Repository navigation
feat: add the shared workflows, scripts, and renovate preset - #3
Merged
Merged
Conversation
Move the release scripts that panicboat/monorepo and panicboat/platform each carry into the shared repository.
Base them on the monorepo version, which reads the stack path templates, so both layouts resolve to targets.
Derive the release-please package and exclude-paths from the path template, because cutting working_directory at /infrastructure/ fails on the aws/{service}/{environment} layout.
Reject a terragrunt production environment whose apply_trigger is not release.
Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7
Signed-off-by: panicboat <panicboat@gmail.com>
… scripts The kubernetes-hydrate scripts and their tests move from platform unchanged. decide.sh moves from monorepo and takes the paths it watches from SCOPE_PATTERN, which is required. find-configs.sh lists the directories that hold a release-please-config.json, so a workflow can build a matrix from it. test-scripts.yaml runs every script test on pull requests and on pushes to main. aqua.yaml pins the yq and kustomize that the kubernetes-hydrate tests run against. Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7 Signed-off-by: panicboat <panicboat@gmail.com>
render-diff.sh looked for hydrate-component.sh and summarize-manifest-diff.sh under the caller's .github/scripts/kubernetes-hydrate. Shared workflows run it from .shared-workflows/scripts/kubernetes-hydrate, where the caller's checkout has no such directory, so every component reported a render failure while the script exited 0. It now takes them from its own directory and reads the caller's files from the working directory. The test no longer copies the scripts into the fixture repository, so it fails when the sibling lookup depends on the caller's checkout. Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7 Signed-off-by: panicboat <panicboat@gmail.com>
grep exits 2 for an invalid pattern, and the negated condition treated that as no match. decide.sh then answered skip-unchanged, so a broken pattern silently skipped the docs check. It now exits 1 with an error that names SCOPE_PATTERN, and passes the pattern with -e so a leading dash stays part of it. Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7 Signed-off-by: panicboat <panicboat@gmail.com>
Add reusable workflows for the Actions SHA-pin lint, the semantic pull request title check, the CI gatekeeper and the deploy label dispatcher. Add this repository's own callers for the first three, so the shared workflows are exercised from the same commit that defines them. Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7 Signed-off-by: panicboat <panicboat@gmail.com>
monorepo and platform each carried their own label-base-deploy resolver and deploy stacks. One resolver now serves both, and each repository enables stacks only through its workflow-config.yaml. Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7 Signed-off-by: panicboat <panicboat@gmail.com>
Callers need one place for the release flow, so the release-please, plan, deploy and build workflows and the terragrunt release config check move here as reusable workflows. They read the scripts from a checkout of this repository at the workflow's own sha and call the shared terragrunt runner and container builder without a ref. Callers grant the permissions and own the workflow-level concurrency, so the reusables only declare the per-job permissions the originals had. The tag comes from github.event.inputs because the inputs context of a reusable workflow holds its own workflow_call inputs. This repository releases itself with release-please at the root, and workflows/test.sh pins the structure the release and deploy workflows depend on. Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7 Signed-off-by: panicboat <panicboat@gmail.com>
This repository only allows squash merges, so the feature branch commit that bootstrap-sha pointed at never exists on main. Main has few commits, so release-please needs no lower bound for its first release. The tag reads in the deploy and build workflows now say why they take the dispatch input from the event. Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7 Signed-off-by: panicboat <panicboat@gmail.com>
Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7 Signed-off-by: panicboat <panicboat@gmail.com>
The three repositories carried the same Renovate settings, so the top-level options and the four package rules they share move here as default.json. Rules that only some repositories have, such as the OpenTofu tracking and the custom managers, stay in those repositories. References to this repository skip minimumReleaseAge because the shared workflows are released by us, and a wait would only delay picking up a release. This repository extends its own preset with local>, which github.com resolves like github>. The README now describes how the shared workflows are called and how the preset is extended. Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7 Signed-off-by: panicboat <panicboat@gmail.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
The shared workflows call each other with `$/` and run their scripts from a self checkout of `job.workflow_sha`. No pull request check ran either path, so a regression in them surfaced only in the consuming repositories. A test workflow chain now calls a reusable workflow through `$/` and asserts that the self checkout is the running commit and can run a script. A workflow test pins the `$/` call so it cannot silently become `./`. Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7 Signed-off-by: panicboat <panicboat@gmail.com>
The kubernetes builder checked out `github.head_ref` for every stack, so the kustomize stack diffed the pull request head instead of the default merge commit against the base. Only the helmfile stack needs the branch head, because its hydrate job commits manifests to the pull request branch first. The builder now takes a `ref` input (empty uses the event's default ref) and the resolver passes `github.head_ref` from the helmfile job only. `fetch-depth: 0` is dropped because no step of the builder reads history. Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7 Signed-off-by: panicboat <panicboat@gmail.com>
panicboat
marked this pull request as ready for review
October 24, 2026 23:22
This was referenced Oct 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
monorepo・platform・deploy-actions で重複している workflow と scripts の正本を、このリポジトリに追加します。
各リポジトリはまだ切り替えません（後続の PR で切り替えます）。
Why
同じか酷似した workflow と scripts が複数のリポジトリに並んでいて、片方だけ直し忘れたり、コピー後に中身がずれたりしています。
設計は
docs/superpowers/specs/2026-10-25-shared-workflows-design.md、手順はdocs/superpowers/plans/2026-10-25-shared-workflows.mdにあります。Before / After
.github/workflows/reusable--*.yamlとscripts/に 1 つだけあるvX.Y.Zを付けるDecisions
$/.github/workflows/...で呼び、scripts はjob.workflow_repositoryをjob.workflow_shaで.shared-workflows/に checkout して実行します。permissionsを宣言しません。check-release-configs.shは、release-please の package とexclude-pathsをパスのテンプレートから求めます。/infrastructure/を前提にしていて、platform の配置では失敗したためです。render-diff.shは、隣の scripts を自分の置き場所から探します。.shared-workflows/から実行されるためです。decide.shは対象のパスをSCOPE_PATTERNで受け取り、不正な正規表現ではエラーで止まります。v1.0.0にするため、release-please-config.jsonにrelease-as: "1.0.0"を入れています。v1.0.0の release 後に削除します。renovate.jsonで完全に一致する部分だけを持ちます。Impact
Verification
scripts/*/test.sh・scripts/*/*.test.sh・scripts/kubernetes-hydrate/tests/*.test.sh）が手元で exit 0 でした。check-release-configs.shとvalidate-apply-trigger.shは、monorepo と platform のorigin/mainの実物に対して exit 0 でした。renovate@44.181.4のrenovate-config-validatorがdefault.jsonと.github/renovate.jsonを通しました。actionlintのエラーは、actionlint 1.7.12 が知らない$/・job.workflow_*・ubuntu-26.04-armの行だけでした。Relations
🤖 Generated with Claude Code
https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7