# GitOps Repo Audit

> Audit the manifests of a Flux CD GitOps repository before merging: will Flux reconcile it, and is it safe. The free check runs in the browser and uploads nothing: it reads the pasted Kustomizations, HelmReleases, sources, FluxInstances, ResourceSets, Secrets and Kustomize build files with line numbers, names every document as Kind/name, and runs 31 deterministic checks drawn from the Flux maintainers' repo audit. The paid audit classifies the repo, confirms or dismisses every flag, gives the corrected document for each finding, the flux migrate steps and what each applier reconciles; the paid fix returns the corrected documents, says what it left for a person to decide and which commands to run outside Git. The page checks every quote, line and fix against the paste, puts every fix back and re-runs its checks, and calls out a reply that repeats a secret from the paste.

App: https://gitops-repo-audit.skillsafe.ai/
API tutorial: https://gitops-repo-audit.skillsafe.ai/api.html

## Input

- The manifests pasted into one box. Several files go after `---` lines, each introduced by a `# file: path` comment; dropped files are joined that way automatically.
- Nothing talks to Kubernetes, Flux or the Git host, and there is no flux-schema validation or kustomize build: every flag is a reading of the text, with the resource and line it points at.
- A source, dependency or valuesFrom object defined in a file that was not pasted is noted as context (FX-32), never reported as missing.
- The Flux version on the cluster, whether a repo is private and what a chart's values do are outside the paste: the paid lanes ask rather than assume.

## Flags the free check raises

- FX-01 (high if removed in Flux 2.7, medium if removed in 2.8, low for image v1beta2): a Flux API version Flux removed, grouped per apiVersion, with the flux migrate steps.
- FX-02 (high): a field the CRD requires is missing - Kustomization interval, prune, sourceRef; HelmRelease interval and exactly one of chart and chartRef; source url and interval.
- FX-03 (high): a sourceRef/chartRef of a kind the applier cannot use, or naming a source of another kind.
- FX-04 (high): a dependsOn cycle between Kustomizations or HelmReleases.
- FX-05 (high): a plaintext Secret in Git (no sops: block, no ENC[ values).
- FX-06 (high; medium for files/envs): a Kustomize secretGenerator with plaintext literals, or a configMapGenerator carrying a credential.
- FX-07 (high): a literal credential in HelmRelease values, postBuild.substitute, a ConfigMap, a patch, or a token pattern anywhere.
- FX-08 (high): a source with insecure: true.
- FX-09 (high): cluster-admin bound to a tenant or app service account.
- FX-10 (high): a postBuild.substitute value that starts with a YAML indicator, such as >=1.0.0.
- FX-11 (high): substituteFrom/valuesFrom naming an object that the paste has only in another namespace.
- FX-12 (high): ArtifactGenerators without source-watcher in the FluxInstance components.
- FX-13 (high in a multi-tenant repo, otherwise medium): a cross-namespace sourceRef/chartRef.
- FX-14 (medium): prune: false.
- FX-15 (medium): a Kustomization that others depend on without wait: true or healthChecks.
- FX-16 (medium): two Kustomizations on one source whose paths overlap.
- FX-17 (medium; low for a GitRepository without ref): a chart version of *, latest or none; an OCIRepository with no ref or a mutable tag.
- FX-18 (medium): a HelmRepository with type: oci (use an OCIRepository and chartRef).
- FX-19 (medium): an ECR, GCR/Artifact Registry or ACR source without a Workload Identity provider.
- FX-20 (medium): a tenant applier without serviceAccountName in a multi-tenant repo.
- FX-21 (medium): FluxInstance network policies switched off, or tenant namespaces without cluster.multitenant: true.
- FX-22 (medium; low for an open ImagePolicy): image automation pushing to the branch it reconciles from.
- FX-23 (medium): images[].name written with a ${variable}.
- FX-24 (medium): a ResourceSet with steps but not wait: true.
- FX-25 (low): legacy install/upgrade.remediation instead of strategy RetryOnFailure.
- FX-26 (low): appliers without timeout or retryInterval; anything reconciling more often than once a minute.
- FX-27 (low): HelmRelease and namespace hygiene - targetNamespace without storageNamespace, createNamespace, no drift detection, the default namespace.
- FX-28 (low): a ConfigMap/Secret read by valuesFrom/substituteFrom without reconcile.fluxcd.io/watch: Enabled.
- FX-29 (low): an OCIRepository without cosign verification.
- FX-30 (low): flux bootstrap - migrate to the Flux Operator (https://fluxoperator.dev/docs/guides/migration/); a FluxInstance without cluster.size.
- FX-31 (medium): SOPS-encrypted Secrets but no Kustomization with spec.decryption in the paste.
- FX-32 (info): context - objects outside the paste, appliers without a namespace, no Alert or Provider, a custom Flux registry.

## Lanes (paid, metered, model gpt-terra)

- `audit`: verdict (unsafe, needs_work, ready), headline, classification, findings (catalogue id, the page flags it confirms, resource, line, severity, title, verbatim evidence, why, fix as whole corrected documents), flag_answers (every page flag confirmed or dismissed with a reason), appliers (what each Kustomization, HelmRelease and ResourceSet reconciles), migration (flux migrate steps when FX-01 applies), plan, questions, summary.
- `fix`: verdict (ready, partial), headline, documents (each the whole corrected document and the pasted resource it replaces, or new), changes (the flags each fixes), kept (flags left, with the reason), removed, commands (steps outside Git: flux migrate, rotating a credential, sops --encrypt), questions, summary.
- The audit hands its findings to the fix lane on the same paste with one button; the fix lane's result can be swapped back into the free check.

## API

Base URL https://api.skillsafe.ai/v1/app-api, slug gitops-repo-audit. Run input is a flat object of strings: `task` ("audit" or "fix"), `manifests` (the paste), `facts` (the page's analysis as a JSON string), optional `note`, `audit_handoff` (fix lane) and `retry_note`. See the API tutorial for tokens, /me, /estimate, /run and /run-stream.

## Sources

- Derived from the agent skill gitops-repo-audit by the Flux CD maintainers: https://github.com/fluxcd/agent-skills (skills/gitops-repo-audit), Apache-2.0 - on SkillSafe as https://skillsafe.ai/skill/@fluxcd/gitops-repo-audit
- Flux API migration: https://github.com/fluxcd/flux2/discussions/5572
- Flux Operator migration guide: https://fluxoperator.dev/docs/guides/migration/
- Flux and Flux CD are projects of the Cloud Native Computing Foundation; "Flux" is a CNCF mark. GitOps Repo Audit is not affiliated with or endorsed by the Flux project or the CNCF.