Run CI through the shared plugin action #53

Merged

tiagoagueda merged 1 commit from 1170-shared-ci into main

2026-11-12 10:09:47 +00:00

tiagoagueda commented

2026-11-12 09:47:37 +00:00

Owner

Refs postulo/postulo#1170. CI runs through the shared action https://source.tiagoagueda.com/Postulo/plugin-ci@v1, proven on postulo-helloworld: uv pinned and checked in one place, uv's cache kept between runs, no CI run on a tag (the release gate has its own workflow), and the dependency audit as its own job, also run weekly from weekly.yml. Every kept job keeps its id and name, so the status checks do not change; checked locally with actionlint, zizmor and the repository's own tests.

🤖 Generated with Claude Code

Refs postulo/postulo#1170. CI runs through the shared action `https://source.tiagoagueda.com/Postulo/plugin-ci@v1`, proven on postulo-helloworld: uv pinned and checked in one place, uv's cache kept between runs, no CI run on a tag (the release gate has its own workflow), and the dependency audit as its own job, also run weekly from `weekly.yml`. Every kept job keeps its id and name, so the status checks do not change; checked locally with actionlint, zizmor and the repository's own tests. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda added 1 commit

2026-11-12 09:47:38 +00:00

Run CI through the shared plugin action

CI / test (pull_request) Successful in 3m29s

Details

CI / Audit the locked dependencies (pull_request) Successful in 21s

Details

79769e9ef5

Every plugin repository carried its own copy of the same workflow, and the
copies drifted; a uv bump was some fifteen hand edits across eight
repositories. The workflows now check the repository out and call
Postulo/plugin-ci@v1 by its full address, which holds the pinned uv (its
installer checked by sha256), uv's cache, the lint, the catalogue checks,
Weblate's gate, the tests, the release gate and the audit.

- ci.yml: no `tags:` trigger any more (a tag is a commit main already
  tested; release.yml is the one workflow a tag starts). The dependency
  audit (#31) moves out of the test job into a job of its own, "Audit the
  locked dependencies", which needs no install. Job `test` is unchanged as
  a status check.
- weekly.yml (new): that audit alone, Mondays 06:17, and by hand, so an
  advisory published in a quiet week is seen.
- release.yml: the release gate runs through the action.

No `permissions:` block (this Forgejo ignores it and warns), and the time
limits sit on the steps, as the action's README says.

Refs postulo/postulo#1170

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda merged commit d9666b0cda into main

2026-11-12 10:09:47 +00:00

tiagoagueda deleted branch 1170-shared-ci

2026-11-12 10:09:48 +00:00

tiagoagueda referenced this pull request from a commit

2026-11-12 10:09:50 +00:00

Run CI through the shared plugin action (#53)