Automated validation and CI controls

Automated test suites ensure all documentation, manifests, and charts conform to security, schema, and link requirements.

Validation command suite

The complete validation pipeline runs via npm scripts:

Command	Description	What it checks
npm run validate	Master local validation suite	Runs npm run lint, npm run validate:links, npm run clear, npm run build, and npm run validate:build.
npm run lint	Composite linting check	TypeScript types (typecheck), markdown style rules (lint:markdown), public safety scan (lint:public-safety), and content metadata/schema validation (validate:content).
npm run lint:public-safety	Public safety scan	Defined forbidden-pattern scan that flags non-public hostnames, private IPs, internal endpoints, and sensitive test strings.
npm run validate:content	Content & schema verification	Parses YAML blocks, checks sensitive YAML field placeholder rules, validates custom resources and use-case merge fragments against repository validation schemas (schemas/anzo-v2.schema.json and schemas/anzograph-v2.schema.json), and checks SHA-256 hashes against schemas/sources.yaml.
npm run validate:links	External link validation	Tests external URL reachability, skipping unresolved template-marker URLs (containing < or ${).
npm run validate:build	Build output verification	Ensures all docs have corresponding HTML, sidebar mappings, sitemap entries, and static asset links.
npm run validate:release	Registry artifact check	Validates image and chart existence against artifacts.altair.com (requires credentials).
npm run validate:charts:local	Local chart rendering	Validates template rendering against four sibling local Helm chart checkouts (csi-helm-anzo, csi-helm-anzograph, csi-k8s-operator-anzo, csi-k8s-operator-anzograph).

CI controls and merge criteria

GitLab CI (.gitlab-ci.yml) enforces validation gates across discrete pipeline jobs rather than running a monolithic script:

• lint: Runs npm run lint (typecheck, lint:markdown, lint:public-safety, validate:content).
• check:external-links: Runs npm run validate:links to test external URL availability.
• scan:secrets: Executes Gitleaks against repository history using zricethezav/gitleaks to provide additional secret scanning.
• build: Runs npm run build and verifies build artifacts via npm run validate:build.

Pipeline jobs fail if any of the following conditions occur (protected-branch and project merge policies must require green pipelines before merge):

• Any YAML block in markdown or static examples fails to parse.
• Any custom resource example fails validation against its respective CRD schema.
• Markdown front matter omits required fields (title, description, product, deploymentModel, productRelease, status, lastValidated).
• Front matter status diverges from data/releases.yaml.
• Defined forbidden patterns (such as private IPs, internal registries, or test markers) appear in documentation or examples.
• Sensitive YAML fields omit required runtime placeholders.
• Repository history contains secrets detected by Gitleaks.
• Any document is orphaned from sidebars.ts.

For details on template and manifest variable structures, see the Template and secret contract.