name: Validate Flux manifests

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  kustomize-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install kustomize
        # The act runner runs as root (no `sudo`). Download a pinned release
        # tarball directly with retries instead of piping the upstream installer
        # script through bash — the installer makes extra GitHub API calls that
        # are rate-limited/unreliable on this runner, and `curl -s` hid the
        # error (a silent exit 6 = could not resolve host).
        env:
          KUSTOMIZE_VERSION: "5.4.3"
        run: |
          set -euxo pipefail
          url="https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_linux_amd64.tar.gz"
          curl -fSL --retry 5 --retry-delay 3 --retry-all-errors -o /tmp/kustomize.tar.gz "$url"
          tar -xzf /tmp/kustomize.tar.gz -C /usr/local/bin kustomize
          kustomize version

      - name: kustomize build flux/
        run: kustomize build flux/ > /dev/null