Run CI through the shared plugin action #29

Merged

tiagoagueda merged 1 commit from 1170-shared-ci into main

2026-11-12 10:13:56 +00:00

tiagoagueda commented

2026-11-12 09:47:51 +00:00

Owner

Refs postulo/postulo#1170. CI runs through the shared action https://source.tiagoagueda.com/Postulo/plugin-ci@v1, proven on postulo-helloworld: uv pinned and checked in one place, uv's cache kept between runs, no CI run on a tag (the release gate has its own workflow), and the dependency audit as its own job, also run weekly from weekly.yml. Every kept job keeps its id and name, so the status checks do not change; checked locally with actionlint, zizmor and the repository's own tests.

🤖 Generated with Claude Code

Refs postulo/postulo#1170. CI runs through the shared action `https://source.tiagoagueda.com/Postulo/plugin-ci@v1`, proven on postulo-helloworld: uv pinned and checked in one place, uv's cache kept between runs, no CI run on a tag (the release gate has its own workflow), and the dependency audit as its own job, also run weekly from `weekly.yml`. Every kept job keeps its id and name, so the status checks do not change; checked locally with actionlint, zizmor and the repository's own tests. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda added 1 commit

2026-11-12 09:47:51 +00:00

Run CI through the shared plugin action

CI / Audit the locked dependencies (pull_request) Successful in 16s

Details

CI / test (pull_request) Successful in 3m44s

Details

84a45e49c0

Every plugin repository carried its own copy of the same workflow, and the
copies drifted; a uv bump was some fifteen hand edits across eight
repositories. The workflows now check the repository out and call
Postulo/plugin-ci@v1 by its full address, which holds the pinned uv (its
installer checked by sha256), uv's cache, the lint, the catalogue checks,
Weblate's gate, the tests, the release gate and the audit.

- ci.yml: no `tags:` trigger any more (a tag is a commit main already
  tested; release.yml is the one workflow a tag starts), and no schedule:
  it ran the whole workflow, tests and all, every week. Jobs `test` and
  `audit` keep their ids and names, so the status checks do not change.
- weekly.yml (new): the audit alone, Mondays 06:17 as before, and by hand.
- release.yml: the release gate runs through the action.
- Both ci.yml and release.yml pass `extra-system-packages:
  libharfbuzz-subset0`, which the locked WeasyPrint asks for.
- tests/test_workflows.py: the uv installer it checked (#15) now lives in
  the action, so it holds instead that every workflow calls the action by
  its full address and nothing else installs uv, that the subsetter is
  installed, and that weekly.yml audits the lock on a schedule.

No `permissions:` block (this Forgejo ignores it and warns), and the time
limits sit on the steps, as the action's README says.

Refs postulo/postulo#1170

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda merged commit b3d17bf5ed into main

2026-11-12 10:13:56 +00:00

tiagoagueda deleted branch 1170-shared-ci

2026-11-12 10:13:56 +00:00

tiagoagueda referenced this pull request from a commit

2026-11-12 10:13:58 +00:00

Run CI through the shared plugin action (#29)