE_URL}/${ARTIFACT_NAME}.sigstore.json" -o "${ARTIFACT_NAME}.sigstore.json" && \
              cosign verify-blob --bundle "${ARTIFACT_NAME}.sigstore.json" \
              --certificate-identity "${COSIGN_IDENTITY}" \
              --certificate-oidc-issuer "${COSIGN_ISSUER}" krel; then
              echo "Signature verified using sigstore bundle"
          elif cosign verify-blob \
              --certificate "${RELEASE_URL}/${ARTIFACT_NAME}.pem" \
              --signature "${RELEASE_URL}/${ARTIFACT_NAME}.sig" \
              --certificate-identity "${COSIGN_IDENTITY}" \
              --certificate-oidc-issuer "${COSIGN_ISSUER}" krel; then
              echo "Signature verified using legacy .sig/.pem"
          else
              echo "Signature verification failed for krel version: '${KREL_VERSION}'"
              exit 1
          fi

          chmod +x krel
          mkdir -p "${HOME}/.local/bin"
          mv krel "${HOME}/.local/bin/"
          cd - > /dev/null
          rm -rf "${TEMP_DIR}"

          KREL_PATH="${HOME}/.local/bin/krel"
          echo "krel-path=${KREL_PATH}" >> "${GITHUB_OUTPUT}"
          echo "Krel installed at: ${KREL_PATH}"
      - name: Run if releases YAML changes exist and validate the YAML
        id: validate_releases_yaml
        env:
          KREL_PATH: ${{ steps.install-krel.outputs.krel-path }}
        run: |
          # Get a list of changed YAML files based on git diff
          CHANGED_FILES=$(git diff --diff-filter=d --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }} -- releases/ | grep -E '\.ya?ml$' || true)

          if [ -n "${CHANGED_FILES}" ]; then
            echo "### YAML Validation Results :mag:" >> "${GITHUB_STEP_SUMMARY}"
            echo "Validating files against base SHA: ${{ github.event.pull_request.base.sha }}" >> "${GITHUB_STEP_SUMMARY}"

            INVALID_FILES=""

            while IFS= read -r file; do
              echo "#### Validating: ${file##*/}" >> "${GITHUB_STEP_SUMMARY}"
              set +e
              VALIDATION_OUTPUT=$("${KREL_PATH}" release-notes validate --path-to-release-notes "${file}" 2>&1)
              exit_code=$?
              set -e

              if [ "${exit_code}" -ne 0 ]; then
                  INVALID_FILES="${INVALID_FILES}- ${file##*/}\n"
                  echo "❌ Validation failed with the following errors:" >> "${GITHUB_STEP_SUMMARY}"
                  echo "\`\`\`" >> "${GITHUB_STEP_SUMMARY}"
                  echo "${VALIDATION_OUTPUT}" >> "${GITHUB_STEP_SUMMARY}"
                  echo "\`\`\`" >> "${GITHUB_STEP_SUMMARY}"
              else
                  echo "✅ File is valid" >> "${GITHUB_STEP_SUMMARY}"
              fi
            done <<< "${CHANGED_FILES}"

            if [ -n "${INVALID_FILES}" ]; then
              echo -e "\n### ❌ Validation Failed" >> "${GITHUB_STEP_SUMMARY}"
              echo "The following files contain invalid YAML:" >> "${GITHUB_STEP_SUMMARY}"
              echo -e "${INVALID_FILES}" >> "${GITHUB_STEP_SUMMARY}"
              exit 1
            fi
          else
            echo "### No YAML Changes Detected" >> "${GITHUB_STEP_SUMMARY}"
            echo "No YAML files were changed under /releases/*" >> "${GITHUB_STEP_SUMMARY}"
          fi