Stage 9 of REFACTOR_PLAN.md.
- New .gitea/workflows/validate.yaml: runs yamllint/ansible-lint/
ansible-playbook --syntax-check/kubeconform on push and PR via the
self-hosted act_runner. Read-only lint pass, no cluster access, no
apply/deploy step. This is a new automation surface -- review before
relying on it; it only takes effect once pushed and the runner picks it up.
- Widen secrets-leak-scanner.md's stated scope to explicitly cover config/**
-- the Dashy API key (finding #4) slipped through previously because the
scanner's description read as manifests/Ansible/Helm-values-centric and
didn't call out app config directories.
- Add a "Validation commands" section to CLAUDE.md with the exact
yamllint/ansible-lint/kubeconform invocations, so future sessions run them
before claiming a change is done instead of just asserting success.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
