ci: call the shared workflows from panicboat/.github

.github/renovate.json

@@ -1,70 +1,4 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended",
-    ":semanticCommits",
-    ":separateMajorReleases",
-    "group:monorepos",
-    "group:recommended",
-    "helpers:pinGitHubActionDigests"
-  ],
-  "semanticCommitScope": "{{packageFileDir}}",
-  "timezone": "Asia/Tokyo",
-  "labels": [
-    "🤖 renovate"
-  ],
-  "assigneesFromCodeOwners": false,
-  "reviewersFromCodeOwners": true,
-  "automergeType": "pr",
-  "automergeStrategy": "squash",
-  "platformAutomerge": true,
-  "prConcurrentLimit": 15,
-  "prHourlyLimit": 5,
-  "branchPrefix": "renovate/",
-  "rangeStrategy": "bump",
-  "schedule": [
-    "before 4am every weekday"
-  ],
-  "minimumReleaseAge": "1 day",
-  "separateMinorPatch": false,
-  "packageRules": [
-    {
-      "description": "Default: separate PRs per package",
-      "groupName": "{{packageFileDir}}/{{depName}}",
-      "matchPackageNames": [
-        "*"
-      ]
-    },
-    {
-      "description": "🚫 Production environments - disable automerge",
-      "matchFileNames": [
-        "**/production/**"
-      ],
-      "automerge": false,
-      "prPriority": -1,
-      "addLabels": [
-        "⚠️ production"
-      ]
-    },
-    {
-      "description": "🚫 Major updates - disable automerge",
-      "matchUpdateTypes": [
-        "major"
-      ],
-      "automerge": false,
-      "addLabels": [
-        "📈 major-update"
-      ]
-    },
-    {
-      "description": "✅ Minor/Patch updates - enable automerge",
-      "matchUpdateTypes": [
-        "minor",
-        "patch",
-        "pin",
-        "digest"
-      ],
-      "automerge": true
-    }
-  ]
+  "extends": ["github>panicboat/.github"]
 }

.github/workflows/lint-actions.yml

@@ -1,17 +1,13 @@
+# Checks that every action is pinned to a full commit SHA.
 name: Lint GitHub Actions
 
 on:
   push:
     branches: [main]
   pull_request:
 
-permissions:
-  contents: read
-
 jobs:
   ensure-sha-pinned:
-    name: Ensure actions are pinned to SHAs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: zgosalvez/github-actions-ensure-sha-pinned-actions@c4e71056006d29f90204b2d063be337109507d62 # v5.0.10
+    permissions:
+      contents: read
+    uses: panicboat/.github/.github/workflows/reusable--lint-actions.yaml@d54532665675f1843914da4b324dc2a58dd37239 # v1.0.0

.github/workflows/semantic-pull-request.yml

@@ -1,24 +1,16 @@
+# Validates that the pull request title follows Conventional Commits.
 name: Semantic Pull Request
 
 on:
   pull_request_target:
     types: [opened, edited, synchronize, reopened]
 
-permissions:
-  contents: read
-
 jobs:
   validate:
-    name: Validate PR title
-    runs-on: ubuntu-latest
-    steps:
-      - name: Generate GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        with:
-          app-id: ${{ vars.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
-      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+    permissions:
+      contents: read
+    uses: panicboat/.github/.github/workflows/reusable--semantic-pull-request.yaml@d54532665675f1843914da4b324dc2a58dd37239 # v1.0.0
+    with:
+      app-id: ${{ vars.APP_ID }}
+    secrets:
+      private-key: ${{ secrets.APP_PRIVATE_KEY }}