Add the GitHub Actions workflows

A lint gate on every push, a manual deploy form, and a connectivity workflow for when a deploy hangs instead of failing. Nothing deploys on a push: merging changes what would be deployed, a person still decides when. The stack name and pull policy reach a shell command, so they are validated through env: rather than interpolated into a run: block. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
2026-09-16 03:58:09 +02:00
parent 9b9e39e67f
commit a0e56c96b7
4 changed files with 496 additions and 0 deletions
@@ -0,0 +1,73 @@
+---
+# The static gate. Runs on every push and pull request, needs no access to any
+# host, and is the definition of "done" for a change here.
+#
+# Everything below is `scripts/check.sh` plus two scans. Keeping the lint steps
+# in a script rather than inline is deliberate: a contributor can run the exact
+# same gate locally with `make check` before pushing, and the two cannot drift.
+name: lint
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+
+# A second push to the same branch makes the first run pointless.
+concurrency:
+  group: lint-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  ansible:
+    name: yamllint + ansible-lint + syntax
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      # scripts/check.sh is the single source of the version pins; it prints
+      # them so that this workflow can install exactly what a contributor runs
+      # locally. Nothing here can drift from the script.
+      - name: Install the pinned toolchain
+        run: |
+          set -eu
+          scripts/check.sh --print-specs | tee /dev/stderr | xargs -d '\n' pip install --quiet
+
+      - name: Run the static gate
+        run: RUNNER=installed scripts/check.sh
+
+  shell:
+    name: shellcheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # Pre-installed on GitHub-hosted Ubuntu runners; installed explicitly so
+      # this job also works on a self-hosted runner with a bare image.
+      - name: Install shellcheck
+        run: command -v shellcheck || sudo apt-get install -y --no-install-recommends shellcheck
+      - name: Check the shell scripts
+        run: shellcheck scripts/*.sh server/*/*/app/*.sh
+
+  secrets:
+    name: secret scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # detect scans history, not just the working tree. A secret that was
+          # committed and then removed is still a leaked secret.
+          fetch-depth: 0
+      # Run the upstream image directly rather than the marketplace action: the
+      # action requires a licence key for organisation-owned repositories, and
+      # silently no-ops without one. The image has no such condition.
+      - name: Scan the working tree and history for committed secrets
+        run: |
+          docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:latest \
+            detect --source=/repo --config=/repo/.gitleaks.toml \
+            --redact --verbose --no-banner