From 503f5cacb0ad864484ceb9613af28576a3a3ab35 Mon Sep 17 00:00:00 2001
From: Dmitry Verkhoturov <paskal.07@gmail.com>
Date: Fri, 3 Jul 2026 21:31:48 +0100
Subject: [PATCH] Add workflow to validate compose files

Compose files were not covered by any CI workflow, so a malformed change
to docker-compose.yml or a compose-*.yml could merge unnoticed. Add a
workflow that runs docker compose config on every tracked compose file
(vendored ones excluded) on changes to any of them.
---
 .github/workflows/ci-compose.yml | 44 ++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 .github/workflows/ci-compose.yml

diff --git a/.github/workflows/ci-compose.yml b/.github/workflows/ci-compose.yml
new file mode 100644
index 00000000..20145ce5
--- /dev/null
+++ b/.github/workflows/ci-compose.yml
@@ -0,0 +1,44 @@
+name: compose
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - ".github/workflows/ci-compose.yml"
+      - "**compose*.yml"
+      - "**compose*.yaml"
+  pull_request:
+    paths:
+      - ".github/workflows/ci-compose.yml"
+      - "**compose*.yml"
+      - "**compose*.yaml"
+
+jobs:
+  validate:
+    name: Validate compose files
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: validate tracked compose files
+        run: |
+          set -euo pipefail
+          n=0
+          # null-delimited to stay safe with unusual filenames; exclude this
+          # workflow (its name contains "compose") and vendored compose files.
+          # filenames are not echoed as workflow commands to avoid log-command injection
+          while IFS= read -r -d '' f; do
+            docker compose -f "$f" config --quiet
+            n=$((n + 1))
+          done < <(git ls-files -z '*compose*.yml' '*compose*.yaml' ':!:*/vendor/*' ':!:.github/*')
+          if [ "$n" -eq 0 ]; then
+            echo "no compose files found" >&2
+            exit 1
+          fi
+          echo "validated $n compose file(s)"