initial commit

scripts/ci/apply-bootstrap

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+event_name="${GITHUB_EVENT_NAME:-}"
+git_ref="${GITHUB_REF:-}"
+
+if [[ "$event_name" != "push" || "$git_ref" != "refs/heads/main" ]]; then
+  echo "Skipping bootstrap apply: only push events on main may apply"
+  exit 0
+fi
+
+if [[ ! -f bootstrap/config.yaml ]] || ! grep -Eq '^[[:space:]]*enabled:[[:space:]]*true[[:space:]]*$' bootstrap/config.yaml; then
+  echo "Skipping bootstrap apply: bootstrap/config.yaml is not enabled"
+  exit 0
+fi
+
+if [[ -z "${KUBECONFIG_B64:-}" ]]; then
+  echo "KUBECONFIG_B64 secret is required to apply bootstrap/applicationset.yaml"
+  exit 1
+fi
+
+curl -fsSL "https://dl.k8s.io/release/$(curl -fsSL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
+  -o /usr/local/bin/kubectl
+chmod +x /usr/local/bin/kubectl
+
+mkdir -p "${HOME}/.kube"
+printf '%s' "$KUBECONFIG_B64" | base64 -d > "${HOME}/.kube/config"
+
+if ! kubectl config current-context >/dev/null 2>&1; then
+  echo "Skipping bootstrap apply: kubeconfig secret is not usable in this runner"
+  exit 0
+fi
+
+kubectl apply -f bootstrap/applicationset.yaml

scripts/ci/perform-kubeconform

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+bootstrap_enabled=false
+if [ -f bootstrap/config.yaml ] && grep -Eq '^[[:space:]]*enabled:[[:space:]]*true[[:space:]]*$' bootstrap/config.yaml; then
+  bootstrap_enabled=true
+fi
+
+mapfile -t manifests < <(
+  find . -type f -name '*.yaml' \
+    ! -path './.gitea/*' \
+    ! -path './manifest/components/example-component/*' \
+    ! -name '*kustomization.yaml' \
+    ! -path './bootstrap/config.yaml' \
+    | sort
+)
+
+if [ "$bootstrap_enabled" != "true" ]; then
+  filtered=()
+  for manifest in "${manifests[@]}"; do
+    [ "$manifest" = "./bootstrap/applicationset.yaml" ] && continue
+    filtered+=("$manifest")
+  done
+  manifests=("${filtered[@]}")
+fi
+
+if [ "${#manifests[@]}" -eq 0 ]; then
+  echo "No manifests found"
+  exit 0
+fi
+
+printf '%s\n' "${manifests[@]}" \
+  | xargs kubeconform \
+      -strict \
+      -kubernetes-version 1.35.0 \
+      -schema-location default \
+      -schema-location 'http://gitea-ha-http.apps:3000/olb042/kubeconform/raw/branch/main/crdSchemas/{{ .ResourceKind }}_{{ .ResourceAPIVersion }}.json' \
+      -summary