ci: validate and build Docker changes

.github/actions/lint-docker/action.yml

@@ -0,0 +1,25 @@
+name: Lint Docker source
+description: Install a verified hadolint binary and lint the repository Dockerfile.
+
+runs:
+  using: composite
+  steps:
+    - name: Install checksum-verified hadolint
+      shell: bash
+      env:
+        HADOLINT_VERSION: v2.15.1
+        HADOLINT_SHA256: c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507
+      run: |-
+        install_dir="${RUNNER_TEMP}/hadolint/bin"
+        asset="hadolint-linux-x86_64"
+        mkdir -p "${install_dir}"
+        curl --fail --location --silent --show-error \
+          --output "${install_dir}/${asset}" \
+          "https://github.com/hadolint/hadolint/releases/download/${HADOLINT_VERSION}/${asset}"
+        echo "${HADOLINT_SHA256}  ${install_dir}/${asset}" | sha256sum --check --strict
+        mv "${install_dir}/${asset}" "${install_dir}/hadolint"
+        chmod 0755 "${install_dir}/hadolint"
+        echo "${install_dir}" >> "${GITHUB_PATH}"
+    - name: Lint Dockerfile
+      shell: bash
+      run: hadolint Dockerfile