From 537facc883da982af7b32493ba6f7a5be5bbf6a9 Mon Sep 17 00:00:00 2001 From: Sunghyun Chun <233250359+sunghyun999@users.noreply.github.com> Date: Sun, 17 May 2026 12:25:11 +0900 Subject: [PATCH 1/3] feat(infra): add terraform, k8s lint ci --- .github/workflows/ci.yml | 75 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 71 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f2b579b669..ffd782d66a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,6 +29,8 @@ jobs: frontend: ${{ steps.filter.outputs.frontend }} infra_ansible: ${{ steps.filter.outputs.infra_ansible }} infra_ssh_keys: ${{ steps.filter.outputs.infra_ssh_keys }} + infra_k8s: ${{ steps.filter.outputs.infra_k8s }} + infra_terraform: ${{ steps.filter.outputs.infra_terraform }} steps: - uses: actions/checkout@v6 @@ -100,6 +102,12 @@ jobs: infra_ssh_keys: - *ci_workflow_path - 'infra/ansible/ssh_publickey/**' + infra_k8s: + - *ci_workflow_path + - 'infra/k8s/**' + infra_terraform: + - *ci_workflow_path + - 'infra/aws/**/*.tf' # =========================================================================== # Common @@ -449,8 +457,8 @@ jobs: # Infra # =========================================================================== - ansible-lint: - name: Ansible Lint + lint-ansible: + name: Lint Ansible needs: detect-changes if: needs['detect-changes'].outputs.infra_ansible == 'true' runs-on: ubuntu-latest @@ -462,6 +470,61 @@ jobs: with: working_directory: infra/ansible/ + lint-k8s: + name: Lint Kubernetes + needs: detect-changes + if: needs['detect-changes'].outputs.infra_k8s == 'true' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + + - uses: azure/setup-kubectl@v4 + + - name: Install kubeconform + run: | + curl -L -o kubeconform.tar.gz https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz + tar xf kubeconform.tar.gz + sudo mv kubeconform /usr/local/bin/ + + - name: Validate Kustomize manifests + shell: bash + run: | + set -euo pipefail + + find infra/k8s -name 'kustomization.y*ml' -print0 | + while IFS= read -r -d '' file; do + dir="$(dirname "$file")" + echo "Validating ${dir}" + kubectl kustomize "$dir" | kubeconform -strict -ignore-missing-schemas + done + + lint-terraform: + name: Lint Terraform + needs: detect-changes + if: needs['detect-changes'].outputs.infra_terraform == 'true' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + + - uses: hashicorp/setup-terraform@v3 + + - uses: terraform-linters/setup-tflint@v4 + + - name: Check Terraform format + run: terraform fmt -check -recursive infra/aws + + - name: Run TFLint + shell: bash + run: | + set -euo pipefail + + find infra/aws -name '*.tf' -printf '%h\n' | sort -u | + while read -r dir; do + echo "Linting ${dir}" + tflint --chdir="$dir" --init + tflint --chdir="$dir" + done + check-ssh-public-keys: name: Check SSH Public Keys needs: detect-changes @@ -615,7 +678,9 @@ jobs: - test-iris - test-plag - build-frontend - - ansible-lint + - lint-ansible + - lint-k8s + - lint-terraform - check-ssh-public-keys - validate-ci-workflow if: always() @@ -638,7 +703,9 @@ jobs: "test-iris:${{ needs['test-iris'].result }}" "test-plag:${{ needs['test-plag'].result }}" "build-frontend:${{ needs['build-frontend'].result }}" - "ansible-lint:${{ needs['ansible-lint'].result }}" + "lint-ansible:${{ needs['lint-ansible'].result }}" + "lint-k8s:${{ needs['lint-k8s'].result }}" + "lint-terraform:${{ needs['lint-terraform'].result }}" "check-ssh-public-keys:${{ needs['check-ssh-public-keys'].result }}" "validate-ci-workflow:${{ needs['validate-ci-workflow'].result }}" ) From 800a668245254c0e17dc5f6e8cf305e25a98d060 Mon Sep 17 00:00:00 2001 From: Sunghyun Chun <233250359+sunghyun999@users.noreply.github.com> Date: Sun, 17 May 2026 12:33:33 +0900 Subject: [PATCH 2/3] fix(infra): configure tflint required version exception --- .github/workflows/ci.yml | 5 +++-- .tflint.hcl | 4 ++++ 2 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 .tflint.hcl diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ffd782d66a..76e51a1fcb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -107,6 +107,7 @@ jobs: - 'infra/k8s/**' infra_terraform: - *ci_workflow_path + - '.tflint.hcl' - 'infra/aws/**/*.tf' # =========================================================================== @@ -521,8 +522,8 @@ jobs: find infra/aws -name '*.tf' -printf '%h\n' | sort -u | while read -r dir; do echo "Linting ${dir}" - tflint --chdir="$dir" --init - tflint --chdir="$dir" + tflint --chdir="$dir" --config "$GITHUB_WORKSPACE/.tflint.hcl" --init + tflint --chdir="$dir" --config "$GITHUB_WORKSPACE/.tflint.hcl" done check-ssh-public-keys: diff --git a/.tflint.hcl b/.tflint.hcl new file mode 100644 index 0000000000..dd57700b57 --- /dev/null +++ b/.tflint.hcl @@ -0,0 +1,4 @@ +# TODO: 각 Terraform 루트/모듈의 terraform 블록에 required_version을 명시한 뒤 이 예외를 제거합니다. +rule "terraform_required_version" { + enabled = false +} From 3d140a5e339d0aed0e11892abd9eeded7da278e7 Mon Sep 17 00:00:00 2001 From: Sunghyun Chun <233250359+sunghyun999@users.noreply.github.com> Date: Sun, 17 May 2026 12:51:23 +0900 Subject: [PATCH 3/3] fix(infra): disable temporary tflint rules --- .github/workflows/ci.yml | 10 +++++++--- .tflint.hcl | 4 ---- 2 files changed, 7 insertions(+), 7 deletions(-) delete mode 100644 .tflint.hcl diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 76e51a1fcb..7755cae1d4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -107,7 +107,6 @@ jobs: - 'infra/k8s/**' infra_terraform: - *ci_workflow_path - - '.tflint.hcl' - 'infra/aws/**/*.tf' # =========================================================================== @@ -518,12 +517,17 @@ jobs: shell: bash run: | set -euo pipefail + # TODO: 임시 예외입니다. 각 Terraform 루트/모듈에 required_version과 provider 버전 제약을 명시한 뒤 이 예외를 제거합니다. + disabled_rules=( + --disable-rule=terraform_required_version + --disable-rule=terraform_required_providers + ) find infra/aws -name '*.tf' -printf '%h\n' | sort -u | while read -r dir; do echo "Linting ${dir}" - tflint --chdir="$dir" --config "$GITHUB_WORKSPACE/.tflint.hcl" --init - tflint --chdir="$dir" --config "$GITHUB_WORKSPACE/.tflint.hcl" + tflint --chdir="$dir" "${disabled_rules[@]}" --init + tflint --chdir="$dir" "${disabled_rules[@]}" done check-ssh-public-keys: diff --git a/.tflint.hcl b/.tflint.hcl deleted file mode 100644 index dd57700b57..0000000000 --- a/.tflint.hcl +++ /dev/null @@ -1,4 +0,0 @@ -# TODO: 각 Terraform 루트/모듈의 terraform 블록에 required_version을 명시한 뒤 이 예외를 제거합니다. -rule "terraform_required_version" { - enabled = false -}