v1.2.2 — shellcheck hardening: preinstalled binary + job timeout

Patch release. The shellcheck reusable now uses the runner's preinstalled ShellCheck with a guarded apt fallback (a stalled apt mirror was silently wedging required checks for 20+ minutes — three times on 2026-08-19; #53), and carries a 5-minute job timeout backstop. Internal composite-action refs bumped to v1.2.2 per RELEASING.md. No input or contract changes.

v1.2.1 — Dependabot action bumps inside the reusables

Patch release per the semver policy (SHA-pinned third-party action updates, no caller-facing interface changes): checkout v7.0.1, setup-node v7.0.0, upload-artifact v7.0.1, aws-actions/configure-aws-credentials v6.2.3, codeql-action/upload-sarif v4.37.7 across the reusable workflows (#49).

Checkout/setup-node v7 are already proven green across the fleet's own workflows tonight. The deploy-path bump (configure-aws-credentials v4→v6 inside site-deploy.yml) is exercised only by a real deploy: the first consumer that bumps to v1.2.1 should watch its post-merge deploy run — the same acceptance pattern the v1.1.x rollout used.

v1.2.0 — Terraform lint reusable (tf-lint.yml)

New

tf-lint.yml — reusable Terraform lint gate for the five fleet repos carrying Terraform (solidago, kalmia, claytonia, drosera, .github). Four independently toggleable gates:

1. terraform fmt -check -recursive
2. terraform init -backend=false + terraform validate (credential-free by design — safe on fork PRs)
3. tflint --recursive
4. trivy config (HIGH/CRITICAL IaC misconfigurations; Trivy over Checkov for one-tool fleet consistency with site-deploy.yml)

All inputs optional with defaults (working_directory: terraform, versions latest, all gates on). All third-party actions SHA-pinned. Header carries the required-check rule: no paths: filter on callers that intend to make this required.

Validated per RELEASING.md against a real caller before this tag: kalmia run 32063875705 — all four gates executed and passed against live Terraform.

Semver rationale

Minor: new workflow file, no changes to any existing workflow's caller-facing interface. Existing v1.1.1 callers are unaffected.

Closes the release phase of #41 (R18). Refs: #50.

v1.1.1 — site-deploy concurrency fix

Fixed

site-deploy.yml no longer declares job-level concurrency. v1.1.0's job hardcoded concurrency: { group: deploy-main }, which deadlocked against any caller holding its own workflow-level group — the caller takes the lock, the called job waits on the same name, GitHub cancels the pair. Proven on the first live invocation (site-lentago-dev run 32057853117). Serialization policy belongs to the caller; all three site repos already carry a workflow-level deploy-main group, which now stands alone.

No interface changes — inputs, permissions and behavior are otherwise identical to v1.1.0. Patch release per RELEASING.md semver policy.

Callers

uses: lentago/shared-workflows/.github/workflows/site-deploy.yml@v1.1.1

v1.1.0 should not be consumed by any caller that sets workflow-level concurrency — which is all of them. Migrate straight to v1.1.1.

v1.1.0 — site-deploy reusable

What's new

site-deploy.yml — the site deploy pipeline, extracted (#38, #47). The three site repos ran near-identical deploy.yml files: build the Astro site, docker build, push to ECR (sha + latest), roll the ECS service, wait for it to stabilize. That pipeline now lives here once, parameterized on what actually differs (ECR repo, cluster, service, region, role ARN, node version, and an optional pre_build_command for the sites that need a content sync or emit two skins).

Two things folded in while centralizing, because doing them once here is cheap and doing them three times was not:

• Image scanning on the built image before it rolls.
• Build-provenance attestation (actions/attest-build-provenance), controllable by input. Building inside a reusable workflow is what qualifies the result for SLSA Build L3 rather than L2 — the reason the attestation belongs here and not in each caller.

Callers must grant id-token: write, attestations: write and packages: read; the README documents the wiring.

Also included: this repo's own OpenSSF Scorecard workflow and badge (#43), and a grouped Dependabot config that separates routine (minor/patch) from major bumps.

Callers

uses: lentago/shared-workflows/.github/workflows/site-deploy.yml@v1.1.0

Bump uses: refs from @v1.0.0 to @v1.1.0. Dependabot opens these as PRs automatically now that the fleet-wide rollout has landed in every active repo.

Release process note

This tag was cut from a commit that first bumped the repo's internal self-references (the reusables call this repo's own composite action by its full external form, since ./ inside a reusable resolves against the caller). Tagging without that bump would have shipped a release whose workflows still ran v1.0.0's action — see RELEASING.md step 2.

v1.0.0 — first stable release

First tagged release of the fleet's reusable workflows, cut from main at the point where every third-party action inside them is SHA-pinned (#42) and the repo carries its own Scorecard posture (#43).

Why this exists. All 16 Lentago Labs repos consumed these workflows at @main, which meant any merge here changed CI for the entire fleet instantly — an undocumented single point of trust. Resolving that was tracked in #40; the decision is to version.

Contents at v1.0.0

• docs-check.yml — relative-markdown-link checking, unconditional by design so it can safely be a required check
• claude-review.yml — advisory automated PR review, soft-fail so a transient API failure never blocks a merge
• claude-responder.yml — interactive @claude responder, routed by label
• shellcheck.yml — shell linting
• .github/actions/render-claude-summary — composite action

Consuming this release. Reference the immutable tag rather than a branch:

uses: lentago/shared-workflows/.github/workflows/docs-check.yml@v1.0.0

Callers pinned to an immutable tag change only when someone opens a PR to bump them — which is the point. Dependabot's github-actions ecosystem updates reusable-workflow references, so bumps arrive as reviewable PRs once the fleet-wide Dependabot rollout (lentago/.github#114) reaches each repo.

Compatibility. @main keeps working and is unchanged; migration of the 50 caller references is staged per repo.