How to Run kubeconform on Manifests in GitHub Actions

By Kaveh Alemi·Latchkey

kubectl apply will happily reject a bad manifest in production; kubeconform catches the same errors in CI instead.

Install kubeconform and run it against your manifest directory, optionally with CRD schemas, to validate every file.

Steps

• Install kubeconform in the job.
• Point it at your manifest directory with strict mode.
• Add extra schema locations for any CRDs you use.
• Fail the job on any schema violation.

Workflow

name: Kubeconform
on: [pull_request]
jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: |
          curl -L https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz \
            | tar xz
          ./kubeconform -strict -summary k8s/

Notes

• CRDs need their own schema sources passed with -schema-location or they fail validation.
• Latchkey managed runners run these manifest validation jobs cheaper and self-heal mid-run.

Verify it actually works

A workflow that runs is not a workflow that works. Confirm the behaviour on a real event rather than on a manual dispatch, because trigger conditions, permissions, and context values all differ between the two.

# 1. validate the file before pushing
docker run --rm -v "$(pwd):/repo" --workdir /repo rhysd/actionlint:latest -color

# 2. trigger the real event, not workflow_dispatch
git commit --allow-empty -m "ci: verify trigger" && git push

# 3. watch it and read the conclusion, not just the colour
gh run watch
gh run view --log-failed

What usually goes wrong first

• The workflow file must exist on the default branch before scheduled or dispatch triggers appear at all.
• GITHUB_TOKEN permissions default to read-only in many organisations. Declare a permissions: block listing every scope the job needs.
• Fork pull requests get a read-only token and no access to secrets, regardless of workflow configuration.
• actions/checkout gives you depth 1 on a detached HEAD, so anything needing history or a branch name needs fetch-depth: 0.

Frequently asked questions

Related guides

References

• Kubernetes documentation
• GitHub Actions documentation