ci: build on the shared ci-workflows node.yaml, remove GitHub workflows #13

2026-11-07T22:15:59Z

james.maes commented

2026-11-07 22:15:59 +00:00

Moves qqq-print-protocol CI onto the shared Gitea workflow KofTwentyTwo/ci-workflows node.yaml (Node 24, pinned sha256-verified uv 0.13.6, verify only), replacing the retired GitHub Actions.

Commands (after npm ci --ignore-scripts), translated from the old .github/workflows/ci.yml verify job:

uv sync --locked
uv run --locked --no-sync python .github/scripts/test-script-quality.py
uv run --locked --no-sync python .github/scripts/check-script-quality.py
uv run --locked --no-sync python .github/scripts/test-source-headers.py
uv run --locked --no-sync python .github/scripts/check-source-headers.py
npm run typecheck
npm run lint
npm run check
npm run bundle

(The source-header scripts now run under uv run with the locked Python 3.13 instead of the image's python3.)

Removed: .github/workflows/ci.yml, codeql.yml, codeql-analysis.yml, pr-gates.yml, security.yml (GitHub-only), plus the CodeQL-only scripts .github/scripts/check-codeql-sarif.py and test-scan-gates.py that only the CodeQL workflow ran.

Changed: the EX-0015 uri-js guard in check-script-quality.py keeps its pins (single dev-only locked copy, version, lock integrity, installed LICENSE bytes); only its check of the pr-gates.yml allow-dependencies-licenses entry is removed, together with that file and its test. .gitea/*.yaml is added to the source-header scope (the new workflow carries the notice). CONTRIBUTING.md is updated.

Kept: .github/scripts (the remaining quality/header scripts), .github/source-headers.json, .github/pyrightconfig.json, .github/CODEOWNERS, .github/dependabot.yml (GitHub-only, inert on Gitea).

Not ported (owner decision): tag releases (bundle + SHA256SUMS release assets, attestation), CodeQL and the security / PR-gates (DCO, conventional title, dependency/license review) scans.

CI: run 61 on 57670e9 (pinned to @main) was green; every command above passed. The final commit pins @v1; v1 does not contain node.yaml yet, so that run cannot resolve the workflow until the owner moves the v1 tag. Merged after the green @main run, as planned.

🤖 Generated with Claude Code

Moves qqq-print-protocol CI onto the shared Gitea workflow `KofTwentyTwo/ci-workflows` `node.yaml` (Node 24, pinned sha256-verified uv 0.13.6, verify only), replacing the retired GitHub Actions. **Commands** (after `npm ci --ignore-scripts`), translated from the old `.github/workflows/ci.yml` verify job: ``` uv sync --locked uv run --locked --no-sync python .github/scripts/test-script-quality.py uv run --locked --no-sync python .github/scripts/check-script-quality.py uv run --locked --no-sync python .github/scripts/test-source-headers.py uv run --locked --no-sync python .github/scripts/check-source-headers.py npm run typecheck npm run lint npm run check npm run bundle ``` (The source-header scripts now run under `uv run` with the locked Python 3.13 instead of the image's `python3`.) **Removed:** `.github/workflows/ci.yml`, `codeql.yml`, `codeql-analysis.yml`, `pr-gates.yml`, `security.yml` (GitHub-only), plus the CodeQL-only scripts `.github/scripts/check-codeql-sarif.py` and `test-scan-gates.py` that only the CodeQL workflow ran. **Changed:** the EX-0015 `uri-js` guard in `check-script-quality.py` keeps its pins (single dev-only locked copy, version, lock integrity, installed LICENSE bytes); only its check of the `pr-gates.yml` `allow-dependencies-licenses` entry is removed, together with that file and its test. `.gitea/*.yaml` is added to the source-header scope (the new workflow carries the notice). CONTRIBUTING.md is updated. **Kept:** `.github/scripts` (the remaining quality/header scripts), `.github/source-headers.json`, `.github/pyrightconfig.json`, `.github/CODEOWNERS`, `.github/dependabot.yml` (GitHub-only, inert on Gitea). **Not ported (owner decision):** tag releases (bundle + SHA256SUMS release assets, attestation), CodeQL and the security / PR-gates (DCO, conventional title, dependency/license review) scans. **CI:** run 61 on 57670e9 (pinned to `@main`) was green; every command above passed. The final commit pins `@v1`; `v1` does not contain node.yaml yet, so that run cannot resolve the workflow until the owner moves the `v1` tag. Merged after the green `@main` run, as planned. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james.maes added 2 commits 2026-11-07 22:15:59 +00:00

ci: build on the shared ci-workflows node.yaml, remove GitHub workflows

node / node (push) Successful in 1m13s

Details

build / node (push) Successful in 1m13s

Details

57670e9891

Gitea CI runs the uv script-quality and source-header checks, typecheck,
lint, check and bundle through KofTwentyTwo/ci-workflows node.yaml (Node 24,
pinned uv). Removes the retired GitHub Actions workflows (ci, codeql,
codeql-analysis, pr-gates, security) and the CodeQL-only scripts. The EX-0015
uri-js guard keeps its lock/integrity/license pins; its check of the
pr-gates.yml allowlist entry goes with that file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci: pin ci-workflows node.yaml to @v1 177db4b06b

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

james.maes merged commit eee42e951d into main

2026-11-07 22:16:01 +00:00

james.maes deleted branch ci/ci-workflows

2026-11-07 22:16:01 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qqq-print-protocol#13