feat: secure build workflows with Image Updater #1

	# CI workflow for the github-workflows repository itself
	# Tests the reusable workflows by validating their syntax

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	jobs:
	validate:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Validate workflow syntax
	uses: actions/github-script@v7
	with:
	script: \|
	const fs = require('fs');
	const path = require('path');
	const yaml = require('js-yaml');

	const workflowDir = '.github/workflows';
	const files = fs.readdirSync(workflowDir).filter(f => f.endsWith('.yml') \|\| f.endsWith('.yaml'));

	let errors = [];

	for (const file of files) {
	const filePath = path.join(workflowDir, file);
	const content = fs.readFileSync(filePath, 'utf8');

	try {
	yaml.load(content);
	console.log(`✓ ${file}: valid YAML`);
	} catch (e) {
	errors.push(`${file}: ${e.message}`);
	console.log(`✗ ${file}: ${e.message}`);
	}
	}

	if (errors.length > 0) {
	core.setFailed(`Workflow validation failed:\n${errors.join('\n')}`);
	}

	- name: Check required fields
	run: \|
	echo "Checking docker-build.yml..."
	yq eval '.on.workflow_call.outputs.build_id' .github/workflows/docker-build.yml
	yq eval '.on.workflow_call.outputs.metadata_url' .github/workflows/docker-build.yml

	echo "Checking k8s-promote.yml..."
	yq eval '.on.workflow_call.inputs.environment' .github/workflows/k8s-promote.yml
	yq eval '.on.workflow_call.inputs.build_id' .github/workflows/k8s-promote.yml

	echo "✓ All required fields present"

Provide feedback