From 28c2357656e1fb9a206b77d69e12696399ab2aa7 Mon Sep 17 00:00:00 2001 From: furedea <132188853+furedea@users.noreply.github.com> Date: Sun, 8 Nov 2026 22:35:44 +0900 Subject: [PATCH] ci: use the shared lint and nix workflows Call gha-lint, dependency-review, nix-lint and nix-check from furedea/reusable-workflows v1.0.0 and require them in all-green. Remove the per-repository GitHub Actions lint and dependency review workflows, move flake checks to the shared nix-check, skip CodeQL on private repositories, and pin the review workflows to the same release. Refs furedea/reusable-workflows#6 Co-Authored-By: Claude Opus 5.5 --- .github/dependency_review_config.yml | 5 --- .github/workflows/ci.yml | 54 ++++++++++++---------- .github/workflows/codeql.yml | 5 ++- .github/workflows/dependency_review.yml | 31 ------------- .github/workflows/gha_lint.yml | 59 ------------------------- 5 files changed, 33 insertions(+), 121 deletions(-) delete mode 100644 .github/dependency_review_config.yml delete mode 100644 .github/workflows/dependency_review.yml delete mode 100644 .github/workflows/gha_lint.yml diff --git a/.github/dependency_review_config.yml b/.github/dependency_review_config.yml deleted file mode 100644 index 694e93c..0000000 --- a/.github/dependency_review_config.yml +++ /dev/null @@ -1,5 +0,0 @@ -# Adjust this threshold per repository risk tolerance. -fail-on-severity: high - -# Fail the workflow instead of reporting only. -warn-only: false diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c1789d2..69b4c27 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,29 +21,9 @@ defaults: jobs: nix-lint: - runs-on: ubuntu-latest - timeout-minutes: 10 + uses: furedea/reusable-workflows/.github/workflows/nix-lint.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0 permissions: contents: read - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - persist-credentials: false - - - name: Install Nix - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5 - - - name: Run nixfmt - run: | - mapfile -t files < <(git ls-files "*.nix") - ((${#files[@]} == 0)) || nix run nixpkgs#nixfmt -- --check "${files[@]}" - - - name: Run statix - run: nix run nixpkgs#statix -- check . - - - name: Run deadnix - run: nix run nixpkgs#deadnix -- --fail . lint: runs-on: ubuntu-latest @@ -134,8 +114,24 @@ jobs: - name: Run uv audit run: uv audit --preview-features audit + gha-lint: + uses: furedea/reusable-workflows/.github/workflows/gha-lint.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0 + permissions: + actions: read + contents: read + + dependency-review: + uses: furedea/reusable-workflows/.github/workflows/dependency-review.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0 + permissions: + contents: read + + nix-check: + uses: furedea/reusable-workflows/.github/workflows/nix-check.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0 + permissions: + contents: read + claude-review: - uses: furedea/reusable-workflows/.github/workflows/claude-review.yml@fc0cba95e88e0cdad9837bf8212d324f3cad50a5 # main + uses: furedea/reusable-workflows/.github/workflows/claude-review.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0 permissions: contents: read pull-requests: write @@ -143,14 +139,24 @@ jobs: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} codex-review: - uses: furedea/reusable-workflows/.github/workflows/codex-review.yml@9bea83d997de4006c411bb5f40091275e316f44f # main + uses: furedea/reusable-workflows/.github/workflows/codex-review.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0 permissions: {} secrets: codex_review_token: ${{ secrets.CODEX_REVIEW_TOKEN }} all-green: if: always() - needs: [nix-lint, lint, typecheck, test, audit, claude-review, codex-review] + needs: + - nix-lint + - lint + - typecheck + - test + - audit + - gha-lint + - dependency-review + - nix-check + - claude-review + - codex-review runs-on: ubuntu-latest timeout-minutes: 1 permissions: {} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 41367da..027a090 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -20,6 +20,7 @@ concurrency: jobs: analyze: + if: ${{ !github.event.repository.private }} runs-on: ubuntu-latest timeout-minutes: 30 permissions: @@ -37,12 +38,12 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 + uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2 with: languages: ${{ matrix.language }} build-mode: none - name: Analyze - uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 + uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2 with: category: /language:${{ matrix.language }} diff --git a/.github/workflows/dependency_review.yml b/.github/workflows/dependency_review.yml deleted file mode 100644 index f815cd5..0000000 --- a/.github/workflows/dependency_review.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: Dependency Review - -on: - pull_request: - -permissions: {} - -defaults: - run: - shell: bash - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - dependency-review: - runs-on: ubuntu-latest - timeout-minutes: 10 - permissions: - contents: read - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - persist-credentials: false - - - name: Review dependencies - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 - with: - config-file: ./.github/dependency_review_config.yml diff --git a/.github/workflows/gha_lint.yml b/.github/workflows/gha_lint.yml deleted file mode 100644 index d1b8462..0000000 --- a/.github/workflows/gha_lint.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: GitHub Actions Lint - -on: - push: - branches: - - main - paths: - - ".github/workflows/**" - - ".github/actions/**" - pull_request: - paths: - - ".github/workflows/**" - - ".github/actions/**" - -permissions: {} - -defaults: - run: - shell: bash - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - actionlint: - runs-on: ubuntu-latest - timeout-minutes: 10 - permissions: - contents: read - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - persist-credentials: false - - - name: Run actionlint - uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.1.2 - with: - fail-on-error: true - shellcheck: true - pyflakes: true - - zizmor: - runs-on: ubuntu-latest - timeout-minutes: 10 - permissions: - actions: read - contents: read - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - persist-credentials: false - - - name: Run zizmor - uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3 - with: - advanced-security: false