Add CI workflow linting and publish :main image (#3)

## Summary

- add `actionlint` and `zizmor` to the Nix dev shell (`flake.nix`)
- extend CI to run on both pull requests and pushes to `main`
- add a dedicated `lint-actions` job that runs `actionlint` and `zizmor`
- add a `publish-main` job that builds and pushes
`ghcr.io/coder/coder-k8s:main` on merges to `main`
- harden workflow actions for security linting (pinned SHAs,
`persist-credentials: false`, publish job cache disabled)

## Validation

- `go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.10`
- `zizmor .github/workflows/ci.yaml`

---

<details>
<summary>📋 Implementation Plan</summary>

# Plan: Publish `:main` image on `main` merges + add Actions linting
(actionlint + zizmor)

## Context / Why
The request now includes three deliverables in one PR: (1) publish
`ghcr.io/coder/coder-k8s:main` on merges to `main`, (2) enforce GitHub
Actions validation with `actionlint`, and (3) run `zizmor` checks for
workflow security issues, while also adding both tools to `flake.nix`
for reproducible local use. The plan keeps these changes minimal by
extending the existing `ci.yaml` workflow and updating the existing Nix
dev shell.

## Evidence
- Explore report `51ee42b024` (workflow baseline):
  - `.github/workflows/ci.yaml` currently only triggers on PRs.
- `.github/workflows/release.yaml` already uses GHCR login via
`docker/login-action@v3` + `GITHUB_TOKEN`.
- Explore report `2afaa89579` (release conventions):
- Existing image coordinates are `ghcr.io/coder/coder-k8s` with
`Dockerfile.goreleaser`.
- Explore report `3863c6adc3` (Nix tooling):
- `flake.nix` provides tooling via
`devShells.<system>.default.packages`.
- `pkgs.actionlint` and `pkgs.zizmor` are available in the current
nixpkgs input.
- Explore report `8231c45f71` (CI integration shape):
- A dedicated workflow lint job in `ci.yaml` fits the current style and
`contents: read` permissions.

These findings are sufficient to define concrete edit locations and
commands for all requested additions.

## Implementation details
1. **Update `flake.nix` dev shell tooling**
- Edit `devShells.<system>.default.packages` to include both workflow
linters.
   - Keep the existing package set; append:

   ```nix
   default = pkgs.mkShell {
     packages = with pkgs; [
       go
       gnumake
       git
       goreleaser
       actionlint
       zizmor
     ];
   };
   ```

2. **Extend `.github/workflows/ci.yaml` trigger to include merged `main`
pushes**
   - Keep existing PR trigger.
   - Add push trigger for `main` so merge commits run CI:

   ```yaml
   on:
     pull_request:
     push:
       branches: [main]
   ```

3. **Add workflow lint/security job in `.github/workflows/ci.yaml`**
   - Add a dedicated `lint-actions` job for GH Actions validation.
- Run both `actionlint` and `zizmor` in CI to catch syntax/semantic
issues and security footguns.
- Keep permissions minimal (`contents: read`); optionally pass `${{
github.token }}` to reduce rate-limit risk for metadata lookups.

   ```yaml
   jobs:
     lint-actions:
       name: Lint GitHub Actions
       runs-on: ubuntu-latest
       permissions:
         contents: read
       steps:
         - uses: actions/checkout@v4

         - name: actionlint
           uses: rhysd/actionlint-action@v1

         - name: zizmor
           uses: woodruffw/zizmor-action@v1
           env:
             GH_TOKEN: ${{ github.token }}
   ```

4. **Add main-branch image publish job in `.github/workflows/ci.yaml`**
- Add `publish-main` job gated on successful `test` and `lint-actions`.
   - Restrict execution to `push` on `refs/heads/main`.
   - Reuse GHCR auth convention from `release.yaml`.
- Build `coder-k8s` binary before Docker build (required by
`Dockerfile.goreleaser`).

   ```yaml
   jobs:
     test:
       ...

     lint-actions:
       ...

     publish-main:
       name: Publish GHCR :main
       needs: [test, lint-actions]
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
       runs-on: ubuntu-latest
       permissions:
         contents: read
         packages: write
       steps:
         - uses: actions/checkout@v4
         - uses: actions/setup-go@v5
           with:
             go-version-file: go.mod
             cache: true
         - name: Build linux/amd64 binary for image
run: CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o coder-k8s ./
         - uses: docker/setup-buildx-action@v3
         - name: Log in to GitHub Container Registry
           uses: docker/login-action@v3
           with:
             registry: ghcr.io
             username: ${{ github.actor }}
             password: ${{ secrets.GITHUB_TOKEN }}
         - name: Build and push :main
           uses: docker/build-push-action@v5
           with:
             context: .
             file: Dockerfile.goreleaser
             push: true
             tags: ghcr.io/coder/coder-k8s:main
   ```

5. **Validation checklist for the PR**
- Confirm `flake.nix` evaluates and dev shell exposes `actionlint` +
`zizmor`.
   - Confirm `ci.yaml` remains valid (`actionlint` passes in CI).
- Confirm `zizmor` runs on PRs and fails on actionable workflow security
findings.
- Confirm `publish-main` is skipped on PRs and runs only on `push` to
`main`.
- After merge to `main`, verify `ghcr.io/coder/coder-k8s:main` exists.

<details>
<summary>Why this approach (concise)</summary>

- **Single CI workflow extension:** keeps changes localized to `ci.yaml`
plus one Nix file.
- **Defensive gating:** `publish-main` waits for both code tests and
workflow lint/security checks.
- **Reproducibility:** adding tools to `flake.nix` makes local
verification match CI expectations.
- **Convention reuse:** preserves existing GHCR image naming and
authentication patterns already used by release automation.

</details>


</details>

---
_Generated with [`mux`](https://github.com/coder/mux) • Model:
`openai:gpt-5.3-codex` • Thinking: `xhigh`_

Author: ThomasK33

.github/workflows/ci.yaml

@@ -2,6 +2,9 @@ name: CI
 
 on:
   pull_request:
+  push:
+    branches:
+      - main
 
 permissions:
   contents: read
@@ -11,10 +14,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
@@ -34,3 +39,75 @@ jobs:
         env:
           GOFLAGS: -mod=vendor
         run: go build ./...
+
+  lint-actions:
+    name: Lint GitHub Actions
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run actionlint
+        run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.10
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
+        with:
+          advanced-security: false
+          inputs: .github/workflows
+
+  publish-main:
+    name: Publish GHCR :main
+    needs: [test, lint-actions]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version-file: go.mod
+          cache: false
+
+      - name: Build linux/amd64 binary for image
+        env:
+          GOFLAGS: -mod=vendor
+          CGO_ENABLED: "0"
+          GOOS: linux
+          GOARCH: amd64
+        run: go build -o coder-k8s ./
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push :main
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
+        with:
+          context: .
+          file: Dockerfile.goreleaser
+          push: true
+          tags: ghcr.io/coder/coder-k8s:main

.github/workflows/release.yaml

@@ -13,28 +13,29 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
-          cache: true
+          cache: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
           distribution: goreleaser
           version: latest

flake.nix

@@ -23,6 +23,8 @@
               gnumake
               git
               goreleaser
+              actionlint
+              zizmor
             ];
           };
         }