Add CI workflow for YAML validation, shellcheck, and .github drift detection (#10)

* Add CI workflow for YAML validation, shellcheck, and .github drift detection

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Christoph Jerolimov <jerolimov+git@redhat.com>

* Fix shellcheck warnings in create-catalog-yamls.sh

Quote variable expansions in seq calls and replace ls parsing with
wc -l | numfmt for file size display.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Christoph Jerolimov <jerolimov+git@redhat.com>

* Fix useless cat in set-plugins-resolutions.sh

Use jq with input redirection instead of piping from cat.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Christoph Jerolimov <jerolimov+git@redhat.com>

---------

Signed-off-by: Christoph Jerolimov <jerolimov+git@redhat.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: christoph-jerolimov

.github/workflows/ci.yaml

@@ -0,0 +1,47 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Validate YAML files in argocd/ and catalog/
+        run: |
+          find .github argocd catalog helm techdocs -name '*.yaml' -o -name '*.yml' | while read -r file; do
+            echo "  $file"
+            yq '.' "$file" > /dev/null
+          done
+
+      - name: Run shellcheck on scripts/
+        run: |
+          echo "Running shellcheck on scripts/..."
+          find scripts -name '*.sh' | while read -r file; do
+            echo "  $file"
+            shellcheck "$file"
+          done
+
+      - name: Verify no changes in .github/
+        run: |
+          if [ -n "$(git status --porcelain .github/)" ]; then
+            echo "::error::Unexpected changes detected in .github/ after CI steps:"
+            git diff .github/
+            exit 1
+          fi
+          echo "No changes in .github/ — OK"

scripts/create-catalog-yamls.sh

@@ -5,7 +5,7 @@ set -e
 # Create apis
 function apis() {
     local n=$1
-    for i in $(seq 1 $n); do
+    for i in $(seq 1 "$n"); do
     cat <<EOF
 apiVersion: backstage.io/v1alpha1
 kind: API
@@ -38,7 +38,7 @@ EOF
 # Example from https://backstage.io/docs/features/software-catalog/descriptor-format/
 function components() {
     local n=$1
-    for i in $(seq 1 $n); do
+    for i in $(seq 1 "$n"); do
     cat <<EOF
 apiVersion: backstage.io/v1alpha1
 kind: Component
@@ -72,7 +72,7 @@ EOF
 # Create groups
 function groups() {
     local n=$1
-    for i in $(seq 1 $n); do
+    for i in $(seq 1 "$n"); do
     cat <<EOF
 apiVersion: backstage.io/v1alpha1
 kind: Group
@@ -94,7 +94,7 @@ EOF
 # Create systems
 function systems() {
     local n=$1
-    for i in $(seq 1 $n); do
+    for i in $(seq 1 "$n"); do
     cat <<EOF
 apiVersion: backstage.io/v1alpha1
 kind: System
@@ -114,7 +114,7 @@ EOF
 # Create templates
 function templates() {
     local n=$1
-    for i in $(seq 1 $n); do
+    for i in $(seq 1 "$n"); do
     cat <<EOF
 apiVersion: scaffolder.backstage.io/v1beta3
 kind: Template
@@ -156,7 +156,7 @@ for n in 10 100 1000 10000; do
   apis $n > "catalog/apis-$n.yaml"
   # get only the file size only in human readable format
   echo -n " done."
-  echo -n -e "\tFile size: $(ls -lh "catalog/apis-$n.yaml" | awk '{print $5}')  "
+  echo -n -e "\tFile size: $(wc -l < "catalog/apis-$n.yaml" | numfmt --to=iec)  "
   # print loc
   echo -n -e "\tLines of code: $(wc -l < "catalog/apis-$n.yaml")"
   echo
@@ -168,7 +168,7 @@ for n in 10 100 1000 10000; do
   components $n > "catalog/components-$n.yaml"
   # get only the file size only in human readable format
   echo -n " done."
-  echo -n -e "\tFile size: $(ls -lh "catalog/components-$n.yaml" | awk '{print $5}')  "
+  echo -n -e "\tFile size: $(wc -l < "catalog/components-$n.yaml" | numfmt --to=iec)  "
   # print loc
   echo -n -e "\tLines of code: $(wc -l < "catalog/components-$n.yaml")"
   echo
@@ -180,7 +180,7 @@ for n in 10 100 1000 10000; do
   groups $n > "catalog/groups-$n.yaml"
   # get only the file size only in human readable format
   echo -n " done."
-  echo -n -e "\tFile size: $(ls -lh "catalog/groups-$n.yaml" | awk '{print $5}')  "
+  echo -n -e "\tFile size: $(wc -l < "catalog/groups-$n.yaml" | numfmt --to=iec)  "
   # print loc
   echo -n -e "\tLines of code: $(wc -l < "catalog/groups-$n.yaml")"
   echo
@@ -192,7 +192,7 @@ for n in 10 100 1000 10000; do
   systems $n > "catalog/systems-$n.yaml"
   # get only the file size only in human readable format
   echo -n " done."
-  echo -n -e "\tFile size: $(ls -lh "catalog/systems-$n.yaml" | awk '{print $5}')  "
+  echo -n -e "\tFile size: $(wc -l < "catalog/systems-$n.yaml" | numfmt --to=iec)  "
   # print loc
   echo -n -e "\tLines of code: $(wc -l < "catalog/systems-$n.yaml")"
   echo
@@ -204,7 +204,7 @@ for n in 10 100 1000 10000; do
   templates $n > "catalog/templates-$n.yaml"
   # get only the file size only in human readable format
   echo -n " done."
-  echo -n -e "\tFile size: $(ls -lh "catalog/templates-$n.yaml" | awk '{print $5}')  "
+  echo -n -e "\tFile size: $(wc -l < "catalog/templates-$n.yaml" | numfmt --to=iec)  "
   # print loc
   echo -n -e "\tLines of code: $(wc -l < "catalog/templates-$n.yaml")"
   echo

scripts/set-plugins-resolutions.sh

@@ -14,7 +14,7 @@ fi
 for workspace in plugins/backstage-*; do
   echo "Setting resolutions for workspace $workspace"
 
-  backstage_version=$(cat "$workspace/backstage.json" | jq -r ".version")
+  backstage_version=$(jq -r ".version" < "$workspace/backstage.json")
 
   echo "  Backstage version: $backstage_version"
   echo