From 2fc194581182623b7e378d7c299359ab338d78ce Mon Sep 17 00:00:00 2001
From: "Patrick J.P. Culp" <jpculp@amazon.com>
Date: Thu, 3 Sep 2026 10:45:55 -0700
Subject: [PATCH] actions: add kernel config validation

Add a CheckConfig workflow that runs 'make full-config' on both x86_64
and aarch64 GitHub-hosted runners and fails if any tracked kernel config
files change.

Signed-off-by: Patrick J.P. Culp <jpculp@amazon.com>
---
 .github/workflows/check-config.yml | 43 ++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 .github/workflows/check-config.yml

diff --git a/.github/workflows/check-config.yml b/.github/workflows/check-config.yml
new file mode 100644
index 00000000..b7ded7ab
--- /dev/null
+++ b/.github/workflows/check-config.yml
@@ -0,0 +1,43 @@
+name: CheckConfig
+on:
+  pull_request:
+    branches: [develop]
+    paths:
+      - 'packages/kernel-*/**'
+      - 'packages/microcode/**'
+      - 'tools/latest-kernel-full-config.sh'
+      - 'tools/docker-run.sh'
+      - 'Makefile'
+      - 'Twoliter.lock'
+      - '.github/workflows/check-config.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: check-config-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check-config:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86_64
+            runner: ubuntu-24.04
+          - arch: aarch64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    name: "Check Config ${{ matrix.arch }}"
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - run: make full-config
+      - name: Fail if configs changed
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "::error::'make full-config' produced changes on ${{ matrix.arch }}. Run 'make full-config' locally and commit the regenerated kernel configs."
+            git status --porcelain
+            git diff
+            exit 1
+          fi