[furedea]

GitHub Actions の lint（actionlint，zizmor），dependency review，nix lint，flake check を，furedea/reusable-workflows v1.1.0 の共有 workflow から呼ぶように変えます．呼んだジョブは all-green の needs に入るので，失敗するとマージできません．CodeQL は workflow をやめ，GitHub の default setup に移します．

項目	今	変更後
共有 workflow の固定	@<sha> # main（main が進むと zizmor の ref-version-mismatch で落ちる）	@<sha> # v1.1.0
actionlint / zizmor	gha_lint.yml（workflow を変えた PR だけ）	ci.yml から gha-lint.yml を呼ぶ（全 PR，all-green に入る）
dependency review	dependency_review.yml（all-green の外），または無し	ci.yml から dependency-review.yml を呼ぶ．非公開 repo と PR 以外では飛ばして成功扱い
nix lint	ci.yml に直接書いたジョブ	nix-lint.yml を呼ぶ
flake check	repo ごと（無い repo もある）	nix-check.yml を呼ぶ（nix flake check -L と全 system の評価）
CodeQL	codeql.yml（非公開 repo でも動いて失敗する）	codeql.yml を消す．public repo は default setup をオンにする（本人が設定）
claude-review / codex-review	# main の古い SHA	# v1.1.0

• 呼んだ共有ジョブがすべて成功する
• all-green が green になる

出典

• 計画: ci: share the common workflows and align the CI layout across repositories reusable-workflows#6，ci: fail on uv.lock drift with UV_LOCKED #13
• 呼び出し先: furedea/reusable-workflows v1.1.0（ca7c5f2）．以後は release ごとに Renovate が更新する
• CodeQL の default setup: https://docs.github.com/en/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-08T16:19:40.909578Z	658778c	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[furedea]

@codex review

[github-actions]

Review summary

No blocking findings.

The diff does two things:

• It moves all six shared-workflow pins in ci.yml from c1a43f6 # v1.0.0 to ca7c5f2 # v1.1.0. Each call's permissions and secrets are unchanged.
• It deletes codeql.yml. That's intended: CodeQL moves to GitHub's default setup. That setup is a per-repo setting, so each public repo created from this template has to turn it on, or it will have no code scanning.

all-green still lists every called job, and it fails on failure, cancelled or skipped.

Not verified here: I couldn't fetch furedea/reusable-workflows at ca7c5f2, so I didn't check two things. First, that the v1.1.0 tag points at that SHA. Second, that v1.1.0 doesn't ask for more permissions or new required inputs or secrets than ci.yml gives it. The CI run on this PR will show both.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 658778c520

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".