Add preflight check for ci and on push in generating full install manifests

Author: sabrina-ngrok

.github/workflows/ci.yaml

@@ -45,6 +45,23 @@ jobs:
         git diff --exit-code
         git diff --cached --exit-code
 
+  manifest-bundle-diff:
+    name: Manifest Bundle Diff
+    runs-on: ubuntu-latest
+    needs:
+    - changes
+    if: |
+      (needs.changes.outputs.charts == 'true') ||
+      (needs.changes.outputs.make == 'true')
+    steps:
+    - uses: actions/checkout@v6
+    - uses: nixbuild/nix-quick-install-action@v34
+    - uses: DeterminateSystems/magic-nix-cache-action@b8276522d77f21bf19d3574e5bc99186a6c7aa6c
+    - name: Generate manifest bundle
+      run: nix develop --command make manifest-bundle
+    - name: Fail if there are uncommitted manifest bundle changes
+      run: git diff --exit-code manifest-bundle.yaml
+
   lint:
     name: Lint
     runs-on: ubuntu-latest

.github/workflows/generate-full-install-manifests.yaml

@@ -1,13 +1,17 @@
 name: 'Generate full install manifests'
 
 on:
-  pull_request_target:
+  push:
     branches:
     - main
     paths:
     - 'helm/**/*'
+    - 'Makefile'
+    - 'tools/make/**'
+
 permissions:
   contents: write
+
 jobs:
   update-full-install:
     name: Update full install
@@ -17,8 +21,6 @@ jobs:
       - name: Checkout repo
         uses: actions/checkout@v6
         with:
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: Install Nix
         uses: nixbuild/nix-quick-install-action@v34