Run CI through the shared plugin action #40

Merged

tiagoagueda merged 1 commit from 1170-shared-ci into main

2026-11-12 10:05:38 +00:00

tiagoagueda commented

2026-11-12 09:47:31 +00:00

Owner

Refs postulo/postulo#1170. CI runs through the shared action https://source.tiagoagueda.com/Postulo/plugin-ci@v1, proven on postulo-helloworld: uv pinned and checked in one place, uv's cache kept between runs, no CI run on a tag (the release gate has its own workflow), and the dependency audit as its own job, also run weekly from weekly.yml. Every kept job keeps its id and name, so the status checks do not change; checked locally with actionlint, zizmor and the repository's own tests.

🤖 Generated with Claude Code

Refs postulo/postulo#1170. CI runs through the shared action `https://source.tiagoagueda.com/Postulo/plugin-ci@v1`, proven on postulo-helloworld: uv pinned and checked in one place, uv's cache kept between runs, no CI run on a tag (the release gate has its own workflow), and the dependency audit as its own job, also run weekly from `weekly.yml`. Every kept job keeps its id and name, so the status checks do not change; checked locally with actionlint, zizmor and the repository's own tests. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda added 1 commit

2026-11-12 09:47:32 +00:00

Run CI through the shared plugin action

CI / test (pull_request) Successful in 3m33s

Details

CI / Audit the locked dependencies (pull_request) Successful in 19s

Details

f040eb29a7

Every plugin repository carried its own copy of the same workflow, and the
copies drifted; a uv bump was some fifteen hand edits across eight
repositories. The workflows now check the repository out and call
Postulo/plugin-ci@v1 by its full address, which holds the pinned uv (its
installer checked by sha256), uv's cache, the lint, the catalogue checks,
Weblate's gate, the tests, the release gate and the audit.

- ci.yml: no `tags:` trigger any more (a tag is a commit main already
  tested; release.yml is the one workflow a tag starts). The dependency
  audit moves out of the test job into a job of its own, "Audit the locked
  dependencies", which needs no install. Job `test` is unchanged as a
  status check.
- weekly.yml (new): that audit alone, Mondays 06:17, and by hand.
- every-python.yml: the 3.12/3.13 matrix now calls the action with lint and
  the catalogue checks off; triggers (push to main touching pyproject.toml
  or uv.lock, Mondays 07:17, by hand) and the job name kept.
- release.yml: the audit step goes (main audited the commit, and the
  weekly run audits it again); the release gate runs through the action.

No `permissions:` block (this Forgejo ignores it and warns), and the time
limits sit on the steps, as the action's README says.

Refs postulo/postulo#1170

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda merged commit 16044dbe09 into main

2026-11-12 10:05:38 +00:00

tiagoagueda referenced this pull request from a commit

2026-11-12 10:05:38 +00:00

Run CI through the shared plugin action (#40)

tiagoagueda deleted branch 1170-shared-ci

2026-11-12 10:05:38 +00:00