ci: add pull-request validation for compose, Go, and terraform

[polylane]

Fixes: Homelab stack repo has 0 CI and no branch protection while autofix PRs (two conflicting, one adding default Postgres credentials) target its compose.yml

This repository is the deployment source for the homelab observability stack, but it had no automated checks, so every pull request reached review with nothing having run. This adds a workflow that runs on pull requests and pushes to the main branch and verifies the Compose stack, the Go service, and the Terraform configuration, so a broken change is caught before it reaches the host.

What caused this

Affected: int_e1a33d7f7001yiuokcac3k3u

Why this fix

As of 2026-09-17 the repository returned total_count: 0 for its actions workflows and 404 for branches/main/protection; no workflow had ever run, so nothing ever executed a change to the stack. That same day the autofix pipeline opened two pull requests two minutes apart (PR #10 at 17:20:09Z, PR #11 at 17:22:12Z), both rewriting compose.yml (+28/-1 and +50/-3). The bot's own comment on #10 was headlined "Production impact not verified": with zero workflows there was no other check available either.

The cause is the absence of any verification layer on a repository that a live stack deploys from. This workflow supplies one: on every pull request and push to main it validates the Compose file, builds and vets the Go module, and validates the Terraform configuration. All three pass on the current tree today, so the baseline is green and the checks can be required.

I left terraform fmt -check out deliberately: terraform/main.tf is not fmt-canonical today, so a format check would make the very first run red and block the workflow's adoption; terraform validate still catches syntax and configuration errors. docker compose config -q only renders the file, starts no service, and pulls no image, and the workflow creates the gitignored .env it needs without adding it to the repository.

Out of scope

• Branch protection on main: requires repository-admin write, which the GitHub App installation does not hold; recorded as a follow-up.
• Dependabot security updates and the extra secret-scanning options: repository security settings, not code.
• Merge order of the open autofix PRs fix(compose): restart all services and declare the tunnel connector #10/fix(compose): declare the API's Postgres datastore, health and backup #11 and the app/app Postgres defaults inside fix(compose): declare the API's Postgres datastore, health and backup #11: content decisions for the operator.
• Reformatting terraform/main.tf to make fmt -check pass, and the committed terraform.tfstate: separate concerns.

Causal chain

• Signal (alert): Homelab stack repo has 0 CI and no branch protection while autofix PRs (two conflicting, one adding default Postgres credentials) target its compose.yml
• Surfacing site: int_e1a33d7f7001yiuokcac3k3u at exploration of the GitHub integration: GET /repos/Tharshen2124/Observability-Project-Utilizing-VictoriaMetrics/actions/workflows, /branches/main/protection, /pulls
• Mechanism: The repository declares no workflow file, so GitHub Actions never runs on it; main has no branch protection rule; and the autofix pipeline opened two pull requests two minutes apart, both editing compose.yml, with no check able to validate either.
• Producer: Tharshen2124/Observability-Project-Utilizing-VictoriaMetrics, at Tharshen2124/Observability-Project-Utilizing-VictoriaMetrics:.github/workflows (absent) and terraform/main.tf
• Producer evidence:
  • actions/workflows total_count 0 (no run has ever executed)
  • branches/main/protection returns 404 Not Found
  • open PRs fix(compose): restart all services and declare the tunnel connector #10 (17:20:09Z) and fix(compose): declare the API's Postgres datastore, health and backup #11 (17:22:12Z) both rewrite compose.yml; bot comment on fix(compose): restart all services and declare the tunnel connector #10 reads 'Production impact not verified'
  • dependabot_security_updates disabled in repo security_and_analysis
  • local checks on the current tree: go build/vet exit 0, terraform init -backend=false + validate 'Success!', docker compose config -q exit 0 after creating the gitignored .env

1 file changed (+51/-0)

• .github/workflows/ci.yml: added, +51/-0

---

Generated by Polylane. You can ask follow-ups by mentioning @polylane in a comment.

[polylane]

Note

Production impact unlikely.

Documentation, test, or CI-only change; nothing that runs in production is affected.

_{Polylane analysed e758a7f for production impact. You can ask follow-ups by mentioning @polylane in a comment.}

Did this help? React 👍 or 👎 so the next review is sharper.