Merge pull request #44047 from thaJeztah/validate_yaml

validate: add additional validation on YAML files

14 files changed, 62 insertions, 25 deletions

diff --git a/Dockerfile b/Dockerfile
index 9bb4ba4d66..1d2336f2a5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -350,7 +350,8 @@ RUN update-alternatives --set iptables  /usr/sbin/iptables-legacy  || true \
  && update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy || true \
  && update-alternatives --set arptables /usr/sbin/arptables-legacy || true
 
-RUN pip3 install yamllint==1.26.1
+ARG YAMLLINT_VERSION=1.27.1
+RUN pip3 install yamllint==${YAMLLINT_VERSION}
 
 COPY --from=dockercli     /build/ /usr/local/cli
 COPY --from=frozen-images /build/ /docker-frozen-images
diff --git a/hack/validate/.swagger-yamllint b/hack/validate/.swagger-yamllint
deleted file mode 100644
index 2f00cb666c..0000000000
--- a/hack/validate/.swagger-yamllint
+++ /dev/null
@@ -1,4 +0,0 @@
-extends: default
-rules:
-  document-start: disable
-  line-length: disable
diff --git a/hack/validate/all b/hack/validate/all
index 3224fe57c2..281684af0d 100755
--- a/hack/validate/all
+++ b/hack/validate/all
@@ -2,7 +2,7 @@
 #
 # Run all validation
 
-export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 . ${SCRIPTDIR}/default
 . ${SCRIPTDIR}/vendor
diff --git a/hack/validate/dco b/hack/validate/dco
index 0e61ccca5d..6354d2b57f 100755
--- a/hack/validate/dco
+++ b/hack/validate/dco
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
 adds=$(validate_diff --numstat | awk '{ s += $1 } END { print s }')
diff --git a/hack/validate/default b/hack/validate/default
index 88a4b95680..bb531770d1 100755
--- a/hack/validate/default
+++ b/hack/validate/default
@@ -2,12 +2,13 @@
 #
 # Run default validation, exclude vendor because it's slow
 
-export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # Skip DCO check here, as it's already checked in a separate stage in the Jenkinsfile
 #. "${SCRIPTDIR}"/dco
 . "${SCRIPTDIR}"/default-seccomp
 . "${SCRIPTDIR}"/pkg-imports
+. "${SCRIPTDIR}"/yamllint
 . "${SCRIPTDIR}"/swagger
 . "${SCRIPTDIR}"/swagger-gen
 . "${SCRIPTDIR}"/toml
diff --git a/hack/validate/default-seccomp b/hack/validate/default-seccomp
index c5f8c7e3c8..aea27d12af 100755
--- a/hack/validate/default-seccomp
+++ b/hack/validate/default-seccomp
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
 IFS=$'\n'
diff --git a/hack/validate/deprecate-integration-cli b/hack/validate/deprecate-integration-cli
index f53b48eedc..f7b273c9f7 100755
--- a/hack/validate/deprecate-integration-cli
+++ b/hack/validate/deprecate-integration-cli
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Check that no new tests are being added to integration-cli
 
-export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
 new_tests=$(
diff --git a/hack/validate/pkg-imports b/hack/validate/pkg-imports
index bba762d99f..c8ba223f63 100755
--- a/hack/validate/pkg-imports
+++ b/hack/validate/pkg-imports
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -e
 
-export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
 IFS=$'\n'
diff --git a/hack/validate/swagger b/hack/validate/swagger
index 5bf9c1cbcc..5313221b7b 100755
--- a/hack/validate/swagger
+++ b/hack/validate/swagger
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 set -e
-export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
 IFS=$'\n'
@@ -8,7 +8,7 @@ files=($(validate_diff --diff-filter=ACMR --name-only -- 'api/swagger.yaml' || t
 unset IFS
 
 if [ -n "${TEST_FORCE_VALIDATE:-}" ] || [ ${#files[@]} -gt 0 ]; then
-	LANG=C.UTF-8 yamllint -c "${SCRIPTDIR}"/.swagger-yamllint api/swagger.yaml
+	yamllint -f parsable -c "${SCRIPTDIR}"/yamllint.yaml api/swagger.yaml
 	if out=$(swagger validate api/swagger.yaml); then
 		echo "Congratulations!  ${out}"
 	else
diff --git a/hack/validate/swagger-gen b/hack/validate/swagger-gen
index 0d000ea39b..40631703cd 100755
--- a/hack/validate/swagger-gen
+++ b/hack/validate/swagger-gen
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
 IFS=$'\n'
diff --git a/hack/validate/toml b/hack/validate/toml
index 7f1739ab84..fe86cac1a7 100755
--- a/hack/validate/toml
+++ b/hack/validate/toml
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
 IFS=$'\n'
diff --git a/hack/validate/vendor b/hack/validate/vendor
index 1ffbb1a3c2..851bf6e249 100755
--- a/hack/validate/vendor
+++ b/hack/validate/vendor
@@ -1,20 +1,20 @@
 #!/usr/bin/env bash
 
-SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
-validate_vendor_diff(){
+validate_vendor_diff() {
 	IFS=$'\n'
-	check_files=( 'vendor.sum' 'vendor.mod' 'vendor/' )
+	check_files=('vendor.sum' 'vendor.mod' 'vendor/')
 	# shellcheck disable=SC2207
-	changed_files=( $(validate_diff --diff-filter=ACMR --name-only -- "${check_files[@]}" || true) )
+	changed_files=($(validate_diff --diff-filter=ACMR --name-only -- "${check_files[@]}" || true))
 	unset IFS
 
 	if [ -n "${TEST_FORCE_VALIDATE:-}" ] || [ "${#changed_files[@]}" -gt 0 ]; then
 		# recreate vendor/
 		./hack/vendor.sh
 		# check if any files have changed
-		diffs="$(git status --porcelain -- "${check_files[@]}" 2>/dev/null)"
+		diffs="$(git status --porcelain -- "${check_files[@]}" 2> /dev/null)"
 		mfiles="$(echo "$diffs" | awk '/^ M / {print $2}')"
 		if [ "$diffs" ]; then
 			{
@@ -24,7 +24,7 @@ validate_vendor_diff(){
 				echo
 				echo 'Please vendor your package with hack/vendor.sh.'
 				echo
-				if [ -n "$mfiles" ] ; then
+				if [ -n "$mfiles" ]; then
 					git diff -- "$mfiles"
 				fi
 			} >&2
@@ -41,11 +41,11 @@ validate_vendor_diff(){
 # 2. make sure all the packages contain license information (just warning, because it can cause false-positive)
 validate_vendor_used() {
 	for f in $(mawk '$1 = "#" { print $2 }' 'vendor/modules.txt'); do
-	if [ -d "vendor/$f" ]; then
-		if ! echo "vendor/$f"/* | grep -qiEc '/(LICENSE|COPYING)'; then
-		echo "WARNING: could not find copyright information for $f"
+		if [ -d "vendor/$f" ]; then
+			if ! echo "vendor/$f"/* | grep -qiEc '/(LICENSE|COPYING)'; then
+				echo "WARNING: could not find copyright information for $f"
+			fi
 		fi
-	fi
 	done
 }
 
diff --git a/hack/validate/yamllint b/hack/validate/yamllint
new file mode 100755
index 0000000000..1c663b1748
--- /dev/null
+++ b/hack/validate/yamllint
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -e
+SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPTDIR}/.validate"
+
+if [ -n "${TEST_FORCE_VALIDATE:-}" ]; then
+	files=(docs/api/*.yaml)
+else
+	IFS=$'\n'
+	files=($(validate_diff --diff-filter=ACMR --name-only -- docs/*.yaml || true))
+	unset IFS
+fi
+
+# validate the yamllint configuration file before anything else
+if out=$(yamllint -f parsable -d "{extends: default, rules: {document-start: disable}}" "${SCRIPTDIR}"/yamllint.yaml); then
+	echo "Congratulations! yamllint config file formatted correctly"
+else
+	echo "${out}" >&2
+	false
+fi
+
+# Then validate GitHub actions workflows, and conditionally lint the swagger
+# files in the docs directory, as these are large files and take some time.
+if out=$(yamllint -f parsable -c "${SCRIPTDIR}"/yamllint.yaml .github/workflows/*.yml "${files[@]}"); then
+	echo "Congratulations! YAML files are formatted correctly"
+else
+	echo "${out}" >&2
+	false
+fi
diff --git a/hack/validate/yamllint.yaml b/hack/validate/yamllint.yaml
new file mode 100644
index 0000000000..93a2b3b787
--- /dev/null
+++ b/hack/validate/yamllint.yaml
@@ -0,0 +1,10 @@
+extends: default
+locale: C.UTF-8
+rules:
+  document-start: disable
+  line-length: disable
+  # ignore "warning  truthy value should be one of [false, true]" on GitHub
+  # actions workflows, which use "on:" to specify when to run.
+  truthy:
+    ignore: |
+      .github/workflows/