[albertodonato]

what

Add a run-script reusable workflow, encapsulating common set up for a mise-based repository where the workflow ends up running one or more commands (e.g lint, test, ...)
This includes

• optional runner hardening via step-security (if the env var is passed)
• optional pre-commit cache save/restore
• optional passing github token (needed for zizmor checks)
• mise and tools installation

why

Reduce repeated setup in many github actions

testing

docs

udpated here

[cubic-dev-ai]

All reported issues were addressed across 3 files

Architecture diagram

sequenceDiagram
    participant Caller as Calling Workflow
    participant WS as run-script Workflow
    participant GH as GitHub Actions Runner
    participant Cache as Actions Cache
    participant Mise as mise-action
    participant SS as Step Security Harden Runner

    Note over Caller,SS: Reusable workflow orchestration for lint/test jobs

    Caller->>WS: workflow_call (inputs: run, pre-commit-cache, github-token, full-git-history)
    Caller->>WS: secrets: STEP_SECURITY_API_KEY (optional)
    WS->>WS: Set env: HARDEN_RUNNER = (secret present)

    alt HARDEN_RUNNER == true
        WS->>SS: Harden Runner (policy store + API key)
        SS-->>WS: Runner hardened
    end

    WS->>GH: Checkout repo (persist-credentials: false)
    GH->>GH: Fetch depth = full-git-history ? 0 : 1

    WS->>Mise: Install tools (mise-action with cache)
    Mise-->>WS: Tools available in PATH

    opt pre-commit-cache == true
        WS->>Cache: Restore cache (key: pre-commit-os-hash)
        Cache-->>WS: Cache hit or miss
        WS->>WS: Set PREK_HOME to cache path
    end

    WS->>GH: Run caller-provided script
    Note over WS,GH: GH_TOKEN exposed only when github-token input is true

    opt pre-commit-cache == true AND event_name != pull_request AND cache was missed
        WS->>Cache: Save cache (primary key)
        Cache-->>WS: Cache saved (restore-only on PRs)
    end

    WS-->>Caller: Job status (success/failure)

Loading

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Confidence score: 4/5

• If branch protection requires the old check names, the renames in .github/workflows/ci.yml can leave required checks pending and block merges. Update the required check names alongside the job IDs.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/ci.yml">

<violation number="1" location=".github/workflows/ci.yml:14">
P2: Renaming these job IDs changes the status check names (`lint / run` becomes `Lint / run`, `test` becomes `Tests`). Any branch protection or ruleset that requires the old names will wait forever for checks that no longer run. Confirm the required-check list is updated in the same change, or keep the existing job IDs.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Renaming these job IDs changes the status check names (lint / run becomes Lint / run, test becomes Tests). Any branch protection or ruleset that requires the old names will wait forever for checks that no longer run. Confirm the required-check list is updated in the same change, or keep the existing job IDs.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/ci.yml, line 14:

<comment>Renaming these job IDs changes the status check names (`lint / run` becomes `Lint / run`, `test` becomes `Tests`). Any branch protection or ruleset that requires the old names will wait forever for checks that no longer run. Confirm the required-check list is updated in the same change, or keep the existing job IDs.</comment>

<file context>
@@ -11,7 +11,7 @@ on:
 
 jobs:
-  lint:
+  Lint:
     permissions:
       contents: read
</file context>

[albertodonato]

that's handled in https://github.com/stacklet/cloud-infra/pull/1323

[johnsca]

LGTM, one minor, non-blocking suggestion below.