ci: gate manual docker builds with local checks

Author: boa-z

.github/workflows/docker-build.yml

@@ -17,7 +17,28 @@ on:
         default: "true"
 
 jobs:
+  validate:
+    name: Validate manual container gates
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+          cache-dependency-path: |
+            go.mod
+            go.sum
+
+      - name: Run manual container gates
+        run: ./scripts/ci.sh workflow-lint hygiene release-hygiene container-hygiene tidy test
+
   build:
+    needs: validate
     runs-on: ubuntu-latest
     permissions:
       contents: read

scripts/ci.sh

@@ -160,6 +160,18 @@ container_hygiene() {
 		printf 'docker publish build job must depend on validate\n' >&2
 		return 1
 	fi
+	if ! git grep -nF 'name: Validate manual container gates' -- "$build" >/dev/null; then
+		printf 'manual docker build workflow must validate repository gates before building images\n' >&2
+		return 1
+	fi
+	if ! git grep -nF './scripts/ci.sh workflow-lint hygiene release-hygiene container-hygiene tidy test' -- "$build" >/dev/null; then
+		printf 'manual docker build validate job must run local release gates\n' >&2
+		return 1
+	fi
+	if ! git grep -nF 'needs: validate' -- "$build" >/dev/null; then
+		printf 'manual docker build job must depend on validate\n' >&2
+		return 1
+	fi
 	if ! git grep -nF 'image: ${VOHIVE_IMAGE:-ghcr.io/boa-z/vohive:latest}' -- "$compose" >/dev/null; then
 		printf 'prebuilt compose file must default to the current GHCR image\n' >&2
 		return 1