docker-compose-validate.yml

---
# This workflow validates docker-compose configuration including syntax,
# service definitions, dependencies, and security best practices.
# It is called by the build.yml workflow.
name: Docker Compose Validate

on:
  workflow_call:

env:
  CI: true
  COMPOSE_VERSION: "v2.32.0"

permissions:
  contents: read

jobs:
  validate-compose:
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: 🔀 Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: 🔧 Install docker-compose
        uses: alexellis/arkade-get@1eef818e467c387d3f50cfe0d2c565d1cbe82b03  # master
        with:
          docker-compose: ${{ env.COMPOSE_VERSION }}

      - name: 📋 Validate docker-compose syntax
        run: |
          docker-compose config --quiet
          echo "✅ docker-compose.yml is valid"

          if [ -f docker-compose.prod.yml ]; then
            docker-compose -f docker-compose.yml -f docker-compose.prod.yml config --quiet
            echo "✅ docker-compose.prod.yml overlay is valid"
          fi

      - name: 🔍 Check docker-compose services
        run: |
          services=$(docker-compose config --services | sort | tr "\n" " " | sed "s/ $//")
          expected="api brainzgraphinator brainztableinator dashboard explore"
          expected="$expected extractor-discogs extractor-musicbrainz graphinator"
          expected="$expected insights neo4j postgres rabbitmq redis schema-init tableinator"

          if [ "$services" != "$expected" ]; then
            echo "❌ Service mismatch!"
            echo "Expected: $expected"
            echo "Got: $services"
            exit 1
          fi
          echo "✅ All expected services are defined"

      - name: 🔒 Validate service dependencies
        run: |
          # Check that services have correct dependencies
          deps=$(docker-compose config | yq eval '.services.dashboard.depends_on | keys | sort | join(" ")' -)
          if [ "$deps" != "api neo4j postgres rabbitmq redis schema-init" ]; then
            echo "❌ Dashboard should depend on api, neo4j, postgres, rabbitmq, redis, and schema-init"
            exit 1
          fi

          deps=$(docker-compose config | yq eval '.services.extractor-discogs.depends_on | keys | .[]' -)
          if [ "$deps" != "rabbitmq" ]; then
            echo "❌ Extractor-discogs should only depend on rabbitmq"
            exit 1
          fi

          deps=$(docker-compose config | yq eval '.services.extractor-musicbrainz.depends_on | keys | .[]' -)
          if [ "$deps" != "rabbitmq" ]; then
            echo "❌ Extractor-musicbrainz should only depend on rabbitmq"
            exit 1
          fi

          deps=$(docker-compose config | yq eval '.services.brainzgraphinator.depends_on | keys | sort | join(" ")' -)
          if [ "$deps" != "neo4j rabbitmq schema-init" ]; then
            echo "❌ Brainzgraphinator should depend on neo4j, rabbitmq, and schema-init"
            exit 1
          fi

          deps=$(docker-compose config | yq eval '.services.graphinator.depends_on | keys | sort | join(" ")' -)
          if [ "$deps" != "neo4j rabbitmq schema-init" ]; then
            echo "❌ Graphinator should depend on neo4j, rabbitmq, and schema-init"
            exit 1
          fi

          deps=$(docker-compose config | yq eval '.services.explore.depends_on | keys | sort | join(" ")' -)
          if [ "$deps" != "api schema-init" ]; then
            echo "❌ Explore should depend on api and schema-init"
            exit 1
          fi

          deps=$(docker-compose config | yq eval '.services.tableinator.depends_on | keys | sort | join(" ")' -)
          if [ "$deps" != "postgres rabbitmq schema-init" ]; then
            echo "❌ Tableinator should depend on postgres, rabbitmq, and schema-init"
            exit 1
          fi

          deps=$(docker-compose config | yq eval '.services.brainztableinator.depends_on | keys | sort | join(" ")' -)
          if [ "$deps" != "postgres rabbitmq schema-init" ]; then
            echo "❌ Brainztableinator should depend on postgres, rabbitmq, and schema-init"
            exit 1
          fi

          deps=$(docker-compose config | yq eval '.services.schema-init.depends_on | keys | sort | join(" ")' -)
          if [ "$deps" != "neo4j postgres" ]; then
            echo "❌ Schema-init should depend on neo4j and postgres"
            exit 1
          fi

          deps=$(docker-compose config | yq eval '.services.insights.depends_on | keys | sort | join(" ")' -)
          if [ "$deps" != "api postgres redis schema-init" ]; then
            echo "❌ Insights should depend on api, postgres, redis, and schema-init"
            exit 1
          fi

          deps=$(docker-compose config | yq eval '.services.api.depends_on | keys | sort | join(" ")' -)
          if [ "$deps" != "neo4j postgres redis schema-init" ]; then
            echo "❌ API should depend on neo4j, postgres, redis, and schema-init"
            exit 1
          fi

          echo "✅ Service dependencies are correct"

      - name: 🛡️ Check for security best practices
        run: |
          # Check that services run as non-root user
          for service in api brainzgraphinator brainztableinator dashboard explore \
            extractor-discogs extractor-musicbrainz graphinator insights schema-init tableinator; do
            user=$(docker-compose config | yq eval ".services.$service.user" -)
            if [ -z "$user" ] || [ "$user" = "null" ]; then
              echo "❌ $service should have a user configured"
              exit 1
            fi
          done
          echo "✅ All services run as non-root user"

          # Check security options
          for service in api brainzgraphinator brainztableinator dashboard explore \
            extractor-discogs extractor-musicbrainz graphinator insights schema-init tableinator; do
            security_opt=$(docker-compose config | yq eval ".services.$service.security_opt[]" - | grep "no-new-privileges:true" || true)
            if [ -z "$security_opt" ]; then
              echo "❌ $service should have no-new-privileges security option"
              exit 1
            fi
          done
          echo "✅ Security options are properly set"