TOOLING.md — tool + version matrix¶
Canonical tool list + stage + pin.
Mandatory toolchain¶
| Tool | Pin (target) | Purpose |
|---|---|---|
git |
latest | — |
git-lfs |
3.x | — |
gh |
2.89+ | GitHub CLI, PR/issue ops |
kubectl |
1.36.2 | k8s CLI (cluster target is 1.36.2) |
helm |
3.18.x | chart tooling |
kustomize |
5.4.0 | overlay tooling |
kubeseal |
0.27.3 | sealed-secrets client |
argocd |
3.3+ | GitOps CLI |
argo |
4.0.7 | Argo Workflows CLI; matches the deployed controller |
cilium |
latest stable | cilium CLI (matches cluster minor) |
hubble |
latest stable | flow observability |
terraform |
1.14.8 | IaC |
packer |
1.15.x | VM templates |
ansible |
2.20+ | node prep |
python |
3.14+ | hooks + scripts (CI pins 3.14; ansible-lint v26 requires it) |
node |
20 LTS+ | tooling |
jq, yq |
latest | parsing |
pre-commit |
4.0+ | hook runner |
gitleaks |
8.24+ | secret detection |
mise |
latest | per-repo version pinning |
Validation gates¶
| Tool | Stage | Scope | Pin |
|---|---|---|---|
kubeconform |
pre-commit, CI | yaml/k8s schema + CRDs | v0.6.7 |
kube-score |
pre-commit, CI | k8s best practices | v1.18.0 |
polaris |
CI | k8s security + reliability | v9.x |
helm lint |
pre-commit, CI | chart syntax | helm-native |
helm-unittest |
CI | rendered-template tests | v1.x |
promtool |
pre-commit | PrometheusRule alert unit tests (cluster/monitoring/tests/ and chart-owned apps/ai/litellm/promtool/) |
v3.13.1 |
argo lint |
CI | strict offline semantics for rendered Workflow-family objects | v4.0.7 |
helm-diff |
pre-push | upgrade preview | v3.x |
kyverno test |
CI | policy fixtures | v1.13+ |
tflint |
pre-commit, CI | terraform provider-aware lint | v0.50+ |
trivy |
pre-commit, CI | terraform + IaC security (replaces archived tfsec) |
latest |
checkov |
CI | IaC + helm + dockerfile | v3.x |
ansible-lint |
pre-commit, CI | ansible | v26.4+ |
yamllint |
pre-commit, CI | yaml style | v1.35+ |
markdownlint-cli2 |
pre-commit, CI | markdown | v0.14+ |
commitlint |
pre-commit commit-msg, CI |
conventional commits | v19+ |
shellcheck |
pre-commit, CI | shell lint | v0.10+ |
shfmt |
pre-commit | shell format | v3.10+ |
skopeo |
CI | verify image tags | v1.x |
promtool ships with Prometheus rather than a package; its pin tracks the
version kube-prometheus-stack deploys so unit tests use the same PromQL engine.
If it is not on PATH, set PROMTOOL or extract it into .workingdir2/cache/:
curl -sL https://github.com/prometheus/prometheus/releases/download/v3.13.1/prometheus-3.13.1.linux-amd64.tar.gz \
| tar xz -O prometheus-3.13.1.linux-amd64/promtool > .workingdir2/cache/promtool
chmod +x .workingdir2/cache/promtool