diff.yml

name: Diff

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to render'
        required: true
        type: choice
        options:
          - development
          - staging
          - production
          - hub

permissions:
  contents: read

jobs:
  diff:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Install kustomize
        uses: imranismail/setup-kustomize@53f941b41dca13ed61874bbc6b4b6e1562877530 # v3

      - name: Install Helm
        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5

      - name: Render manifests
        run: |
          mkdir -p rendered
          find . -path "*/overlays/${{ inputs.environment }}/kustomization.yaml" -exec dirname {} \; | while read dir; do
            name=$(echo "$dir" | sed 's|^\./||' | tr '/' '-')
            echo "Rendering $dir ..."
            kustomize build --enable-helm "$dir" > "rendered/${name}.yaml" || exit 1
          done
          # Env-agnostic kustomize roots (no per-env overlays — same on every cluster).
          for dir in dashboards/base addons/bootstrap/secret-stores addons/bootstrap/secret-stores-managed; do
            name=$(echo "$dir" | sed 's|^\./||' | tr '/' '-')
            echo "Rendering $dir ..."
            kustomize build --enable-helm "$dir" > "rendered/${name}.yaml" || exit 1
          done
          echo "All manifests rendered."

      - name: Upload rendered manifests
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: rendered-${{ inputs.environment }}
          path: rendered/
          retention-days: 14