# =============================================================================
# L0 STATIC — no plaintext secrets in git (R-SEC-01)
# Catalog: docs/14 L0 row, "Manifests/ServiceDefinitions obey invariants ...
#          no plaintext secrets" — runs in CI WITHOUT a cluster.
#
# GIVEN the repository as git tracks it,
# WHEN  every tracked file is inspected,
# THEN  every committed Secret is SOPS ciphertext, every ansible group_vars vault is
#       ansible-vault encrypted, no private key material is tracked, decryption is
#       delegated to an in-cluster SOPS key, and the L0 policy that rejects plaintext
#       Secrets exists, Enforces, and is proven by a negative test row to reject one.
#
# STATUS: EXECUTABLE. `check.sh` is a pure offline assertion script (git ls-files +
# PyYAML, no cluster, no network); conformance/run.sh --layer l0 and ci/l0.sh run it
# directly, and this Chainsaw Test wraps the SAME script so an in-cluster run executes
# the identical assertions. Encryption at rest is necessary but NOT sufficient: the
# runtime half of "decrypted only in-cluster", and a scan of git HISTORY, are named as
# explicit gaps in check.sh's header and are NOT claimed here.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: no-plaintext-secrets
  labels:
    conformance.home.k3s/R-SEC-01: "true"
  annotations:
    conformance.home.k3s/requirements: "R-SEC-01"
    conformance.home.k3s/layer: "L0"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      No secret is stored in plaintext in git: committed Secrets are SOPS ciphertext,
      ansible vaults are encrypted, no private key material is tracked, and the
      no-plaintext-secrets policy gate is enforced and proven to reject.
spec:
  steps:
    - name: scan-tracked-tree-for-plaintext-secrets
      description: >-
        Assert over the whole tracked tree that no secret material is stored in
        plaintext and that decryption is delegated to the in-cluster SOPS key.
      try:
        - script:
            content: bash ./check.sh