From 203f6cc7c00badf459c205290ee3afc6bad2e645 Mon Sep 17 00:00:00 2001
From: Derek Roberts <derek.roberts@gmail.com>
Date: Fri, 9 Oct 2026 16:09:59 -0700
Subject: [PATCH] ci: lint the frontend and workflows on pull requests

Frontend lint never ran in CI, and nothing checked workflows that only run after merge or on a schedule, so Renovate could auto-merge a broken one. Both now run in analysis.yml and feed Analysis Results. The fixes actionlint asked for are included: the deploy workflow's autoscaling input is a boolean, and the oc templates in scheduled.yml are quoted.

Refs #597
---
 .github/actionlint.yaml         |  4 ++++
 .github/workflows/.deploy.yml   |  4 ++--
 .github/workflows/analysis.yml  | 32 +++++++++++++++++++++++++++++++-
 .github/workflows/scheduled.yml |  4 ++--
 4 files changed, 39 insertions(+), 5 deletions(-)
 create mode 100644 .github/actionlint.yaml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 00000000..7d5fa2c3
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,4 @@
+self-hosted-runner:
+  # GitHub-hosted runner labels newer than actionlint's built-in list
+  labels:
+    - ubuntu-26.04
diff --git a/.github/workflows/.deploy.yml b/.github/workflows/.deploy.yml
index d85962f4..aa0f8513 100644
--- a/.github/workflows/.deploy.yml
+++ b/.github/workflows/.deploy.yml
@@ -7,8 +7,8 @@ on:
       autoscaling:
         description: Autoscaling enabled or not for the deployments
         required: false
-        type: string
-        default: "true"
+        type: boolean
+        default: true
       environment:
         description: Environment name; omit for PRs
         required: false
diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml
index 11d9b90c..fae35480 100644
--- a/.github/workflows/analysis.yml
+++ b/.github/workflows/analysis.yml
@@ -93,11 +93,41 @@ jobs:
       - run: npm ci
       - run: npm test
 
+  frontend-lint:
+    name: Frontend Lint
+    runs-on: ubuntu-26.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "24.x"
+      - run: npm ci
+      - run: npm run lint
+
+  # Catches broken workflows on the PR, including those that only run after merge or on a schedule
+  workflow-lint:
+    name: Workflow Lint
+    runs-on: ubuntu-26.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+      - uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
+        with:
+          args: -color
+
   # This job is the merge gate for this workflow. Every job in this
   # workflow must be listed in 'needs', or its failure won't block the PR.
   results:
     name: Analysis Results
-    needs: [trivy, api-tests, unit-tests]
+    needs: [trivy, api-tests, unit-tests, frontend-lint, workflow-lint]
     if: always()
     runs-on: ubuntu-26.04
     timeout-minutes: 1
diff --git a/.github/workflows/scheduled.yml b/.github/workflows/scheduled.yml
index 65820333..e83da923 100644
--- a/.github/workflows/scheduled.yml
+++ b/.github/workflows/scheduled.yml
@@ -58,7 +58,7 @@ jobs:
           oc project ${{ vars.OC_NAMESPACE }}
 
           # Get API key
-          API_KEY=$(oc get secrets/pubcode --template={{.data.API_KEY}} | base64 -d)
+          API_KEY=$(oc get secrets/pubcode --template='{{.data.API_KEY}}' | base64 -d)
           API_URL=https://$(oc get ingress/pubcode-api --template='{{(index .spec.rules 0).host}}')
           API_KEY="${API_KEY}" API_URL="${API_URL}" node src/main.js
 
@@ -153,7 +153,7 @@ jobs:
           oc project ${{ vars.OC_NAMESPACE }}
 
           # Get API key
-          API_KEY=$(oc get secrets/pubcode --template={{.data.API_KEY}} | base64 -d)
+          API_KEY=$(oc get secrets/pubcode --template='{{.data.API_KEY}}' | base64 -d)
           API_URL=https://$(oc get ingress/pubcode-api --template='{{(index .spec.rules 0).host}}')
           API_KEY="${API_KEY}" API_URL="${API_URL}" node index.js