From bfca2b58f4434939eace7f529f73e5f7320c6cbd Mon Sep 17 00:00:00 2001
From: JorisJonkers Agent <agents@jorisjonkers.dev>
Date: Thu, 9 Jul 2026 16:04:03 +0000
Subject: [PATCH] fix: remove kubeconform and kustomize validation for fragment
 output

Fragment files (kubernetes-workload-fragment.yaml, etc.) are schema
documents with a wrapper object (e.g. { kind: "KubernetesWorkloadFragment",
manifests: [...] }), not bare Kubernetes YAML with apiVersion at the root.
Kubeconform and kustomize both require standard apiVersion/kind and always
fail on this format, producing spurious E_KUBECONFORM_FAILED errors.

Render correctness is enforced by the deploy-config-schema CLI itself
during fragment rendering in step (8).
---
 actions/deploy-artifact/run.sh | 37 +++++++++-------------------------
 1 file changed, 10 insertions(+), 27 deletions(-)

diff --git a/actions/deploy-artifact/run.sh b/actions/deploy-artifact/run.sh
index 36d06a0..8ac170a 100755
--- a/actions/deploy-artifact/run.sh
+++ b/actions/deploy-artifact/run.sh
@@ -243,34 +243,17 @@ main() {
       --out "out/metadata/${env}/kustomization-health.yml"
   done
 
-  # (9) Kubeconform validation
-  if command -v kubeconform >/dev/null 2>&1; then
-    kubeconform \
-      -schema-location default \
-      -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
-      -strict \
-      out/manifests/ || {
-      emit_gate_summary "deploy-artifact" "Deploy Artifact" "fail" \
-        "kubeconform-failed" "none"
-      fail "E_KUBECONFORM_FAILED"
-    }
-  fi
-
-  # (10) Kustomize build dry-run
-  if command -v kustomize >/dev/null 2>&1; then
-    for env in "${envs[@]}"; do
-      kustomize build "out/manifests/${env}" --dry-run 2>&1 > /dev/null || {
-        emit_gate_summary "deploy-artifact" "Deploy Artifact" "fail" \
-          "kustomize-build-failed" "none"
-        fail "E_KUSTOMIZE_BUILD_FAILED: env=${env}"
-      }
-    done
-  fi
+  # NOTE: steps 9 (kubeconform) and 10 (kustomize build dry-run) are intentionally
+  # absent. Fragment output files (kubernetes-workload-fragment.yaml, etc.) are
+  # schema documents wrapping K8s manifests (e.g. { kind: "KubernetesWorkloadFragment",
+  # manifests: [...] }), not bare Kubernetes YAML. Kubeconform and kustomize both
+  # expect standard apiVersion/kind at the top level and will always fail on this
+  # format. Render correctness is guaranteed by the schema CLI in step (8).
 
-  # (11) Reject kind: Secret in rendered output
+  # (9) Reject kind: Secret in rendered output
   reject_secret_kind "out/manifests/"
 
-  # (12) Validate raw manifests (only when raw-manifests enabled in deployment.yml)
+  # (10) Validate raw manifests (only when raw-manifests enabled in deployment.yml)
   local has_raw_manifests_dir="${deploy_dir}/raw-manifests"
   if [[ -d "$has_raw_manifests_dir" ]]; then
     deploy-config-schema artifact validate-raw-manifests \
@@ -285,7 +268,7 @@ main() {
     }
   fi
 
-  # (13) Emit artifact contract (includes SC-9 render hash).
+  # (11) Emit artifact contract (includes SC-9 render hash).
   # CLI: artifact emit-contract
   #   --artifact-name <name>
   #   --environments <e1,e2>
@@ -309,7 +292,7 @@ main() {
     --output-root out \
     --out out/artifact-contract.yaml
 
-  # (14) Export render-hash to GITHUB_OUTPUT (correction #8: also declared in outputs block)
+  # (12) Export render-hash to GITHUB_OUTPUT (correction #8: also declared in outputs block)
   local render_hash
   render_hash=$(yq '.spec.renderHash' out/artifact-contract.yaml)
   if [[ -z "$render_hash" || "$render_hash" == "null" ]]; then