feat: Enhance GitHub Actions workflows and add YAML linting (#1020)

- Updated action descriptions for clarity in provision-k3s-vm-workers.
- Refactored steps in provision-k3s-vm-workers for improved readability.
- Adjusted permissions formatting in multiple workflows for consistency.
- Added YAML linting step in validate workflow to ensure YAML file quality.
- Introduced .yamllint configuration file for GitHub Actions YAML files.
- Enhanced Makefile to include a target for linting YAML files.

.github/workflows/build.yml

@@ -7,7 +7,7 @@ on:
     types: [opened, synchronize, reopened]
 
 permissions:
-    contents: read
+  contents: read
 
 env:
   GORELEASER_VERSION: v2.15.2
@@ -29,7 +29,7 @@ jobs:
       uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
       with:
         go-version-file: go.mod
-    
+
     - name: Set up QEMU
       uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
 

.github/workflows/chart.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 permissions:
-    contents: write
+  contents: write
 
 env:
   HELM_VERSION: v4.1.3
@@ -17,7 +17,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       with:
-          fetch-depth: 0
+        fetch-depth: 0
 
     - name: Configure Git
       run: |

.github/workflows/release-delete.yml

@@ -8,8 +8,8 @@ on:
         description: The tag of the release
 
 permissions:
-    contents: write
-    packages: write
+  contents: write
+  packages: write
 
 env:
   GH_TOKEN: ${{ github.token }}
@@ -22,10 +22,10 @@ jobs:
     - name: Check tag
       if: inputs.tag == ''
       run: echo "::error::Missing tag from input" && exit 1
-    
+
     - name: Checkout code
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-    
+
     - name: Check if release is draft
       run: |
         CURRENT_TAG=${{ inputs.tag }}
@@ -51,7 +51,7 @@ jobs:
 
           PACKAGE_ID=$(echo $PACKAGE_TO_DELETE | jq .id)
           echo "Deleting ${PACKAGE_ID}"
-          gh api --method DELETE /user/packages/container/${package}/versions/${PACKAGE_ID}  
+          gh api --method DELETE /user/packages/container/${package}/versions/${PACKAGE_ID}
         done
 
     - name: Delete Github release

.github/workflows/release.yml

@@ -11,9 +11,9 @@ on:
         description: Checkout a specific commit
 
 permissions:
-    contents: write
-    packages: write
-    id-token: write
+  contents: write
+  packages: write
+  id-token: write
 
 env:
   GORELEASER_VERSION: v2.15.2

.github/workflows/renovate-vault.yml

@@ -8,24 +8,24 @@ on:
         default: info
         type: choice
         options:
-          - info
-          - debug
+        - info
+        - debug
       overrideSchedule:
         description: "Override all schedules"
         required: false
         default: "false"
         type: choice
         options:
-          - "false"
-          - "true"
+        - "false"
+        - "true"
       configMigration:
         description: "Toggle PRs for config migration"
         required: false
         default: "true"
         type: choice
         options:
-          - "false"
-          - "true"
+        - "false"
+        - "true"
       renovateConfig:
         description: "Define a custom renovate config file"
         required: false
@@ -43,7 +43,7 @@ on:
         type: string
 
   schedule:
-    - cron: '30 4,6 * * 1-5'
+  - cron: '30 4,6 * * 1-5'
 
 permissions:
   contents: read

.github/workflows/test-conformance-hcp.yaml

@@ -2,7 +2,7 @@ name: Conformance Tests - HCP Mode
 
 on:
   schedule:
-    - cron: "0 1 * * *"
+  - cron: "0 1 * * *"
   workflow_dispatch:
     inputs:
       k3k_version:
@@ -14,13 +14,13 @@ on:
         required: false
         type: choice
         options:
-          - ""
-          - "v1.34.9"
-          - "v1.35.6"
-          - "v1.36.2"
+        - ""
+        - "v1.34.9"
+        - "v1.35.6"
+        - "v1.36.2"
 
 permissions:
-    contents: read
+  contents: read
 
 env:
   K8S_VERSIONS: "v1.34.9,v1.35.6,v1.36.2"
@@ -33,14 +33,14 @@ jobs:
     outputs:
       k8s_versions: ${{ steps.set-matrix.outputs.k8s_versions }}
     steps:
-      - id: set-matrix
-        run: |
-          if [[ -z "${{ inputs.k8s_version }}" ]]; then
-            JSON_ARRAY=$(jq -nc '"${{ env.K8S_VERSIONS }}" | split(",")')
-            echo "k8s_versions=${JSON_ARRAY}" >> "$GITHUB_OUTPUT"
-          else
-            echo "k8s_versions=[\"${{ inputs.k8s_version }}\"]" >> "$GITHUB_OUTPUT"
-          fi
+    - id: set-matrix
+      run: |
+        if [[ -z "${{ inputs.k8s_version }}" ]]; then
+          JSON_ARRAY=$(jq -nc '"${{ env.K8S_VERSIONS }}" | split(",")')
+          echo "k8s_versions=${JSON_ARRAY}" >> "$GITHUB_OUTPUT"
+        else
+          echo "k8s_versions=[\"${{ inputs.k8s_version }}\"]" >> "$GITHUB_OUTPUT"
+        fi
 
   conformance:
     needs: setup
@@ -77,7 +77,7 @@ jobs:
         rm -fr "${{ env.FILENAME }}" linux-amd64/helm
 
     - name: Install hydrophone
-      run: go install sigs.k8s.io/hydrophone@3de3e886a2f6f09635d8b981c195490af1584d97 #v0.7.0
+      run: go install sigs.k8s.io/hydrophone@3de3e886a2f6f09635d8b981c195490af1584d97 # v0.7.0
 
     - name: Install k3s
       env:
@@ -114,7 +114,7 @@ jobs:
         helm repo add k3k https://rancher.github.io/k3k
         helm repo update
         helm install --namespace k3k-system --create-namespace --version "${CHART_VERSION}" k3k k3k/k3k
-        
+
         wget -qO k3kcli "https://github.com/rancher/k3k/releases/download/${{ inputs.k3k_version }}/k3kcli-linux-amd64"
         sudo mv k3kcli /usr/local/bin/k3kcli
         sudo chmod +x /usr/local/bin/k3kcli

.github/workflows/test-conformance-shared.yaml

@@ -2,7 +2,7 @@ name: Conformance Tests - Shared Mode
 
 on:
   schedule:
-    - cron: "0 1 * * *"
+  - cron: "0 1 * * *"
   workflow_dispatch:
     inputs:
       k3k_version:
@@ -14,13 +14,13 @@ on:
         required: false
         type: choice
         options:
-          - ""
-          - "v1.34.9"
-          - "v1.35.6"
-          - "v1.36.2"
+        - ""
+        - "v1.34.9"
+        - "v1.35.6"
+        - "v1.36.2"
 
 permissions:
-    contents: read
+  contents: read
 
 env:
   K8S_VERSIONS: "v1.34.9,v1.35.6,v1.36.2"
@@ -35,14 +35,14 @@ jobs:
     outputs:
       k8s_versions: ${{ steps.set-matrix.outputs.k8s_versions }}
     steps:
-      - id: set-matrix
-        run: |
-          if [[ -z "${{ inputs.k8s_version }}" ]]; then
-            JSON_ARRAY=$(jq -nc '"${{ env.K8S_VERSIONS }}" | split(",")')
-            echo "k8s_versions=${JSON_ARRAY}" >> "$GITHUB_OUTPUT"
-          else
-            echo "k8s_versions=[\"${{ inputs.k8s_version }}\"]" >> "$GITHUB_OUTPUT"
-          fi
+    - id: set-matrix
+      run: |
+        if [[ -z "${{ inputs.k8s_version }}" ]]; then
+          JSON_ARRAY=$(jq -nc '"${{ env.K8S_VERSIONS }}" | split(",")')
+          echo "k8s_versions=${JSON_ARRAY}" >> "$GITHUB_OUTPUT"
+        else
+          echo "k8s_versions=[\"${{ inputs.k8s_version }}\"]" >> "$GITHUB_OUTPUT"
+        fi
 
   conformance:
     needs: setup
@@ -79,7 +79,7 @@ jobs:
         rm -fr "${{ env.FILENAME }}" linux-amd64/helm
 
     - name: Install hydrophone
-      run: go install sigs.k8s.io/hydrophone@3de3e886a2f6f09635d8b981c195490af1584d97 #v0.7.0
+      run: go install sigs.k8s.io/hydrophone@3de3e886a2f6f09635d8b981c195490af1584d97 # v0.7.0
 
     - name: Install k3d
       run: |
@@ -103,12 +103,12 @@ jobs:
         echo "127.0.0.1 ${REPO_NAME}" | sudo tee -a /etc/hosts
 
         k3d registry create ${REPO_NAME} --port ${REPO_PORT}
-        
+
         k3d cluster create k3k --servers 2 \
           --image rancher/k3s:${{ env.KUBERNETES_VERSION }}-k3s1 \
           -p "30000-30010:30000-30010@server:0" \
           --registry-use k3d-${REPO_NAME}:${REPO_PORT}
-        
+
         kubectl cluster-info
         kubectl get nodes
 
@@ -141,7 +141,7 @@ jobs:
         helm repo add k3k https://rancher.github.io/k3k
         helm repo update
         helm install --namespace k3k-system --create-namespace --version "${CHART_VERSION}" k3k k3k/k3k
-        
+
         wget -qO k3kcli "https://github.com/rancher/k3k/releases/download/${{ inputs.k3k_version }}/k3kcli-linux-amd64"
         sudo mv k3kcli /usr/local/bin/k3kcli
         sudo chmod +x /usr/local/bin/k3kcli
@@ -179,11 +179,11 @@ jobs:
         k3kcli kubeconfig generate --name mycluster
 
         export KUBECONFIG=${{ github.workspace }}/k3k-mycluster-mycluster-kubeconfig.yaml
-        
+
         kubectl cluster-info
         kubectl get nodes
         kubectl get pods -A
-    
+
     - name: Run conformance tests
       run: |
         hydrophone --conformance --parallel 4 \

.github/workflows/test-conformance-virtual.yaml

@@ -2,7 +2,7 @@ name: Conformance Tests - Virtual Mode
 
 on:
   schedule:
-    - cron: "0 1 * * *"
+  - cron: "0 1 * * *"
   workflow_dispatch:
     inputs:
       k3k_version:
@@ -14,13 +14,13 @@ on:
         required: false
         type: choice
         options:
-          - ""
-          - "v1.34.9"
-          - "v1.35.6"
-          - "v1.36.2"
+        - ""
+        - "v1.34.9"
+        - "v1.35.6"
+        - "v1.36.2"
 
 permissions:
-    contents: read
+  contents: read
 
 env:
   K8S_VERSIONS: "v1.34.9,v1.35.6,v1.36.2"
@@ -33,14 +33,14 @@ jobs:
     outputs:
       k8s_versions: ${{ steps.set-matrix.outputs.k8s_versions }}
     steps:
-      - id: set-matrix
-        run: |
-          if [[ -z "${{ inputs.k8s_version }}" ]]; then
-            JSON_ARRAY=$(jq -nc '"${{ env.K8S_VERSIONS }}" | split(",")')
-            echo "k8s_versions=${JSON_ARRAY}" >> "$GITHUB_OUTPUT"
-          else
-            echo "k8s_versions=[\"${{ inputs.k8s_version }}\"]" >> "$GITHUB_OUTPUT"
-          fi
+    - id: set-matrix
+      run: |
+        if [[ -z "${{ inputs.k8s_version }}" ]]; then
+          JSON_ARRAY=$(jq -nc '"${{ env.K8S_VERSIONS }}" | split(",")')
+          echo "k8s_versions=${JSON_ARRAY}" >> "$GITHUB_OUTPUT"
+        else
+          echo "k8s_versions=[\"${{ inputs.k8s_version }}\"]" >> "$GITHUB_OUTPUT"
+        fi
 
   conformance:
     needs: setup
@@ -77,7 +77,7 @@ jobs:
         rm -fr "${{ env.FILENAME }}" linux-amd64/helm
 
     - name: Install hydrophone
-      run: go install sigs.k8s.io/hydrophone@3de3e886a2f6f09635d8b981c195490af1584d97 #v0.7.0
+      run: go install sigs.k8s.io/hydrophone@3de3e886a2f6f09635d8b981c195490af1584d97 # v0.7.0
 
     - name: Install k3s
       env:
@@ -116,7 +116,7 @@ jobs:
         helm repo add k3k https://rancher.github.io/k3k
         helm repo update
         helm install --namespace k3k-system --create-namespace --version "${CHART_VERSION}" k3k k3k/k3k
-        
+
         wget -qO k3kcli "https://github.com/rancher/k3k/releases/download/${{ inputs.k3k_version }}/k3kcli-linux-amd64"
         sudo mv k3kcli /usr/local/bin/k3kcli
         sudo chmod +x /usr/local/bin/k3kcli
@@ -137,12 +137,12 @@ jobs:
       run: |
         k3kcli cluster create --mode=virtual --servers=2 mycluster
 
-        export KUBECONFIG=${{ github.workspace }}/k3k-mycluster-mycluster-kubeconfig.yaml        
-        
+        export KUBECONFIG=${{ github.workspace }}/k3k-mycluster-mycluster-kubeconfig.yaml
+
         kubectl cluster-info
         kubectl get nodes
         kubectl get pods -A
-    
+
     - name: Run conformance tests
       run: |
         hydrophone --conformance --parallel 4 \

.github/workflows/test-e2e.yaml

@@ -8,7 +8,7 @@ on:
   workflow_dispatch:
 
 permissions:
-    contents: read
+  contents: read
 
 env:
   KUBERNETES_VERSION: v1.36.2
@@ -29,12 +29,12 @@ jobs:
         go-version-file: go.mod
 
     - name: Install Ginkgo
-      run: go install github.com/onsi/ginkgo/v2/ginkgo@9ff1646a26f77a4c0d33ddba3e6368c42c0e8842 #v2.32.0
-    
+      run: go install github.com/onsi/ginkgo/v2/ginkgo@9ff1646a26f77a4c0d33ddba3e6368c42c0e8842 # v2.32.0
+
     - name: Setup environment
       run: |
         mkdir ${{ github.workspace }}/covdata
-        
+
         echo "COVERAGE=true" >> $GITHUB_ENV
         echo "GOCOVERDIR=${{ github.workspace }}/covdata" >> $GITHUB_ENV
         echo "REPO=ttl.sh/$(uuidgen)" >> $GITHUB_ENV
@@ -92,7 +92,7 @@ jobs:
         KUBECONFIG: /etc/rancher/k3s/k3s.yaml
         REPO: ${{ env.REPO }}
         VERSION: ${{ env.VERSION }}
-      run:  make E2E_LABEL_FILTER="e2e && !slow" test-e2e
+      run: make E2E_LABEL_FILTER="e2e && !slow" test-e2e
 
     - name: Convert coverage data
       run: go tool covdata textfmt -i=${GOCOVERDIR} -o ${GOCOVERDIR}/cover.out
@@ -161,12 +161,12 @@ jobs:
         go-version-file: go.mod
 
     - name: Install Ginkgo
-      run: go install github.com/onsi/ginkgo/v2/ginkgo@9ff1646a26f77a4c0d33ddba3e6368c42c0e8842 #v2.32.0
-    
+      run: go install github.com/onsi/ginkgo/v2/ginkgo@9ff1646a26f77a4c0d33ddba3e6368c42c0e8842 # v2.32.0
+
     - name: Setup environment
       run: |
         mkdir ${{ github.workspace }}/covdata
-        
+
         echo "COVERAGE=true" >> $GITHUB_ENV
         echo "GOCOVERDIR=${{ github.workspace }}/covdata" >> $GITHUB_ENV
         echo "REPO=ttl.sh/$(uuidgen)" >> $GITHUB_ENV
@@ -224,7 +224,7 @@ jobs:
         KUBECONFIG: /etc/rancher/k3s/k3s.yaml
         REPO: ${{ env.REPO }}
         VERSION: ${{ env.VERSION }}
-      run:  make E2E_LABEL_FILTER="e2e && slow" test-e2e
+      run: make E2E_LABEL_FILTER="e2e && slow" test-e2e
 
     - name: Convert coverage data
       run: go tool covdata textfmt -i=${GOCOVERDIR} -o ${GOCOVERDIR}/cover.out

.github/workflows/test.yaml

@@ -8,7 +8,7 @@ on:
   workflow_dispatch:
 
 permissions:
-    contents: read
+  contents: read
 
 env:
   KUBERNETES_VERSION: v1.36.2
@@ -50,12 +50,12 @@ jobs:
         go-version-file: go.mod
 
     - name: Install Ginkgo
-      run: go install github.com/onsi/ginkgo/v2/ginkgo@9ff1646a26f77a4c0d33ddba3e6368c42c0e8842 #v2.32.0
-    
+      run: go install github.com/onsi/ginkgo/v2/ginkgo@9ff1646a26f77a4c0d33ddba3e6368c42c0e8842 # v2.32.0
+
     - name: Setup environment
       run: |
         mkdir ${{ github.workspace }}/covdata
-        
+
         echo "COVERAGE=true" >> $GITHUB_ENV
         echo "GOCOVERDIR=${{ github.workspace }}/covdata" >> $GITHUB_ENV
         echo "REPO=ttl.sh/$(uuidgen)" >> $GITHUB_ENV

.github/workflows/validate.yml

@@ -14,28 +14,33 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    - name: Checkout code
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
-        with:
-          go-version-file: go.mod
-          cache: true
+    - name: Set up Go
+      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      with:
+        go-version-file: go.mod
+        cache: true
 
-      - name: Install Pandoc
-        run: sudo apt-get install pandoc
+    - name: Install Pandoc
+      run: sudo apt-get install pandoc
 
-      - name: Run linters
-        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
-        with:
-          version: v2.12.2
-          args: -v
-          only-new-issues: true
-          skip-cache: false
+    - name: Run linters
+      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+      with:
+        version: v2.12.2
+        args: -v
+        only-new-issues: true
+        skip-cache: false
 
-      - name: Run formatters
-        run: golangci-lint -v fmt ./...
+    - name: Run formatters
+      run: golangci-lint -v fmt ./...
 
-      - name: Validate
-        run: make validate
+    - name: Lint YAML
+      run: |
+        pipx install yamllint==1.38.0
+        make lint-yaml
+
+    - name: Validate
+      run: make validate