fix: resolve critical workflow and runtime issues

- Add yq installation to all workflows that use it (prevents immediate failures)
- Fix executable permissions on shell scripts
- docker-entrypoint.sh, backup.sh, user_data.sh now executable
- All workflows now properly install required tools before using them

Author: fgogolli

.github/workflows/ci.yml

@@ -26,6 +26,9 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v5
 
+    - name: Install yq
+      uses: mikefarah/yq@master
+
     - name: Get default Python version from project config
       id: version
       run: |

.github/workflows/container.yml

@@ -47,6 +47,8 @@ jobs:
       id: default-python-version
       run: |
         # Use project config directly with yq
+    - name: Install yq
+      uses: mikefarah/yq@master
         DEFAULT_PYTHON_VERSION=$(yq '.python.default_version' .project.yml)
         echo "default-python-version=$DEFAULT_PYTHON_VERSION" >> $GITHUB_OUTPUT
         echo "Using Python version: $DEFAULT_PYTHON_VERSION"
@@ -74,6 +76,8 @@ jobs:
       id: config
       run: |
         PYTHON_VERSIONS_JSON=$(make print-json-PYTHON_VERSIONS)
+    - name: Install yq
+      uses: mikefarah/yq@master
         DEFAULT_PYTHON_VERSION=$(yq '.python.default_version' .project.yml)
         CONTAINER_REGISTRY=$(make print-CONTAINER_REGISTRY)
         CONTAINER_IMAGE=$(make print-CONTAINER_IMAGE)

.github/workflows/dependabot.yml

@@ -21,6 +21,8 @@ jobs:
     - name: Get default Python version from project config
       id: version
       run: |
+    - name: Install yq
+      uses: mikefarah/yq@master
         DEFAULT_PYTHON_VERSION=$(yq '.python.default_version' .project.yml)
         echo "default-python-version=$DEFAULT_PYTHON_VERSION" >> $GITHUB_OUTPUT
         echo "Using Python version: $DEFAULT_PYTHON_VERSION"

.github/workflows/docs.yml

@@ -36,6 +36,8 @@ jobs:
     - name: Get default Python version from project config
       id: version
       run: |
+    - name: Install yq
+      uses: mikefarah/yq@master
         DEFAULT_PYTHON_VERSION=$(yq '.python.default_version' .project.yml)
         echo "default-python-version=$DEFAULT_PYTHON_VERSION" >> $GITHUB_OUTPUT
         echo "Using Python version: $DEFAULT_PYTHON_VERSION"

.github/workflows/publish.yml

@@ -36,6 +36,8 @@ jobs:
     - name: Get default Python version from project config
       id: version
       run: |
+    - name: Install yq
+      uses: mikefarah/yq@master
         DEFAULT_PYTHON_VERSION=$(yq '.python.default_version' .project.yml)
         echo "default-python-version=$DEFAULT_PYTHON_VERSION" >> $GITHUB_OUTPUT
         echo "Using Python version: $DEFAULT_PYTHON_VERSION"

.github/workflows/security.yml

@@ -41,6 +41,8 @@ jobs:
       run: |
         # Use consistent print-* and print-json-* targets
         PYTHON_VERSIONS_JSON=$(make print-json-PYTHON_VERSIONS)
+    - name: Install yq
+      uses: mikefarah/yq@master
         DEFAULT_PYTHON_VERSION=$(yq '.python.default_version' .project.yml)
 
         echo "python-versions=$PYTHON_VERSIONS_JSON" >> $GITHUB_OUTPUT

.github/workflows/test-matrix.yml

@@ -34,6 +34,8 @@ jobs:
       run: |
         # Use consistent print-* and print-json-* targets
         PYTHON_VERSIONS_JSON=$(make print-json-PYTHON_VERSIONS)
+    - name: Install yq
+      uses: mikefarah/yq@master
         DEFAULT_PYTHON_VERSION=$(yq '.python.default_version' .project.yml)
 
         echo "python-versions=$PYTHON_VERSIONS_JSON" >> $GITHUB_OUTPUT

.github/workflows/validate-workflows.yml

@@ -23,6 +23,8 @@ jobs:
         for file in .github/workflows/*.yml .github/workflows/*.yaml; do
           if [ -f "$file" ]; then
             echo "Validating $file..."
+    - name: Install yq
+      uses: mikefarah/yq@master
             yq . "$file" > /dev/null && echo "VALID: $file" || (echo "INVALID: $file" && exit 1)
           fi
         done