[furedea]

GitHub Actions の lint（actionlint，zizmor），dependency review，nix lint，flake check を，furedea/reusable-workflows v1.0.0 の共有 workflow から呼ぶように変えます．4 つとも all-green の needs に入るので，失敗するとマージできません．

項目	今	変更後
共有 workflow の固定	@<sha> # main（main が進むと zizmor の ref-version-mismatch で落ちる）	@<sha> # v1.0.0
actionlint / zizmor	gha_lint.yml（workflow を変えた PR だけ）	ci.yml から gha-lint.yml を呼ぶ（全 PR，all-green に入る）
dependency review	dependency_review.yml（all-green の外），または無し	ci.yml から dependency-review.yml を呼ぶ．非公開 repo と PR 以外では飛ばして成功扱い
nix lint	ci.yml に直接書いたジョブ	nix-lint.yml を呼ぶ
flake check	repo ごと（無い repo もある）	nix-check.yml を呼ぶ（nix flake check -L と全 system の評価）
CodeQL	非公開でも動く	非公開 repo では飛ばす．codeql-action を v4.39.2 に
claude-review / codex-review	# main の古い SHA	# v1.0.0

• gha-lint / …，dependency-review / …，nix-lint / nix-lint，nix-check / nix-check が成功する
• all-green が green になる

出典

• 計画: ci: share the common workflows and align the CI layout across repositories reusable-workflows#6，ci: fail on uv.lock drift with UV_LOCKED #13
• 呼び出し先: furedea/reusable-workflows v1.0.0（c1a43f6）．以後は release ごとに Renovate が更新する
• 消した .github/dependency_review_config.yml は共有 workflow の既定値（fail-on-severity: high）と同じだった

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-08T13:38:47.487802Z	28c2357	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[furedea]

@codex review

[github-actions]

Review summary

No blocking findings.

I read the PR changes in ci.yml and codeql.yml, plus the deleted gha_lint.yml, dependency_review.yml and dependency_review_config.yml:

• All four new reusable-workflow calls and both review workflows point at the same pinned SHA (c1a43f6, v1.0.0).
• All four new jobs are in all-green.needs.
• The caller permissions match what the old jobs used (actions: read for zizmor, contents: read otherwise).
• In codeql.yml, the !github.event.repository.private guard is correct, and that workflow is not part of all-green.

Not verified: I couldn't read the contents of furedea/reusable-workflows@c1a43f6 from this environment. Two things depend on it:

1. all-green fails when any needed job's result is skipped. If dependency-review.yml skips with a job-level if: on push or on private repos, all-green will fail on every push to main. It only works if the skip happens at step level, so the job still reports success.
2. A called workflow fails to start if it asks for more permissions than the caller grants. For example, pull-requests: write for the dependency-review summary comment would need to be granted here.

The PR checklist (all-green green on this PR) covers the PR side. Please also check the first push to main after merge.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 28c2357656

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".