From aa2d9af8d1a1dc50ffbebaa072cefff6cbdbc7e6 Mon Sep 17 00:00:00 2001
From: Khaja Omer <komer@akamai.com>
Date: Mon, 9 Nov 2026 15:32:28 -0600
Subject: [PATCH 1/2] [CI] Add Chainsaw lint checks

---
 .github/workflows/go-analyze.yml | 3 +++
 Makefile                         | 5 +++++
 docs/development/testing.md      | 8 ++++++++
 mise.toml                        | 4 ++++
 4 files changed, 20 insertions(+)

diff --git a/.github/workflows/go-analyze.yml b/.github/workflows/go-analyze.yml
index 64c54945..dc34fdc0 100644
--- a/.github/workflows/go-analyze.yml
+++ b/.github/workflows/go-analyze.yml
@@ -84,6 +84,9 @@ jobs:
       - name: lint
         run: mise run lint
 
+
+      - name: Chainsaw lint
+        run: mise run chainsaw-lint
       - name: Helm Lint
         run: mise run helm-lint
 
diff --git a/Makefile b/Makefile
index 6925889d..ba7cfa27 100644
--- a/Makefile
+++ b/Makefile
@@ -80,6 +80,11 @@ vet: fmt
 lint:
 	golangci-lint run -c .golangci.yml
 
+.PHONY: chainsaw-lint
+chainsaw-lint: ## Validate the Chainsaw configuration and every test manifest.
+	chainsaw lint configuration --file .chainsaw.yaml
+	find e2e -type f -name 'chainsaw-test.yaml' -print0 | xargs -0 -n 1 chainsaw lint test --file
+
 .PHONY: lint-fix
 lint-fix:
 	golangci-lint run -c .golangci.yml --fix
diff --git a/docs/development/testing.md b/docs/development/testing.md
index 31cf8bc8..c839ba1d 100644
--- a/docs/development/testing.md
+++ b/docs/development/testing.md
@@ -163,3 +163,11 @@ The E2E manifests use labels to select compatible scenarios:
 | `ipv6-backends` | CAPL-provisioned IPv6 workload cluster |
 
 Some tests require a CAPL management cluster to add nodes or configure routes. They are intentionally excluded from the `lke` selector.
+
+## Chainsaw schema validation
+
+Run the Chainsaw configuration and test-manifest checks without a cluster:
+
+```bash
+mise run chainsaw-lint
+```
diff --git a/mise.toml b/mise.toml
index c9b5aefb..3a55195a 100644
--- a/mise.toml
+++ b/mise.toml
@@ -92,6 +92,10 @@ run = "make vet"
 description = "Run golangci-lint"
 run = "make lint"
 
+[tasks.chainsaw-lint]
+description = "Validate the Chainsaw configuration and every E2E test manifest."
+run = "make chainsaw-lint"
+
 [tasks.lint-fix]
 description = "Run golangci-lint --fix"
 run = "make lint-fix"

From b6ba3b06510757c45e4830a7f2db83dd09a4985a Mon Sep 17 00:00:00 2001
From: Khaja Omer <komer@akamai.com>
Date: Mon, 9 Nov 2026 16:53:49 -0600
Subject: [PATCH 2/2] Move Docker OIDC login after Mise

---
 .github/workflows/ci.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 582c580b..43b39b47 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -130,6 +130,9 @@ jobs:
           # allowed because the job is gated on manual approval for fork PRs
           allow-unsafe-pr-checkout: true
 
+      - name: Set up Mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+
       - name: Login to Docker Hub
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         env:
@@ -137,9 +140,6 @@ jobs:
         with:
           username: ${{ github.repository_owner }}
 
-      - name: Set up Mise
-        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
-
       - name: Build and push the CCM PR image
         run: mise run ko-publish