#!/usr/bin/env bash
set -euo pipefail
dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
sh -n "$dir/install.sh"
bash -n "$dir/create-ci-kubeconfig.sh" "$dir/test.sh"
grep -Fxq 'cloudflare-api-credentials.yaml' "$dir/.gitignore"
if grep -R -q 'cloudflare-api-credentials' "$dir/.gitea/workflows"; then
  echo 'CI must never read or apply the ignored credential manifest.' >&2
  exit 1
fi
image=ghcr.io/yannh/kubeconform:v0.7.0@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c
for file in cloudflare.yaml http-issuer.yaml certificates.yaml; do docker run --rm -i "$image" -strict -exit-on-error -ignore-missing-schemas -summary < "$dir/$file"; done
docker run --rm -i "$image" -strict -exit-on-error -summary < "$dir/ci-deployer.yaml"
echo 'cert-manager configuration is valid; no credential file is tracked by CI.'