# ci/yamllint.yaml — lint config for the yaml/lint gate stage.
# Kept under ci/ (not repo root) because WS-GITOPS(CI) owns only .gitea/ and ci/.
# Pass with: yamllint -c ci/yamllint.yaml <paths>
extends: default

yaml-files:
  - "*.yaml"
  - "*.yml"

# Machine-generated encrypted files — skip them:
#  - ansible-vault files are a `$ANSIBLE_VAULT;...` blob, not parseable YAML.
#  - SOPS-encrypted secrets (*.sops.yaml) are re-emitted by `sops` with its own indentation
#    and long ENC[...] / mac lines; they're never hand-edited, so linting them is noise.
ignore: |
  **/vault.yml
  **/*.sops.yaml

rules:
  # Kubernetes / Kustomize / Helm manifests routinely exceed 80 cols; allow room
  # but keep a sane ceiling so lines stay reviewable.
  line-length:
    max: 160
    level: warning
  # '---' at the top of multi-doc manifests is idiomatic; don't force it, don't ban it.
  document-start: disable
  # Helm/Kustomize templates and CRDs use 'on:', 'yes'/'no' keys legitimately.
  truthy:
    allowed-values: ["true", "false"]
    check-keys: false
  # Gitea/GitHub Actions expressions `${{ ... }}` and inline flow maps
  # (`with: { fetch-depth: 0 }`) legitimately carry a space inside braces.
  braces:
    max-spaces-inside: 1
    min-spaces-inside: 0
  comments:
    min-spaces-from-content: 1
  # Long inline comments in manifests are common.
  comments-indentation: disable
  indentation:
    spaces: 2
    indent-sequences: consistent