@@ -0,0 +1,69 @@
+---
+# TEMPORARY. Exercises scripts/osh-chart-diff.py against the real
+# openstack-helm repository, which the development sandbox cannot reach.
+# Delete before this branch is proposed for merge.
+name: TEMP validate osh-chart-diff
+
+on:
+  push:
+    branches:
+      - claude/openstack-helm-chart-diff-n4pb59
+
+permissions: {}
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 0
+
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
+        with:
+          version: v3.18.4
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+
+      - run: pip install pyyaml
+
+      # 74fddf2~1 predates both the ovn chart bump and the ovn values
+      # override, so this covers a version change and a value file change.
+      - name: Diff against a historical base
+        run: |
+          set -euo pipefail
+          python3 scripts/osh-chart-diff.py \
+            --base 74fddf2ee3bde50b0713c9020e446f3058e2a240~1 \
+            --out "${RUNNER_TEMP}/osh" \
+            --summary "${RUNNER_TEMP}/osh/comment.md" \
+            --summary-limit 60000
+
+      - name: Show what was produced
+        if: always()
+        run: |
+          find "${RUNNER_TEMP}/osh" -type f -printf '%10s  %p\n' | sort -k2
+          echo "--- render-inputs ---"
+          cat "${RUNNER_TEMP}"/osh/*/render-inputs.txt
+
+      - name: Sanity check the render
+        run: |
+          set -euo pipefail
+          test "$(cat "${RUNNER_TEMP}/osh/changed")" = "true"
+          for app in testsite-neutron testsite-ovn; do
+            test -s "${RUNNER_TEMP}/osh/${app}/before.yaml"
+            test -s "${RUNNER_TEMP}/osh/${app}/after.yaml"
+            # A real OpenStack Helm render has to contain a Deployment or
+            # DaemonSet; an empty or error render would not.
+            grep -qE '^kind: (Deployment|DaemonSet)' "${RUNNER_TEMP}/osh/${app}/after.yaml"
+          done
+          echo "render looks real"
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: temp-osh-diff
+          path: ${{ runner.temp }}/osh