Run CI through the shared plugin action #32

Merged

tiagoagueda merged 1 commit from 1170-shared-ci into main

2026-11-12 10:12:54 +00:00

tiagoagueda commented

2026-11-12 09:47:44 +00:00

Owner

Refs postulo/postulo#1170. CI runs through the shared action https://source.tiagoagueda.com/Postulo/plugin-ci@v1, proven on postulo-helloworld: uv pinned and checked in one place, uv's cache kept between runs, no CI run on a tag (the release gate has its own workflow), and the dependency audit as its own job, also run weekly from weekly.yml. Every kept job keeps its id and name, so the status checks do not change; checked locally with actionlint, zizmor and the repository's own tests.

🤖 Generated with Claude Code

Refs postulo/postulo#1170. CI runs through the shared action `https://source.tiagoagueda.com/Postulo/plugin-ci@v1`, proven on postulo-helloworld: uv pinned and checked in one place, uv's cache kept between runs, no CI run on a tag (the release gate has its own workflow), and the dependency audit as its own job, also run weekly from `weekly.yml`. Every kept job keeps its id and name, so the status checks do not change; checked locally with actionlint, zizmor and the repository's own tests. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda added 1 commit

2026-11-12 09:47:45 +00:00

Run CI through the shared plugin action

CI / Audit the locked dependencies (pull_request) Successful in 41s

Details

CI / test (pull_request) Successful in 3m41s

Details

a5d33f8456

Every plugin repository carried its own copy of the same workflow, and the
copies drifted; a uv bump was some fifteen hand edits across eight
repositories. The workflows now check the repository out and call
Postulo/plugin-ci@v1 by its full address, which holds the pinned uv (its
installer checked by sha256), uv's cache, the lint, the catalogue checks,
Weblate's gate, the tests, the release gate and the audit.

- ci.yml: no `tags:` trigger any more (a tag is a commit main already
  tested; release.yml is the one workflow a tag starts). Jobs `test` and
  `audit` ("Audit the locked dependencies", #17) keep their ids and names,
  so the status checks do not change.
- weekly.yml (new): the audit alone, Mondays 06:17, and by hand, so an
  advisory published in a quiet week is seen.
- release.yml: the release gate runs through the action.

No `permissions:` block (this Forgejo ignores it and warns), and the time
limits sit on the steps, as the action's README says.

Refs postulo/postulo#1170

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda merged commit b91fc9ff25 into main

2026-11-12 10:12:54 +00:00

tiagoagueda deleted branch 1170-shared-ci

2026-11-12 10:12:54 +00:00

tiagoagueda referenced this pull request from a commit

2026-11-12 10:12:55 +00:00

Run CI through the shared plugin action (#32)