ci: use the shared lint and nix workflows

.github/workflows/ci.yml

@@ -21,29 +21,9 @@ defaults:
 
 jobs:
   nix-lint:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
+    uses: furedea/reusable-workflows/.github/workflows/nix-lint.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0
     permissions:
       contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
-
-      - name: Run nixfmt
-        run: |
-          mapfile -t files < <(git ls-files "*.nix")
-          ((${#files[@]} == 0)) || nix run nixpkgs#nixfmt -- --check "${files[@]}"
-
-      - name: Run statix
-        run: nix run nixpkgs#statix -- check .
-
-      - name: Run deadnix
-        run: nix run nixpkgs#deadnix -- --fail .
 
   lint:
     runs-on: ubuntu-latest
@@ -134,23 +114,49 @@ jobs:
       - name: Run uv audit
         run: uv audit --preview-features audit
 
+  gha-lint:
+    uses: furedea/reusable-workflows/.github/workflows/gha-lint.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0
+    permissions:
+      actions: read
+      contents: read
+
+  dependency-review:
+    uses: furedea/reusable-workflows/.github/workflows/dependency-review.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0
+    permissions:
+      contents: read
+
+  nix-check:
+    uses: furedea/reusable-workflows/.github/workflows/nix-check.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0
+    permissions:
+      contents: read
+
   claude-review:
-    uses: furedea/reusable-workflows/.github/workflows/claude-review.yml@fc0cba95e88e0cdad9837bf8212d324f3cad50a5 # main
+    uses: furedea/reusable-workflows/.github/workflows/claude-review.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0
     permissions:
       contents: read
       pull-requests: write
     secrets:
       claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
   codex-review:
-    uses: furedea/reusable-workflows/.github/workflows/codex-review.yml@9bea83d997de4006c411bb5f40091275e316f44f # main
+    uses: furedea/reusable-workflows/.github/workflows/codex-review.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0
     permissions: {}
     secrets:
       codex_review_token: ${{ secrets.CODEX_REVIEW_TOKEN }}
 
   all-green:
     if: always()
-    needs: [nix-lint, lint, typecheck, test, audit, claude-review, codex-review]
+    needs:
+      - nix-lint
+      - lint
+      - typecheck
+      - test
+      - audit
+      - gha-lint
+      - dependency-review
+      - nix-check
+      - claude-review
+      - codex-review
     runs-on: ubuntu-latest
     timeout-minutes: 1
     permissions: {}

.github/workflows/codeql.yml

@@ -20,6 +20,7 @@ concurrency:
 
 jobs:
   analyze:
+    if: ${{ !github.event.repository.private }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
@@ -37,12 +38,12 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
         with:
           languages: ${{ matrix.language }}
           build-mode: none
 
       - name: Analyze
-        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
         with:
           category: /language:${{ matrix.language }}