gitops-check

Validate GitOps repository structure before the reconciliation loop runs.

Most teams call their deployment process GitOps. What they have is a Git repository with a deploy script. The reconciliation loop, secret externalization, and controller configuration are the parts that make it real. This tool checks whether they exist.

What it checks

• Controller detection — ArgoCD or Flux present in the repo
• Secret externalization — Sealed Secrets, SOPS, or External Secrets (not plaintext)
• Plaintext secret scan — passwords, tokens, API keys, private keys in Git
• Config separation — config repo distinct from app code repo

Usage

python gitops_check.py /path/to/gitops-repo
python gitops_check.py /path/to/gitops-repo --report
python gitops_check.py /path/to/gitops-repo --json

Output

GitOps Check: /path/to/repo
  Controller: argocd
  Secrets externalized: YES
  Plaintext secrets: 0
  Config separated from app code: YES
  Score: 90/100
  Report line: GitOps check: controller=argocd, secrets=externalized, plaintext=0, score=90/100

Exit codes

• 0: score >= 70 (pass)
• 1: score < 70 (fail)
• 2: error (bad path)

Recognition

Indexed on the XERJ Corpus Hub - the open reference memory AI coding agents search before they write code.

Requirements

Python 3.9+, no dependencies.

License

MIT

Who is this for?

No telemetry in this tool. If you use it, plan to, or rejected it, tell us your environment in the discussion thread. Operator replies steer the roadmap.