diff --git a/.github/workflows/dev-infrastructure.yml b/.github/workflows/dev-infrastructure.yml
new file mode 100644
index 000000000..2f3794662
--- /dev/null
+++ b/.github/workflows/dev-infrastructure.yml
@@ -0,0 +1,37 @@
+---
+name: Validate dev-infrastructure
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'dev-infrastructure/**'
+
+jobs:
+  validate_bicep:
+    permissions:
+      contents: 'read'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        with:
+          fetch-depth: 1
+          sparse-checkout: dev-infrastructure
+
+      - name: 'az bicep format and lint'
+        uses: azure/cli@965c8d7571d2231a54e321ddd07f7b10317f34d9 # v2.0.0
+        with:
+          azcliversion: latest
+          inlineScript: |
+            make fmt
+            make lint
+
+      - name: Check for uncommitted changes
+        run: |
+          git diff --exit-code || (echo "::error::Uncommitted changes detected in OpenAPI spec. Please regenerate and commit them." && exit 1)
diff --git a/dev-infrastructure/Makefile b/dev-infrastructure/Makefile
index 7089be403..c0ff1e410 100644
--- a/dev-infrastructure/Makefile
+++ b/dev-infrastructure/Makefile
@@ -1,4 +1,3 @@
-
 SHELL = /bin/bash
 
 HCPDEVSUBSCRIPTION="ARO Hosted Control Planes (EA Subscription 1)"
@@ -9,13 +8,24 @@ DEPLOYMENTNAME=hcp-$(USER)-dev-infra
 LOCATION?=eastus
 RESOURCEGROUP=aro-hcp-${AKSCONFIG}-$(USER)
 
-ifndef AKSCONFIG
-$(error "Must set AKSCONFIG")
-endif
-
 list:
 	@grep '^[^#[:space:]].*:' Makefile
 
+fmt:
+	set -e; \
+	FILES="$$(find . -type f -name "*.bicep*")"; \
+	for file in $$FILES; do \
+	az bicep format --file $$file; \
+	done
+
+lint:
+	set -e; \
+	FILES="$$(find . -type f -name "*.bicep*")"; \
+	for file in $$FILES; do \
+	echo "az bicep lint --file $${file}"; \
+	az bicep lint --file $$file; \
+	done
+
 show:
 	@echo "Resource group      : $(RESOURCEGROUP)"
 	@echo "VPN resource group  : $(VPNRESOURCEGROUP)"
@@ -26,6 +36,9 @@ show:
 	@echo "DNSZone/deployment  : $(DEPLOYMENTNAME)"
 
 setsubscription:
+	ifndef AKSCONFIG
+	$(error "Must set AKSCONFIG")
+	endif
 	az account set --subscription $(HCPDEVSUBSCRIPTION)
 	az account show
 
@@ -56,7 +69,7 @@ mgmt-cluster: setsubscription rg
 		--parameters \
 			currentUserId=$(CURRENTUSER)			
 
-aks.kubeconfig:
+aks.kubeconfig: setsubscription
 	az aks get-credentials -n aro-hcp-cluster-001 -g $(RESOURCEGROUP) -a -f aks.kubeconfig
 
 secrets-download: setsubscription