From fd7be4f62821b715b6fe738ba6d2671fd69feb5c Mon Sep 17 00:00:00 2001
From: Charles Ewert <cewert@gmail.com>
Date: Thu, 28 May 2026 23:58:31 -0400
Subject: [PATCH] ci: validate Renovate preset + JSON on PRs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

.github inherits the org Renovate preset's patch+digest automerge rule
but had no CI, so automerge here merged with no gate — and a malformed
default.json silently breaks Renovate for the entire org. Add a check
job that runs renovate-config-validator --strict on default.json and
jq-validates every JSON file, satisfying the preset's stated contract
that every extending repo have PR-triggered CI.
---
 .github/workflows/ci.yml | 41 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..6a13438
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,41 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '22'
+
+      - name: Validate Renovate preset
+        # A malformed default.json would silently break Renovate for the whole
+        # org (every repo inherits this preset). Validate it on every PR so the
+        # org-wide automerge contract has a real CI gate here too.
+        run: npx --yes --package renovate -- renovate-config-validator --strict renovate/default.json
+
+      - name: Validate JSON files parse
+        run: |
+          fail=0
+          while IFS= read -r -d '' f; do
+            if ! jq empty "$f" 2>/dev/null; then
+              echo "::error file=$f::invalid JSON"
+              fail=1
+            fi
+          done < <(find . -name '*.json' -not -path './.git/*' -print0)
+          exit $fail