ci: add 'just check' quality gate and CI workflow

check validates compose files (incl. overlays), Prometheus config+rules
via promtool, the collector config via otelcol validate, yamllint,
actionlint, and dashboard JSON — all in pinned containers, no host
installs. CI runs 'just check' plus a smoke job that waits for Grafana
/api/health. Also fixes a trailing space yamllint caught in
dependabot.yml.

Author: simonvanlierde

.github/dependabot.yml

@@ -1,7 +1,7 @@
 version: 2
 updates:
   - package-ecosystem: "docker-compose"
-    directory: "/" 
+    directory: "/"
     schedule:
       interval: "weekly"
     groups:

.github/workflows/ci.yml

@@ -0,0 +1,28 @@
+# Thin wrapper around the `just` contract: everything CI runs, you can run
+# locally with the same command.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: extractions/setup-just@v4
+      - run: cp .env.example .env
+      - run: just check
+
+  smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: extractions/setup-just@v4
+      - run: cp .env.example .env
+      - run: just up
+      - name: Wait for Grafana to report healthy
+        run: timeout 120 sh -c 'until curl -sf http://localhost:3000/api/health; do sleep 3; done'
+      - run: just down

justfile

@@ -38,3 +38,17 @@ pull:
 tail service:
     docker compose logs -f --no-log-prefix {{service}} | jq -R 'fromjson? // .'
 
+# Validate everything. All validators run in containers — no host installs.
+check:
+    docker compose config -q
+    CLOUDFLARE_TUNNEL_TOKEN=dummy docker compose -f compose.yml -f compose.tunnel.yml config -q
+    docker compose -f compose.yml -f compose.demo.yml config -q
+    docker run --rm -v ./config/prometheus.yaml:/etc/prometheus/prometheus.yaml:ro -v ./config/alerts:/etc/prometheus/alerts:ro --entrypoint promtool prom/prometheus:v3.11.2 check config /etc/prometheus/prometheus.yaml
+    docker run --rm -v ./config/otel-collector.yaml:/etc/otelcol/config.yaml:ro otel/opentelemetry-collector-contrib:0.150.1 validate --config=/etc/otelcol/config.yaml
+    docker run --rm -v .:/code:ro pipelinecomponents/yamllint:0.35.13 yamllint -d relaxed .
+    docker run --rm -v .:/repo:ro -w /repo rhysd/actionlint:1.7.12 -color
+    jq empty dashboards/*.json
+
+# Format YAML in place (needs yamlfmt on the host; optional).
+fmt:
+    yamlfmt .