From 0c44be9925eaca2197c9a433e06ccb85590f661d Mon Sep 17 00:00:00 2001 From: vptechops Date: Sun, 6 Sep 2026 06:29:34 -0500 Subject: [PATCH] =?UTF-8?q?ci:=20real=20HA=20load=20validation=20=E2=80=94?= =?UTF-8?q?=20check=5Fconfig=20in=20pinned=20container=20[#778]?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Boots HA 2026.8.3 against the repo config with CI-only stub secrets; catches bad Jinja/unknown keys/schema drift yamllint cannot see. Meat: https://projects.knownelement.com/issues/778 --- .gitea/workflows/ci.yml | 19 +++++++++++++++++++ tests/fixtures/secrets-stub.yaml | 7 +++++++ 2 files changed, 26 insertions(+) create mode 100644 tests/fixtures/secrets-stub.yaml diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 08e2cc6..29d85a1 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -26,3 +26,22 @@ jobs: run: | chmod +x tests/test_sdlc.sh bash tests/test_sdlc.sh + + # Real load validation: boots Home Assistant against the repo config and + # proves HA can parse + set up every integration (yamllint only proves the + # YAML parses; this catches unknown keys, bad Jinja, schema drift). + # Pinned to the version the box runs. Stub secrets are CI-only fixtures + # (tests/fixtures/secrets-stub.yaml) — never present on the live box. + config-check: + runs-on: ultix + container: + image: homeassistant/home-assistant:2026.8.3 + steps: + - uses: actions/checkout@v4 + - name: homeassistant check_config + run: | + cp tests/fixtures/secrets-stub.yaml secrets.yaml + python3 -m homeassistant --script check_config --config . + rc=$? + rm -f secrets.yaml home-assistant_v2.db home-assistant.log* + exit $rc diff --git a/tests/fixtures/secrets-stub.yaml b/tests/fixtures/secrets-stub.yaml new file mode 100644 index 0000000..4061fe5 --- /dev/null +++ b/tests/fixtures/secrets-stub.yaml @@ -0,0 +1,7 @@ +# CI-only stub for `homeassistant check_config` (see .gitea/workflows/ci.yml). +# NEVER copied to the live box. Values are syntactically-valid placeholders. +deploy_webhook_id: ci-stub-deploy-webhook +doorman_scan_webhook_id: ci-stub-scan-webhook +doorman_unlock_url: http://127.0.0.1:1/unlock-stub +gitea_auth_header: token ci-stub-gitea-token +kuma_push_url: http://127.0.0.1:1/push?status=up&msg=ci-stub