# =============================================================================
# L0 STATIC — no plaintext secrets in git (R-SEC-01)
# Catalog: docs/14 L0 row, "Manifests/ServiceDefinitions obey invariants ...
#          no plaintext secrets" — runs in CI WITHOUT a cluster.
#
# GIVEN the repository as git tracks it,
# WHEN  every tracked file is inspected,
# THEN  every committed Secret is SOPS ciphertext, every ansible group_vars vault is
#       ansible-vault encrypted, no private key material is tracked, decryption is
#       delegated to an in-cluster SOPS key, and the L0 policy that rejects plaintext
#       Secrets exists, Enforces, and is proven by a negative test row to reject one.
#
# STATUS: EXECUTABLE. `check.sh` is a pure offline assertion script (git ls-files +
# PyYAML, no cluster, no network); conformance/run.sh --layer l0 and ci/l0.sh run it
# directly, and this Chainsaw Test wraps the SAME script so an in-cluster run executes
# the identical assertions. Encryption at rest is necessary but NOT sufficient: the
# runtime half of "decrypted only in-cluster", and a scan of git HISTORY, are named as
# explicit gaps in check.sh's header and are NOT claimed here.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: no-plaintext-secrets
  labels:
    conformance.home.k3s/R-SEC-01: "true"
  annotations:
    conformance.home.k3s/requirements: "R-SEC-01"
    conformance.home.k3s/layer: "L0"
    # WHOLE-REPO SCOPE. The invariant is literally universally quantified over the tracked
    # tree: `git ls-files` -> every file must be free of plaintext credentials. ANY new or
    # edited file in ANY subtree can break it, and most subtrees (apps/, docs/, infra/,
    # runbooks/, most of platform/) attribute NO requirement at all in
    # ci/touched-requirements.sh's path map — so requirement-scoped selection would filter
    # secret hygiene out of exactly the commit that pastes a password into a new manifest.
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      No secret is stored in plaintext in git: committed Secrets are SOPS ciphertext,
      ansible vaults are encrypted, no private key material is tracked, and the
      no-plaintext-secrets policy gate is enforced and proven to reject.
spec:
  steps:
    - name: scan-tracked-tree-for-plaintext-secrets
      description: >-
        Assert over the whole tracked tree that no secret material is stored in
        plaintext and that decryption is delegated to the in-cluster SOPS key.
      try:
        - script:
            content: bash ./check.sh