No CI validates workflow files: a syntax error in refresh-amis.yml or publish-template.yml surfaces only when its cron fires

[defangdevs]

Found while fixing #173 (the AMI publish gap). PR #173 touched only .github/workflows/refresh-amis.yml and zero checks ran — gh pr checks reported "no checks reported on the branch". That is not a fluke; no workflow watches that file.

Every workflow's paths: filter is either self-referential or asset-scoped:

Workflow	Covers which workflow files
ci.yml	.github/workflows/ci.yml only
aws-ci.yml	aws-ci.yml, deploy-test.yml
deploy-test.yml	deploy-test.yml (and it has no pull_request trigger)
publish-template.yml	publish-template.yml — but on push only, so a PR touching it gets no check
refresh-amis.yml	nothing watches it

So refresh-amis.yml is validated by nothing, publish-template.yml is validated by nothing at PR time, and the three agent workflows proposed in #172 would also land unvalidated.

Why it matters for a repo that is meant to maintain itself: the failure mode is silent and delayed. A YAML syntax error or a bad expression in refresh-amis.yml merges green, then surfaces the following Monday at 06:17 UTC as a failed cron nobody is watching — which is exactly the shape of the bug #173 just fixed (a broken automation link that went unnoticed for a month). The blast radius includes publish-template.yml, which owns the S3 template the 1-click Launch buttons serve.

Smallest reproduction

Open a PR editing only .github/workflows/refresh-amis.yml (e.g. #173) and run gh pr checks <n>. It reports no checks.

Where the fix belongs

Options, with a recommendation:

1. Recommended — add a workflows-lint job to ci.yml with paths: [.github/workflows/**], running actionlint (in nixpkgs as pkgs.actionlint) over every workflow file. Catches YAML errors, unknown contexts (e.g. secrets used in a step-level if:, which is invalid and silently always-false), bad needs: references, and shellcheck issues in run: blocks. Cheap — seconds, no VM, no nix build — and it would have caught a real mistake I made while writing feat(ci): agent workflows for PR fixes, fork review, and queue triage #172.
2. Add .github/workflows/** to ci.yml's existing paths:. Simplest, but it drags the full VM suite (~10 min) onto every workflow-comment change, for no extra signal.
3. Give each workflow a self-referential paths: entry plus a pull_request trigger. Fixes coverage per-file but leaves the pattern easy to forget on the next workflow added — which is how this gap appeared.

Option 1 also gives a natural home for a repo-specific assertion or two, e.g. that no workflow granting contents: write also grants actions: write without a comment explaining why (the cascade hazard discussed in #172 and #173).

Related

• fix(ci): refresh-amis must dispatch the publisher, not rely on its push #173 — the bug this was found under; merged, and itself unvalidated by CI.
• feat(ci): agent workflows for PR fixes, fork review, and queue triage #172 — adds three more workflow files that would land unvalidated without this.

[defangdevs]

Context and reasoning for this now live in #176 (self-maintaining repo tracker).