Feat/release pipeline overhaul and improvements

.ansible-lint

@@ -0,0 +1,14 @@
+---
+# Starting at the "min" profile deliberately: it catches genuine errors such as
+# syntax problems and removed modules without failing the build over the naming
+# and formatting conventions of a codebase that predates this config. Tighten to
+# "basic" and upwards once the existing findings have been worked through.
+profile: min
+
+exclude_paths:
+  - docs/
+  - .github/
+
+skip_list:
+  # yamllint runs as its own step with the config in .yamllint.
+  - yaml

.github/workflows/ci.yml

@@ -0,0 +1,75 @@
+name: CI
+
+# Fast checks on every pull request.
+#
+# Until now nothing ran on a PR, so the first sign that a change had broken the
+# build was a failed release run, hours into a tag. These checks take a couple of
+# minutes and catch the class of mistake that used to reach a published image.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - packer-test
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      # A virtualenv rather than a system pip install: Ubuntu runners mark the
+      # system Python as externally managed and refuse to install into it.
+      - name: Install linters
+        run: |
+          set -euo pipefail
+          python3 -m venv /tmp/lint
+          /tmp/lint/bin/pip install --quiet --upgrade pip
+          /tmp/lint/bin/pip install --quiet ansible ansible-lint yamllint
+          /tmp/lint/bin/ansible-galaxy collection install -r ansible/requirements.yml
+
+      - name: yamllint
+        run: /tmp/lint/bin/yamllint .
+
+      - name: ansible-lint
+        run: /tmp/lint/bin/ansible-lint
+
+      - name: Ansible syntax check
+        run: |
+          set -euo pipefail
+          for playbook in ansible/packer.yml ansible/initialise-env.yml; do
+            echo "==> ${playbook}"
+            /tmp/lint/bin/ansible-playbook --syntax-check -i localhost, "${playbook}"
+          done
+
+      - name: shellcheck
+        run: shellcheck scripts/*.sh
+
+      - name: Install Packer
+        run: |
+          set -euo pipefail
+          PACKER_VERSION='1.11.2'
+          wget -q "https://releases.hashicorp.com/packer/${PACKER_VERSION}/packer_${PACKER_VERSION}_linux_amd64.zip"
+          unzip -q "packer_${PACKER_VERSION}_linux_amd64.zip"
+          sudo mv packer /usr/local/bin/
+          packer version
+
+      - name: Packer fmt and validate
+        env:
+          PACKER_GITHUB_API_TOKEN: ${{ github.token }}
+        run: |
+          packer fmt -check -diff viper.pkr.hcl
+          packer init viper.pkr.hcl
+          packer validate viper.pkr.hcl