From 6f6d8987df7629e76da98fdd4cea507ab9b0146c Mon Sep 17 00:00:00 2001
From: panicboat <panicboat@gmail.com>
Date: Sun, 25 Oct 2026 11:42:00 +0900
Subject: [PATCH 1/2] refactor: mark the workflows called only by other shared
 workflows as internal

Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7
Signed-off-by: panicboat <panicboat@gmail.com>
---
 ...drator.yaml => internal--helmfile-hydrator.yaml} |  2 +-
 ...er-builder.yaml => internal--image-builder.yaml} |  2 +-
 ...s-builder.yaml => internal--kustomize-diff.yaml} |  2 +-
 .../reusable--label-base-deploy--resolver.yaml      |  8 ++++----
 .github/workflows/reusable--release--build.yaml     |  2 +-
 README.md                                           |  1 +
 scripts/workflows/test.sh                           | 13 ++++++++++---
 7 files changed, 19 insertions(+), 11 deletions(-)
 rename .github/workflows/{reusable--kubernetes-hydrator.yaml => internal--helmfile-hydrator.yaml} (99%)
 rename .github/workflows/{reusable--container-builder.yaml => internal--image-builder.yaml} (99%)
 rename .github/workflows/{reusable--kubernetes-builder.yaml => internal--kustomize-diff.yaml} (99%)

diff --git a/.github/workflows/reusable--kubernetes-hydrator.yaml b/.github/workflows/internal--helmfile-hydrator.yaml
similarity index 99%
rename from .github/workflows/reusable--kubernetes-hydrator.yaml
rename to .github/workflows/internal--helmfile-hydrator.yaml
index 537adbf..68820bc 100644
--- a/.github/workflows/reusable--kubernetes-hydrator.yaml
+++ b/.github/workflows/internal--helmfile-hydrator.yaml
@@ -1,5 +1,5 @@
 # Renders the given components into kubernetes/manifests and commits the result to the pull request branch.
-name: 'Reusable - Kubernetes Hydrator'
+name: 'Internal - Helmfile Hydrator'
 
 on:
   workflow_call:
diff --git a/.github/workflows/reusable--container-builder.yaml b/.github/workflows/internal--image-builder.yaml
similarity index 99%
rename from .github/workflows/reusable--container-builder.yaml
rename to .github/workflows/internal--image-builder.yaml
index 3b5be97..3d7cd57 100644
--- a/.github/workflows/reusable--container-builder.yaml
+++ b/.github/workflows/internal--image-builder.yaml
@@ -1,5 +1,5 @@
 # Builds the container image of one service and pushes it to ghcr.io.
-name: Reusable Container Builder
+name: 'Internal - Image Builder'
 
 on:
   workflow_call:
diff --git a/.github/workflows/reusable--kubernetes-builder.yaml b/.github/workflows/internal--kustomize-diff.yaml
similarity index 99%
rename from .github/workflows/reusable--kubernetes-builder.yaml
rename to .github/workflows/internal--kustomize-diff.yaml
index b0a4717..10b047e 100644
--- a/.github/workflows/reusable--kubernetes-builder.yaml
+++ b/.github/workflows/internal--kustomize-diff.yaml
@@ -1,5 +1,5 @@
 # Posts the kustomize diff of one kustomization directory as a pull request comment.
-name: 'Reusable - Kubernetes Builder'
+name: 'Internal - Kustomize Diff'
 
 on:
   workflow_call:
diff --git a/.github/workflows/reusable--label-base-deploy--resolver.yaml b/.github/workflows/reusable--label-base-deploy--resolver.yaml
index 4a2a98d..c45ade4 100644
--- a/.github/workflows/reusable--label-base-deploy--resolver.yaml
+++ b/.github/workflows/reusable--label-base-deploy--resolver.yaml
@@ -100,7 +100,7 @@ jobs:
     concurrency:
       group: image-build-${{ matrix.target.stack_id }}-${{ matrix.target.service }}-${{ github.sha }}
       cancel-in-progress: false
-    uses: $/.github/workflows/reusable--container-builder.yaml
+    uses: $/.github/workflows/internal--image-builder.yaml
     with:
       image-name: ${{ matrix.target.stack == 'container' && matrix.target.service || '' }}
       working-directory: ${{ matrix.target.working_directory }}
@@ -119,7 +119,7 @@ jobs:
       matrix:
         target: ${{ fromJson(needs.resolve.outputs.targets) }}
       fail-fast: false
-    uses: $/.github/workflows/reusable--kubernetes-builder.yaml
+    uses: $/.github/workflows/internal--kustomize-diff.yaml
     with:
       service-name: ${{ matrix.target.service }}
       environment: ${{ matrix.target.environment }}
@@ -158,7 +158,7 @@ jobs:
       matrix:
         env: ${{ fromJson(needs.helmfile-targets-group.outputs.environments) }}
       fail-fast: false
-    uses: $/.github/workflows/reusable--kubernetes-hydrator.yaml
+    uses: $/.github/workflows/internal--helmfile-hydrator.yaml
     with:
       environment: ${{ matrix.env.environment }}
       services: ${{ toJson(matrix.env.services) }}
@@ -177,7 +177,7 @@ jobs:
       matrix:
         target: ${{ fromJson(needs.resolve.outputs.targets) }}
       fail-fast: false
-    uses: $/.github/workflows/reusable--kubernetes-builder.yaml
+    uses: $/.github/workflows/internal--kustomize-diff.yaml
     with:
       service-name: ${{ matrix.target.service }}
       environment: ${{ matrix.target.environment }}
diff --git a/.github/workflows/reusable--release--build.yaml b/.github/workflows/reusable--release--build.yaml
index ed05bff..9e1940a 100644
--- a/.github/workflows/reusable--release--build.yaml
+++ b/.github/workflows/reusable--release--build.yaml
@@ -60,7 +60,7 @@ jobs:
     concurrency:
       group: image-build-${{ needs.detect-component.outputs.service }}-${{ github.sha }}
       cancel-in-progress: false
-    uses: $/.github/workflows/reusable--container-builder.yaml
+    uses: $/.github/workflows/internal--image-builder.yaml
     with:
       image-name: ${{ needs.detect-component.outputs.service }}
       working-directory: ${{ needs.detect-component.outputs.working-directory }}
diff --git a/README.md b/README.md
index faab4f3..5dea5e2 100644
--- a/README.md
+++ b/README.md
@@ -12,6 +12,7 @@ panicboat アカウントのリポジトリで共有する GitHub の設定を
 `.github/workflows/reusable--*.yaml` は、panicboat の他のリポジトリから呼び出す共通の workflow。
 呼び出し側は `uses: panicboat/.github/.github/workflows/<file>@<sha> # vX.Y.Z` と書いて、release の commit SHA に固定する。
 固定した SHA は Renovate が更新する。
+`.github/workflows/internal--*.yaml` は、共通の workflow の中からだけ呼ぶ workflow で、他のリポジトリからは呼ばない。
 
 ```yaml
 jobs:
diff --git a/scripts/workflows/test.sh b/scripts/workflows/test.sh
index 09467cf..a2d9f4c 100755
--- a/scripts/workflows/test.sh
+++ b/scripts/workflows/test.sh
@@ -33,12 +33,12 @@ test_release_deploy_declares_environment() {
     assert_eq '${{ needs.resolve.outputs.tag }}' "$(yq '.jobs.apply.with.ref' "${workflow}")"
 }
 
-test_kubernetes_builder_checks_out_head_ref_only_for_helmfile() {
+test_kustomize_diff_checks_out_head_ref_only_for_helmfile() {
     local resolver="${workflows_dir}/reusable--label-base-deploy--resolver.yaml"
-    local builder="${workflows_dir}/reusable--kubernetes-builder.yaml"
+    local kustomize_diff="${workflows_dir}/internal--kustomize-diff.yaml"
     assert_eq '${{ github.head_ref }}' "$(yq '.jobs["deploy-helmfile"].with.ref' "${resolver}")"
     assert_eq 'null' "$(yq '.jobs["deploy-kustomize"].with.ref' "${resolver}")"
-    assert_eq '${{ inputs.ref }}' "$(yq '.jobs["kustomize-diff"].steps[] | select(.name == "Checkout") | .with.ref' "${builder}")"
+    assert_eq '${{ inputs.ref }}' "$(yq '.jobs["kustomize-diff"].steps[] | select(.name == "Checkout") | .with.ref' "${kustomize_diff}")"
 }
 
 test_nested_test_workflow_uses_dollar_slash() {
@@ -46,6 +46,13 @@ test_nested_test_workflow_uses_dollar_slash() {
     assert_eq '$/.github/workflows/test-shared-workflows--checkout.yaml' "$(yq '.jobs[].uses' "${workflow}")"
 }
 
+test_nested_calls_resolve_to_existing_workflows() {
+    local target
+    for target in $(yq -N '.jobs[].uses | select(. != null and test("^\\$/"))' "${workflows_dir}"/*.y*ml); do
+        [ -f "${repo_root}/${target#\$/}" ] || { echo "  missing: ${target}" >&2; exit 1; }
+    done
+}
+
 failed=0
 for test_name in $(compgen -A function test_); do
     set +e

From af05aa3105194cffb75e5e62103e6fc8deb50198 Mon Sep 17 00:00:00 2001
From: panicboat <panicboat@gmail.com>
Date: Sun, 25 Oct 2026 11:43:28 +0900
Subject: [PATCH 2/2] refactor: name the internal kustomize workflow after the
 build it runs

Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7
Signed-off-by: panicboat <panicboat@gmail.com>
---
 ...kustomize-diff.yaml => internal--kustomize-builder.yaml} | 2 +-
 .../workflows/reusable--label-base-deploy--resolver.yaml    | 4 ++--
 scripts/workflows/test.sh                                   | 6 +++---
 3 files changed, 6 insertions(+), 6 deletions(-)
 rename .github/workflows/{internal--kustomize-diff.yaml => internal--kustomize-builder.yaml} (99%)

diff --git a/.github/workflows/internal--kustomize-diff.yaml b/.github/workflows/internal--kustomize-builder.yaml
similarity index 99%
rename from .github/workflows/internal--kustomize-diff.yaml
rename to .github/workflows/internal--kustomize-builder.yaml
index 10b047e..8831087 100644
--- a/.github/workflows/internal--kustomize-diff.yaml
+++ b/.github/workflows/internal--kustomize-builder.yaml
@@ -1,5 +1,5 @@
 # Posts the kustomize diff of one kustomization directory as a pull request comment.
-name: 'Internal - Kustomize Diff'
+name: 'Internal - Kustomize Builder'
 
 on:
   workflow_call:
diff --git a/.github/workflows/reusable--label-base-deploy--resolver.yaml b/.github/workflows/reusable--label-base-deploy--resolver.yaml
index c45ade4..a0a0690 100644
--- a/.github/workflows/reusable--label-base-deploy--resolver.yaml
+++ b/.github/workflows/reusable--label-base-deploy--resolver.yaml
@@ -119,7 +119,7 @@ jobs:
       matrix:
         target: ${{ fromJson(needs.resolve.outputs.targets) }}
       fail-fast: false
-    uses: $/.github/workflows/internal--kustomize-diff.yaml
+    uses: $/.github/workflows/internal--kustomize-builder.yaml
     with:
       service-name: ${{ matrix.target.service }}
       environment: ${{ matrix.target.environment }}
@@ -177,7 +177,7 @@ jobs:
       matrix:
         target: ${{ fromJson(needs.resolve.outputs.targets) }}
       fail-fast: false
-    uses: $/.github/workflows/internal--kustomize-diff.yaml
+    uses: $/.github/workflows/internal--kustomize-builder.yaml
     with:
       service-name: ${{ matrix.target.service }}
       environment: ${{ matrix.target.environment }}
diff --git a/scripts/workflows/test.sh b/scripts/workflows/test.sh
index a2d9f4c..5473209 100755
--- a/scripts/workflows/test.sh
+++ b/scripts/workflows/test.sh
@@ -33,12 +33,12 @@ test_release_deploy_declares_environment() {
     assert_eq '${{ needs.resolve.outputs.tag }}' "$(yq '.jobs.apply.with.ref' "${workflow}")"
 }
 
-test_kustomize_diff_checks_out_head_ref_only_for_helmfile() {
+test_kustomize_builder_checks_out_head_ref_only_for_helmfile() {
     local resolver="${workflows_dir}/reusable--label-base-deploy--resolver.yaml"
-    local kustomize_diff="${workflows_dir}/internal--kustomize-diff.yaml"
+    local kustomize_builder="${workflows_dir}/internal--kustomize-builder.yaml"
     assert_eq '${{ github.head_ref }}' "$(yq '.jobs["deploy-helmfile"].with.ref' "${resolver}")"
     assert_eq 'null' "$(yq '.jobs["deploy-kustomize"].with.ref' "${resolver}")"
-    assert_eq '${{ inputs.ref }}' "$(yq '.jobs["kustomize-diff"].steps[] | select(.name == "Checkout") | .with.ref' "${kustomize_diff}")"
+    assert_eq '${{ inputs.ref }}' "$(yq '.jobs["kustomize-diff"].steps[] | select(.name == "Checkout") | .with.ref' "${kustomize_builder}")"
 }
 
 test_nested_test_workflow_uses_dollar_slash() {