[furedea]

GitHub Actions の lint（actionlint，zizmor），dependency review，nix lint，flake check を，furedea/reusable-workflows v1.0.0 の共有 workflow から呼ぶように変えます．4 つとも all-green の needs に入るので，失敗するとマージできません．

項目	今	変更後
共有 workflow の固定	@<sha> # main（main が進むと zizmor の ref-version-mismatch で落ちる）	@<sha> # v1.0.0
actionlint / zizmor	gha_lint.yml（workflow を変えた PR だけ）	ci.yml から gha-lint.yml を呼ぶ（全 PR，all-green に入る）
dependency review	dependency_review.yml（all-green の外），または無し	ci.yml から dependency-review.yml を呼ぶ．非公開 repo と PR 以外では飛ばして成功扱い
nix lint	ci.yml に直接書いたジョブ	nix-lint.yml を呼ぶ
flake check	repo ごと（無い repo もある）	nix-check.yml を呼ぶ（nix flake check -L と全 system の評価）
CodeQL	非公開でも動く	非公開 repo では飛ばす．codeql-action を v4.39.2 に
claude-review / codex-review	# main の古い SHA	# v1.0.0

• gha-lint / …，dependency-review / …，nix-lint / nix-lint，nix-check / nix-check が成功する
• all-green が green になる

出典

• 計画: ci: share the common workflows and align the CI layout across repositories reusable-workflows#6，ci: add the claude review job #13
• 呼び出し先: furedea/reusable-workflows v1.0.0（c1a43f6）．以後は release ごとに Renovate が更新する
• 消した .github/dependency_review_config.yml は共有 workflow の既定値（fail-on-severity: high）と同じだった

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-08T13:38:46.770734Z	82d45fb	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[furedea]

@codex review

[github-actions]

P2 — I don't think this guard works for the weekly schedule trigger. A schedule event payload doesn't include repository, so github.event.repository.private is null and !null is true. In a private repo made from this template, the PR and push runs get skipped as intended, but the Monday cron run would still start CodeQL. It would then fail at upload because code scanning isn't available on private repos without GHAS.

One possible fix is to also skip scheduled runs on private repos with a check that doesn't depend on the event payload. For example, gate on a repo variable, or use github.event_name != 'schedule' && !github.event.repository.private. That second option also drops the cron on public repos, so pick whichever fits.

[github-actions]

Review summary

Blocking findings (P0/P1): 0

• P2 codeql.yml: the new !github.event.repository.private check probably doesn't cover the weekly schedule trigger, because that event's payload has no repository field. So in a private repo created from this template, the cron run would still start CodeQL and fail. Details are in the inline comment.

The rest of the diff looks fine. The four new jobs are added to all-green, every caller job gets the minimum permissions, and all reusable workflows are pinned to the same v1.0.0 SHA with a matching comment.

I couldn't open the called workflows in furedea/reusable-workflows from this environment. So I couldn't confirm two things, and both are worth checking in this PR's CI run:

1. When dependency-review skips (on push to main, or in a private repo), the caller job must report success, not skipped. If it reports skipped, all-green will fail.
2. The called workflows must not set a workflow-level concurrency group like ${{ github.workflow }}-${{ github.ref }}. In a called workflow that resolves to the caller's group, so it would cancel CI.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 82d45fb08e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".