Skip to content

kustomize-build.md

Latest commit

 

History

History
66 lines (54 loc) · 2.96 KB

kustomize-build.md

File metadata and controls

66 lines (54 loc) · 2.96 KB
Raw

kustomize-build

Build every Kustomize root found under the given paths. Reports all failing roots, not just the first, and writes a pass/fail table to the job summary.

Call

actionsforge/actions/.github/workflows/kustomize-build.yml@main

Example

name: Kustomize build
on:
  pull_request:
    paths:
      - "apps/**"
      - ".github/workflows/kustomize-build.yml"
permissions:
  contents: read
jobs:
  build:
    uses: actionsforge/actions/.github/workflows/kustomize-build.yml@main
    with:
      job-name: kustomize build (apps)
      paths: apps
      exclude: |
        */vendored/*

Example (several paths, Helm inflation)

jobs:
  build:
    uses: actionsforge/actions/.github/workflows/kustomize-build.yml@main
    with:
      paths: infrastructure shared
      exclude: |
        */vendored/*
        */experimental/*
      kustomize-args: --enable-helm

Inputs

Name Type Required Default Description
paths string yes - Whitespace- or newline-separated paths to search
exclude string no "" Newline-separated globs; a match skips that root
kustomize-args string no "" Extra args appended to each kustomize build
job-name string no kustomize build Job display name (appears in the check name)
runs-on string no ubuntu-latest Runner label
kustomize-version string no 5.8.1 kustomize release to install
kustomize-sha256 string no "" Tarball SHA-256 for this runner's OS/arch; empty verifies via the release checksums.txt

No secrets or outputs.

Notes

  • A root is any directory holding a file kustomize recognises (kustomization.yaml, kustomization.yml, or Kustomization). Overlays already pull in their bases, but building bases directly still catches mistakes in shared trees when a PR only touches base files.
  • Discovery uses git ls-files, so the repository must be checked out. Files ignored by .gitignore are skipped, and files generated by an earlier step in the same job are still picked up.
  • exclude patterns are shell globs matched against the file path, where * also spans /. So */vendored/* skips anything under a vendored directory at any depth.
  • The download is always verified. Set kustomize-sha256 for a hard pin; left empty, the tarball is checked against the checksums.txt published with that release, so version bumps and non-amd64 runners need no hand-maintained hashes.
  • No sudo. kustomize is installed into $RUNNER_TEMP and added via $GITHUB_PATH, so self-hosted runners without passwordless sudo work. Architecture comes from uname -m (amd64, arm64, ppc64le, s390x).
  • Self-contained. The build logic is inline in the workflow rather than fetched from a script in this repo, so pinning uses: ...@<sha> pins every line that executes.
  • A failing root prints kustomize's stderr beneath its FAIL line; rendered manifests are discarded.