feat: add v1 PR workflows with opt-in deb checks

.github/workflows/build-deb.yml

@@ -0,0 +1,75 @@
+# Reusable Debian package build for deb repositories.
+#
+# Builds with the caller's .github/actions/build-deb action and runs lintian
+# on every package found in the repository root or build/. A build that
+# produces no package fails.
+#
+# Requirements:
+# - .github/actions/build-deb/action.yml in the caller repository
+
+name: Build Debian package
+
+on:
+  workflow_call:
+    inputs:
+      runs-on:
+        description: 'Runner to use'
+        required: false
+        default: 'ubuntu-latest'
+        type: string
+      lintian:
+        description: 'Run lintian on the built packages'
+        required: false
+        default: true
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  build-deb:
+    runs-on: ${{ inputs.runs-on }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Build .deb package
+        uses: ./.github/actions/build-deb
+
+      - name: Find built packages
+        id: packages
+        run: |
+          mapfile -t debs < <(find . build -maxdepth 1 -name '*.deb' -type f 2>/dev/null | sort)
+          if [ "${#debs[@]}" -eq 0 ]; then
+            echo "::error::The build-deb action produced no .deb in the repository root or build/"
+            exit 1
+          fi
+          printf '%s\n' "${debs[@]}"
+          {
+            echo 'list<<EOF'
+            printf '%s\n' "${debs[@]}"
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Install lintian
+        if: inputs.lintian
+        run: sudo apt-get update && sudo apt-get install -y lintian
+
+      - name: Run lintian
+        if: inputs.lintian
+        env:
+          DEBS: ${{ steps.packages.outputs.list }}
+        run: |
+          failed=0
+          while IFS= read -r deb; do
+            echo ""
+            echo "=== Checking: $deb ==="
+            if ! lintian --info --display-info --fail-on error,warning "$deb"; then
+              failed=1
+            fi
+          done <<< "$DEBS"
+          if [ "$failed" -eq 1 ]; then
+            echo ""
+            echo "::error::Lintian found issues. To suppress specific tags, create debian/<package>.lintian-overrides"
+            exit 1
+          fi

.github/workflows/checks.yml

@@ -0,0 +1,56 @@
+# Reusable PR checks for every caller, packaged or not.
+#
+# Requirements:
+# - .github/actions/run-tests/action.yml in the caller repository
+# - .github/actions/check-versions/action.yml (or .yaml) is optional
+#
+# Deb repositories also call build-deb.yml. Callers gate branch protection on
+# a status job of their own; the job names here are not part of the interface.
+
+name: Checks
+
+on:
+  workflow_call:
+    inputs:
+      runs-on:
+        description: 'Runner to use for every job'
+        required: false
+        default: 'ubuntu-latest'
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    runs-on: ${{ inputs.runs-on }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run tests
+        uses: ./.github/actions/run-tests
+
+  version-check:
+    runs-on: ${{ inputs.runs-on }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Check if check-versions action exists
+        id: check-action
+        run: |
+          if [ -f .github/actions/check-versions/action.yml ] || [ -f .github/actions/check-versions/action.yaml ]; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Check version consistency
+        if: steps.check-action.outputs.exists == 'true'
+        uses: ./.github/actions/check-versions
+
+  version-bump-check:
+    uses: ./.github/workflows/version-bump-check.yml
+    with:
+      runs-on: ${{ inputs.runs-on }}

.github/workflows/version-bump-check.yml

@@ -1,5 +1,5 @@
 # Reusable workflow for version bump checks
-# Can be called standalone or from pr-checks.yml
+# Can be called standalone, from checks.yml, or from the legacy pr-checks.yml
 #
 # Checks:
 # - App-level (apps/*/metadata.yaml): per-PR, requires metadata bump when app files change
@@ -101,7 +101,7 @@ jobs:
                 PACKAGE_FILES=$(echo "$CHANGED_FILES" \
                   | grep -v '^apps/' \
                   | grep -v -E '^(VERSION$|.*\.md$|docs/|\.github/|\.devcontainer/|\.vscode/|\.claude/)' \
-                  | grep -v -E '^(lefthook\.yml$|\.bumpversion\.cfg$|\.gitignore$|\.editorconfig$|LICENSE)' \
+                  | grep -v -E '^(lefthook\.yml$|\.bumpversion\.cfg$|\.gitignore$|\.editorconfig$|LICENSE|\.coderabbit\.ya?ml$)' \
                   | grep -v -E '^(tests?/|__tests__/|e2e/|.*\.test\.[^/]+$|.*\.spec\.[^/]+$)' \
                   | grep -v -E '^(docker/|Dockerfile|config\.)' \
                   | grep -v -E '^(tools/|run$|Makefile$|Taskfile\.yml$)' \

examples/deb/.github/workflows/pr.yml

@@ -0,0 +1,26 @@
+name: PR checks
+
+# No branch filter: a PR stacked on another branch gets checked before it is
+# retargeted to main.
+on:
+  pull_request:
+
+jobs:
+  checks:
+    uses: halos-org/shared-workflows/.github/workflows/checks.yml@v1
+
+  build-deb:
+    uses: halos-org/shared-workflows/.github/workflows/build-deb.yml@v1
+
+  # Branch protection requires only this job. List every other job in needs,
+  # including jobs defined in this file.
+  status:
+    needs: [checks, build-deb]
+    if: always()
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Require every job to succeed
+        env:
+          NEEDS: ${{ toJSON(needs) }}
+        run: jq -e 'all(.[]; .result == "success")' <<< "$NEEDS"

examples/npm/.github/workflows/pr.yml

@@ -0,0 +1,23 @@
+name: PR checks
+
+# No branch filter: a PR stacked on another branch gets checked before it is
+# retargeted to main.
+on:
+  pull_request:
+
+jobs:
+  checks:
+    uses: halos-org/shared-workflows/.github/workflows/checks.yml@v1
+
+  # Branch protection requires only this job. List every other job in needs,
+  # including jobs defined in this file.
+  status:
+    needs: [checks]
+    if: always()
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Require every job to succeed
+        env:
+          NEEDS: ${{ toJSON(needs) }}
+        run: jq -e 'all(.[]; .result == "success")' <<< "$NEEDS"