Makefile targets

[EdGeraghty]

This pull request refactors CI workflows to use the Makefile for common tasks and adds new Makefile targets for linting and config validation. The main improvements are centralizing logic for Dockerfile linting and Headscale config drift checks, introducing containerized linters, and simplifying workflow maintenance.

CI/CD Workflow Refactoring and Centralization:

• The .github/workflows/hadolint.yml and .github/workflows/headscale-config-checker.yml workflows now call Makefile targets (lint-docker and check-config-drift) instead of duplicating logic in workflow YAML, reducing maintenance overhead and ensuring consistency. [1] [2]

Makefile Enhancements:

• Added new targets: lint-docker (runs hadolint in Docker), lint-shell (runs shellcheck in Docker), render-headscale-config, check-config-drift (compares rendered config with upstream Headscale config), build, check, and clean. These targets encapsulate and containerize linting and validation logic. [1] [2]
• Introduced helper targets to check for required tools (check-curl, check-docker, check-envsubst) to improve developer experience.
• Updated the smoke-test target to rely on the new build target for image building, avoiding duplicate build steps.

Workflow Reliability and Failure Handling:

• Both workflows now use continue-on-error: true for Makefile-based steps, and explicitly fail the job if new config options are detected, ensuring correct PR status reporting. [1] [2]

General Cleanup:

• The clean target in the Makefile removes all generated artifacts, simplifying local and CI cleanup.

These changes make CI more maintainable and consistent by centralizing logic and using containerized tools for linting and validation.

[Copilot]

Pull request overview

This pull request centralises common CI checks into the repository Makefile, so workflows call shared make targets rather than duplicating linting and config-drift logic in YAML.

Changes:

• Added Makefile targets for Dockerfile linting (hadolint), shell linting (shellcheck), config rendering, and Headscale config drift checking.
• Refactored the Headscale config checker and hadolint GitHub Actions workflows to invoke those Makefile targets.
• Reduced duplicate Docker build logic by making smoke-test depend on the new build target.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
Makefile	Introduces new build/lint/config-drift targets and helper checks, and refactors smoke-test to use build.
.github/workflows/headscale-config-checker.yml	Replaces inline drift-check scripting with make check-config-drift and adds explicit failure handling.
.github/workflows/hadolint.yml	Switches from hadolint-action to invoking hadolint via the Makefile target and uploads SARIF.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

.github/workflows/hadolint.yml:44

• make lint-docker is allowed to fail (continue-on-error: true), but the SARIF upload step is unconditional. If the lint step fails before producing hadolint-results.sarif (e.g. Docker not available / image pull failure), the upload step will fail the job anyway.

Guard the upload step on the SARIF file existing so the workflow behaviour matches the “no-fail” intent.

      - name: Upload analysis results to GitHub
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          sarif_file: hadolint-results.sarif
          wait-for-processing: true

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.