From bd70b48926b6c9292f09a264f1a6544fb2f1aafc Mon Sep 17 00:00:00 2001 From: Matti Airas Date: Thu, 17 Sep 2026 12:46:11 +0300 Subject: [PATCH 1/4] feat: add checks.yml for deb-free PR checks Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/checks.yml | 56 ++++++++++++++++++++++++ .github/workflows/version-bump-check.yml | 2 +- 2 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/checks.yml diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml new file mode 100644 index 0000000..9960012 --- /dev/null +++ b/.github/workflows/checks.yml @@ -0,0 +1,56 @@ +# Reusable PR checks for every caller, packaged or not. +# +# Requirements: +# - .github/actions/run-tests/action.yml in the caller repository +# - .github/actions/check-versions/action.yml (or .yaml) is optional +# +# Deb repositories also call build-deb.yml. Callers gate branch protection on +# a status job of their own; the job names here are not part of the interface. + +name: Checks + +on: + workflow_call: + inputs: + runs-on: + description: 'Runner to use for every job' + required: false + default: 'ubuntu-latest' + type: string + +permissions: + contents: read + +jobs: + tests: + runs-on: ${{ inputs.runs-on }} + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Run tests + uses: ./.github/actions/run-tests + + version-check: + runs-on: ${{ inputs.runs-on }} + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Check if check-versions action exists + id: check-action + run: | + if [ -f .github/actions/check-versions/action.yml ] || [ -f .github/actions/check-versions/action.yaml ]; then + echo "exists=true" >> "$GITHUB_OUTPUT" + else + echo "exists=false" >> "$GITHUB_OUTPUT" + fi + + - name: Check version consistency + if: steps.check-action.outputs.exists == 'true' + uses: ./.github/actions/check-versions + + version-bump-check: + uses: ./.github/workflows/version-bump-check.yml + with: + runs-on: ${{ inputs.runs-on }} diff --git a/.github/workflows/version-bump-check.yml b/.github/workflows/version-bump-check.yml index 0f83294..94c1b12 100644 --- a/.github/workflows/version-bump-check.yml +++ b/.github/workflows/version-bump-check.yml @@ -1,5 +1,5 @@ # Reusable workflow for version bump checks -# Can be called standalone or from pr-checks.yml +# Can be called standalone, from checks.yml, or from the legacy pr-checks.yml # # Checks: # - App-level (apps/*/metadata.yaml): per-PR, requires metadata bump when app files change From 2d121d3f28ed1ae3a7df9f0c4896b4b722316b67 Mon Sep 17 00:00:00 2001 From: Matti Airas Date: Thu, 17 Sep 2026 12:46:11 +0300 Subject: [PATCH 2/4] feat: add build-deb.yml for explicit deb checks Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/build-deb.yml | 75 +++++++++++++++++++++++++++++++++ 1 file changed, 75 insertions(+) create mode 100644 .github/workflows/build-deb.yml diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml new file mode 100644 index 0000000..166baff --- /dev/null +++ b/.github/workflows/build-deb.yml @@ -0,0 +1,75 @@ +# Reusable Debian package build for deb repositories. +# +# Builds with the caller's .github/actions/build-deb action and runs lintian +# on every package found in the repository root or build/. A build that +# produces no package fails. +# +# Requirements: +# - .github/actions/build-deb/action.yml in the caller repository + +name: Build Debian package + +on: + workflow_call: + inputs: + runs-on: + description: 'Runner to use' + required: false + default: 'ubuntu-latest' + type: string + lintian: + description: 'Run lintian on the built packages' + required: false + default: true + type: boolean + +permissions: + contents: read + +jobs: + build-deb: + runs-on: ${{ inputs.runs-on }} + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Build .deb package + uses: ./.github/actions/build-deb + + - name: Find built packages + id: packages + run: | + mapfile -t debs < <(find . build -maxdepth 1 -name '*.deb' -type f 2>/dev/null | sort) + if [ "${#debs[@]}" -eq 0 ]; then + echo "::error::The build-deb action produced no .deb in the repository root or build/" + exit 1 + fi + printf '%s\n' "${debs[@]}" + { + echo 'list<> "$GITHUB_OUTPUT" + + - name: Install lintian + if: inputs.lintian + run: sudo apt-get update && sudo apt-get install -y lintian + + - name: Run lintian + if: inputs.lintian + env: + DEBS: ${{ steps.packages.outputs.list }} + run: | + failed=0 + while IFS= read -r deb; do + echo "" + echo "=== Checking: $deb ===" + if ! lintian --info --display-info --fail-on error,warning "$deb"; then + failed=1 + fi + done <<< "$DEBS" + if [ "$failed" -eq 1 ]; then + echo "" + echo "::error::Lintian found issues. To suppress specific tags, create debian/.lintian-overrides" + exit 1 + fi From 05494f851c36beff6d1ff4d6926b9af2997fbc58 Mon Sep 17 00:00:00 2001 From: Matti Airas Date: Thu, 17 Sep 2026 12:46:11 +0300 Subject: [PATCH 3/4] fix(version-bump-check): ignore CodeRabbit config Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/version-bump-check.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/version-bump-check.yml b/.github/workflows/version-bump-check.yml index 94c1b12..37ba276 100644 --- a/.github/workflows/version-bump-check.yml +++ b/.github/workflows/version-bump-check.yml @@ -101,7 +101,7 @@ jobs: PACKAGE_FILES=$(echo "$CHANGED_FILES" \ | grep -v '^apps/' \ | grep -v -E '^(VERSION$|.*\.md$|docs/|\.github/|\.devcontainer/|\.vscode/|\.claude/)' \ - | grep -v -E '^(lefthook\.yml$|\.bumpversion\.cfg$|\.gitignore$|\.editorconfig$|LICENSE)' \ + | grep -v -E '^(lefthook\.yml$|\.bumpversion\.cfg$|\.gitignore$|\.editorconfig$|LICENSE|\.coderabbit\.ya?ml$)' \ | grep -v -E '^(tests?/|__tests__/|e2e/|.*\.test\.[^/]+$|.*\.spec\.[^/]+$)' \ | grep -v -E '^(docker/|Dockerfile|config\.)' \ | grep -v -E '^(tools/|run$|Makefile$|Taskfile\.yml$)' \ From 17fc5cf2da0721a4c336f51538de710d3258106b Mon Sep 17 00:00:00 2001 From: Matti Airas Date: Thu, 17 Sep 2026 12:46:11 +0300 Subject: [PATCH 4/4] docs: add v1 pr.yml examples with status job Co-Authored-By: Claude Opus 5 (1M context) --- examples/deb/.github/workflows/pr.yml | 26 ++++++++++++++++++++++++++ examples/npm/.github/workflows/pr.yml | 23 +++++++++++++++++++++++ 2 files changed, 49 insertions(+) create mode 100644 examples/deb/.github/workflows/pr.yml create mode 100644 examples/npm/.github/workflows/pr.yml diff --git a/examples/deb/.github/workflows/pr.yml b/examples/deb/.github/workflows/pr.yml new file mode 100644 index 0000000..8e3ecf6 --- /dev/null +++ b/examples/deb/.github/workflows/pr.yml @@ -0,0 +1,26 @@ +name: PR checks + +# No branch filter: a PR stacked on another branch gets checked before it is +# retargeted to main. +on: + pull_request: + +jobs: + checks: + uses: halos-org/shared-workflows/.github/workflows/checks.yml@v1 + + build-deb: + uses: halos-org/shared-workflows/.github/workflows/build-deb.yml@v1 + + # Branch protection requires only this job. List every other job in needs, + # including jobs defined in this file. + status: + needs: [checks, build-deb] + if: always() + runs-on: ubuntu-latest + permissions: {} + steps: + - name: Require every job to succeed + env: + NEEDS: ${{ toJSON(needs) }} + run: jq -e 'all(.[]; .result == "success")' <<< "$NEEDS" diff --git a/examples/npm/.github/workflows/pr.yml b/examples/npm/.github/workflows/pr.yml new file mode 100644 index 0000000..88d4848 --- /dev/null +++ b/examples/npm/.github/workflows/pr.yml @@ -0,0 +1,23 @@ +name: PR checks + +# No branch filter: a PR stacked on another branch gets checked before it is +# retargeted to main. +on: + pull_request: + +jobs: + checks: + uses: halos-org/shared-workflows/.github/workflows/checks.yml@v1 + + # Branch protection requires only this job. List every other job in needs, + # including jobs defined in this file. + status: + needs: [checks] + if: always() + runs-on: ubuntu-latest + permissions: {} + steps: + - name: Require every job to succeed + env: + NEEDS: ${{ toJSON(needs) }} + run: jq -e 'all(.[]; .result == "success")' <<< "$NEEDS"