ci: validate golangci-default.yaml and trigger on its changes

Author: bwlkr

.github/workflows/main.yaml

@@ -7,7 +7,7 @@ on:
     paths:
       - ".github/actions/**"
       - ".github/workflows/**"
-      - ".github/semantic-release/**"
+      - "golangci-default.yaml"
       - "README.md"
   workflow_dispatch:
 

.github/workflows/pr.yaml

@@ -7,7 +7,7 @@ on:
     paths:
       - ".github/actions/**"
       - ".github/workflows/**"
-      - ".github/semantic-release/**"
+      - "golangci-default.yaml"
       - "README.md"
 
 permissions:

.github/workflows/validate.yaml

@@ -51,3 +51,48 @@ jobs:
               echo "- Review the job logs for details."
             } >> "$GITHUB_STEP_SUMMARY"
           fi
+
+  golangci-config:
+    # go-lint.yaml fetches golangci-default.yaml from this repo at runtime for
+    # every consumer without a local golangci config, so a malformed or invalid
+    # edit here breaks lint across the estate. Validate the file on every change
+    # (it's in this workflow's paths filter) with the same golangci-lint major
+    # version consumers install via go-lint.yaml.
+    name: golangci config verify
+    runs-on: ${{ inputs.runs-on }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          cache: false
+          go-version: "1.26.2"
+
+      - name: Install golangci-lint
+        shell: bash
+        run: |
+          GOBIN="$RUNNER_TEMP/bin" go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+
+      - name: Verify golangci-default.yaml
+        id: golangci-config
+        run: golangci-lint config verify --config golangci-default.yaml
+
+      - name: golangci config summary
+        if: always()
+        run: |
+          if [ "${{ steps.golangci-config.outcome }}" = "success" ]; then
+            {
+              echo "### golangci config verify"
+              echo "golangci-default.yaml is valid."
+            } >> "$GITHUB_STEP_SUMMARY"
+          else
+            {
+              echo "### golangci config verify"
+              echo "golangci-default.yaml failed validation."
+              echo ""
+              echo "- Review the job logs for details."
+            } >> "$GITHUB_STEP_SUMMARY"
+          fi