From 45603f110bcc60bfefd77cc31886d653f2114ae4 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Tue, 3 Nov 2026 18:02:10 -0600
Subject: [PATCH] ci: build Docker images and check the npm package before
 merge

Dockerfile, Dockerfile.release, docker/** and npm-distribution/** had no
pre-merge check: goreleaser.yml and docker.yml only run on release tags,
and renovate automerges on green CI. Two path-filtered workflows now
build every shipped image (with the same static linux binary goreleaser
feeds to Dockerfile.release) and run npm ci + npm pack on the npm package.

Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-01a1a37e-8603-775d-bc85-c5677817f7a8
---
 .github/workflows/docker-check.yml | 47 ++++++++++++++++++++++++++++++
 .github/workflows/npm-check.yml    | 25 ++++++++++++++++
 2 files changed, 72 insertions(+)
 create mode 100644 .github/workflows/docker-check.yml
 create mode 100644 .github/workflows/npm-check.yml

diff --git a/.github/workflows/docker-check.yml b/.github/workflows/docker-check.yml
new file mode 100644
index 0000000000..8ba757f355
--- /dev/null
+++ b/.github/workflows/docker-check.yml
@@ -0,0 +1,47 @@
+# Builds every Docker image this repo ships. Nothing else tests them before a
+# tag: .goreleaser.yml and docker.yml only run on release tags.
+name: Docker check
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - Dockerfile
+      - Dockerfile.release
+      - .dockerignore
+      - docker/**
+      - .github/workflows/docker-check.yml
+
+jobs:
+  src-cli-image:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Get Go version from mise
+        id: mise
+        run: echo "go-version=$(grep 'golang' mise.toml | cut -d'"' -f2)" >> "$GITHUB_OUTPUT"
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version: ${{ steps.mise.outputs.go-version }}
+          cache: false
+      # Dockerfile.release expects the static linux binary goreleaser builds
+      # into the project root.
+      - name: Build src like goreleaser does
+        run: CGO_ENABLED=0 GOOS=linux go build -o src ./cmd/src
+      - name: Build Dockerfile.release
+        run: docker build --file Dockerfile.release --tag src-cli:release .
+      - run: docker run --rm src-cli:release version --client-only
+      - name: Build Dockerfile
+        run: docker build --tag src-cli:dev .
+      - run: docker run --rm src-cli:dev version --client-only
+
+  batch-change-volume-workspace-image:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Build docker/batch-change-volume-workspace
+        run: docker build --tag volume-workspace docker/batch-change-volume-workspace
+      - run: docker run --rm volume-workspace sh -c 'git --version && unzip -v'
diff --git a/.github/workflows/npm-check.yml b/.github/workflows/npm-check.yml
new file mode 100644
index 0000000000..d06cc2f505
--- /dev/null
+++ b/.github/workflows/npm-check.yml
@@ -0,0 +1,25 @@
+# Checks the npm package that goreleaser.yml publishes on release tags.
+name: npm check
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - npm-distribution/**
+      - .github/workflows/npm-check.yml
+
+jobs:
+  npm-check:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: npm-distribution
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      # The install script downloads the release binary for package.json's
+      # version, which does not exist until the tag is published.
+      - run: npm ci --ignore-scripts
+      - run: node -e 'require("tar")'
+      # Runs the prepack script and lists what would ship.
+      - run: npm pack --dry-run