Skip to content

ci: use the shared lint and nix workflows #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
furedea merged 1 commit into from
Nov 8, 2026
Merged

ci: use the shared lint and nix workflows #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 0 additions & 5 deletions .github/dependency_review_config.yml
View file
Open in desktop

This file was deleted.

54 changes: 30 additions & 24 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,29 +18,9 @@ defaults:

jobs:
nix-lint:
runs-on: ubuntu-latest
timeout-minutes: 10
uses: furedea/reusable-workflows/.github/workflows/nix-lint.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0
permissions:
contents: read
steps:
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false

- name: Install Nix
uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

- name: Run nixfmt
run: |
mapfile -t files < <(git ls-files "*.nix")
((${#files[@]} == 0)) || nix run nixpkgs#nixfmt -- --check "${files[@]}"

- name: Run statix
run: nix run nixpkgs#statix -- check .

- name: Run deadnix
run: nix run nixpkgs#deadnix -- --fail .

lint:
runs-on: ubuntu-latest
Expand Down Expand Up @@ -121,23 +101,49 @@ jobs:
- name: Run cargo-machete
uses: bnjbvr/cargo-machete@ac30a525c0a8d163a92d727b3ff079ee3f6ecb08 # v0.9.2

gha-lint:
uses: furedea/reusable-workflows/.github/workflows/gha-lint.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0
permissions:
actions: read
contents: read

dependency-review:
uses: furedea/reusable-workflows/.github/workflows/dependency-review.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0
permissions:
contents: read

nix-check:
uses: furedea/reusable-workflows/.github/workflows/nix-check.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0
permissions:
contents: read

claude-review:
uses: furedea/reusable-workflows/.github/workflows/claude-review.yml@fc0cba95e88e0cdad9837bf8212d324f3cad50a5 # main
uses: furedea/reusable-workflows/.github/workflows/claude-review.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0
permissions:
contents: read
pull-requests: write
secrets:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

codex-review:
uses: furedea/reusable-workflows/.github/workflows/codex-review.yml@9bea83d997de4006c411bb5f40091275e316f44f # main
uses: furedea/reusable-workflows/.github/workflows/codex-review.yml@c1a43f64ed01a49fa05eccbf8a45dcdf0a9385f9 # v1.0.0
permissions: {}
secrets:
codex_review_token: ${{ secrets.CODEX_REVIEW_TOKEN }}

all-green:
if: always()
needs: [nix-lint, lint, format, test, audit, claude-review, codex-review]
needs:
- nix-lint
- lint
- format
- test
- audit
- gha-lint
- dependency-review
- nix-check
- claude-review
- codex-review
runs-on: ubuntu-latest
timeout-minutes: 1
permissions: {}
Expand Down
5 changes: 3 additions & 2 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ concurrency:

jobs:
analyze:
if: ${{ !github.event.repository.private }}

@github-actions github-actions Bot Nov 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 — I don't think this guard works for the weekly schedule trigger. A schedule event payload doesn't include repository, so github.event.repository.private is null and !null is true. In a private repo made from this template, the PR and push runs get skipped as intended, but the Monday cron run would still start CodeQL. It would then fail at upload because code scanning isn't available on private repos without GHAS.

One possible fix is to also skip scheduled runs on private repos with a check that doesn't depend on the event payload. For example, gate on a repo variable, or use github.event_name != 'schedule' && !github.event.repository.private. That second option also drops the cron on public repos, so pick whichever fits.

runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
Expand All @@ -37,12 +38,12 @@ jobs:
persist-credentials: false

- name: Initialize CodeQL
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
with:
languages: ${{ matrix.language }}
build-mode: none

- name: Analyze
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
with:
category: /language:${{ matrix.language }}
31 changes: 0 additions & 31 deletions .github/workflows/dependency_review.yml
View file
Open in desktop

This file was deleted.

59 changes: 0 additions & 59 deletions .github/workflows/gha_lint.yml
View file
Open in desktop

This file was deleted.

Loading