refactor(ci): flatten workflow directory structure to top-level naming

.github/workflows/ci.yml

@@ -35,7 +35,7 @@ jobs:
         run: pip install yamllint
 
       - name: actionlint
-        run: actionlint .github/workflows/**/*.yml .github/workflows/*.yml
+        run: actionlint .github/workflows/*.yml
 
       - name: zizmor
         run: zizmor --format sarif .github/workflows/ > zizmor.sarif || true
@@ -46,7 +46,7 @@ jobs:
             .github/workflows/
 
   test-check-release:
-    name: Test — common/check-release
+    name: Test — common-check-release
     needs: lint
     runs-on: ubuntu-latest
     strategy:
@@ -107,7 +107,7 @@ jobs:
           REF="${{ steps.fixture.outputs.github_ref }}"
           REF_NAME=$(echo "$REF" | sed 's|refs/tags/||;s|refs/heads/||')
           act workflow_call \
-            -W .github/workflows/common/check-release.yml \
+            -W .github/workflows/common-check-release.yml \
             --eventpath /tmp/event.json \
             --env "GITHUB_REF=$REF" \
             --env "GITHUB_REF_NAME=$REF_NAME" \

.github/workflows/build-docs.yml → .github/workflows/common-build-docs.yml

@@ -7,6 +7,9 @@ on:
         type: string
         default: "fatal"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/check-semantic-pr.yml → .github/workflows/common-check-semantic-pr.yml

@@ -2,6 +2,9 @@ name: Check Semantic PR
 on:
   workflow_call:
 
+permissions:
+  pull-requests: read
+
 jobs:
   semantic-pr:
     name: Validate PR title

tests/common/check-release.yml

@@ -1,24 +1,24 @@
-name: Test — common/check-release
+name: Test — common-check-release
 
 on:
   workflow_call:
 
-# Happy-path tests for .github/workflows/common/check-release.yml.
+# Happy-path tests for .github/workflows/common-check-release.yml.
 # Failure-path tests (invalid tag, wrong branch, not-a-tag) are exercised by
 # ci.yml via act with event fixtures in tests/common/check-release/*.json.
 
 jobs:
   valid-semver:
-    uses: ./.github/workflows/common/check-release.yml
+    uses: ./.github/workflows/common-check-release.yml
     with:
       version-format: semver
 
   valid-pep440:
-    uses: ./.github/workflows/common/check-release.yml
+    uses: ./.github/workflows/common-check-release.yml
     with:
       version-format: pep440
 
   valid-maven:
-    uses: ./.github/workflows/common/check-release.yml
+    uses: ./.github/workflows/common-check-release.yml
     with:
       version-format: maven

tests/common/publish-to-docker.yml

@@ -1,15 +1,15 @@
-name: Test — common/publish-to-docker
+name: Test — common-publish-to-docker
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/common/publish-to-docker.yml
+# Tests for .github/workflows/common-publish-to-docker.yml
 # Uses dry-run mode: builds the image but does not push.
 # Requires tests/_resources/fake-docker-context/Dockerfile.
 
 jobs:
   dry-run:
-    uses: ./.github/workflows/common/publish-to-docker.yml
+    uses: ./.github/workflows/common-publish-to-docker.yml
     with:
       version: "1.0.0"
       image-name: "reqstool-org/test-image"

tests/common/publish-to-github-pages.yml

@@ -1,15 +1,15 @@
-name: Test — common/publish-to-github-pages
+name: Test — common-publish-to-github-pages
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/common/publish-to-github-pages.yml
+# Tests for .github/workflows/common-publish-to-github-pages.yml
 # Requires docs/antora-playbook.yml and a configured GitHub Pages environment.
 # Validated by actionlint only in ci.yml (no act execution — requires Pages environment).
 
 jobs:
   publish:
-    uses: ./.github/workflows/common/publish-to-github-pages.yml
+    uses: ./.github/workflows/common-publish-to-github-pages.yml
     permissions:
       contents: read
       pages: write

tests/common/release-preview.yml

@@ -1,14 +1,14 @@
-name: Test — common/release-preview
+name: Test — common-release-preview
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/common/release-preview.yml
+# Tests for .github/workflows/common-release-preview.yml
 # The workflow is read-only, so we just confirm it completes successfully.
 
 jobs:
   preview:
-    uses: ./.github/workflows/common/release-preview.yml
+    uses: ./.github/workflows/common-release-preview.yml
     with:
       version-command: ""
     permissions:

tests/common/release.yml

@@ -1,15 +1,15 @@
-name: Test — common/release
+name: Test — common-release
 
 on:
   workflow_call:
 
-# Dry-run tests for .github/workflows/common/release.yml.
+# Dry-run tests for .github/workflows/common-release.yml.
 # No tag is pushed and no draft release is created.
 # Failure-path tests (invalid version format) are exercised by ci.yml via act.
 
 jobs:
   dry-run-semver:
-    uses: ./.github/workflows/common/release.yml
+    uses: ./.github/workflows/common-release.yml
     with:
       version: "1.2.3"
       version-format: semver
@@ -18,7 +18,7 @@ jobs:
       contents: write
 
   dry-run-pep440:
-    uses: ./.github/workflows/common/release.yml
+    uses: ./.github/workflows/common-release.yml
     with:
       version: "1.2.3rc1"
       version-format: pep440
@@ -27,7 +27,7 @@ jobs:
       contents: write
 
   dry-run-maven:
-    uses: ./.github/workflows/common/release.yml
+    uses: ./.github/workflows/common-release.yml
     with:
       version: "1.2.3"
       version-format: maven

tests/java/build-gradle.yml

@@ -1,13 +1,13 @@
-name: Test — java/build-gradle
+name: Test — java-build-gradle
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/java/build-gradle.yml
+# Tests for .github/workflows/java-build-gradle.yml
 # Requires build.gradle — validated by actionlint only in ci.yml (no act execution).
 
 jobs:
   build:
-    uses: ./.github/workflows/java/build-gradle.yml
+    uses: ./.github/workflows/java-build-gradle.yml
     with:
       java-version: "21"

tests/java/build-maven.yml

@@ -1,13 +1,13 @@
-name: Test — java/build-maven
+name: Test — java-build-maven
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/java/build-maven.yml
+# Tests for .github/workflows/java-build-maven.yml
 # Requires a pom.xml — validated by actionlint only in ci.yml (no act execution).
 
 jobs:
   build:
-    uses: ./.github/workflows/java/build-maven.yml
+    uses: ./.github/workflows/java-build-maven.yml
     with:
       java-version: "21"

tests/java/lint.yml

@@ -1,14 +1,14 @@
-name: Test — java/lint
+name: Test — java-lint
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/java/lint.yml
+# Tests for .github/workflows/java-lint.yml
 # Requires a pom.xml in the calling repo — exercised via act in repos that have one.
 # In ci.yml this test is validated by actionlint only (no act execution).
 
 jobs:
   lint:
-    uses: ./.github/workflows/java/lint.yml
+    uses: ./.github/workflows/java-lint.yml
     with:
       java-version: "21"

tests/java/publish-to-gradle.yml

@@ -1,21 +1,21 @@
-name: Test — java/publish-to-gradle
+name: Test — java-publish-to-gradle
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/java/publish-to-gradle.yml
+# Tests for .github/workflows/java-publish-to-gradle.yml
 # Dry-run executes ./gradlew build -x test (no publish task, no credentials).
 # Requires a build.gradle / build.gradle.kts in the calling repo.
 
 jobs:
   dry-run-portal:
-    uses: ./.github/workflows/java/publish-to-gradle.yml
+    uses: ./.github/workflows/java-publish-to-gradle.yml
     with:
       target: portal
       dry-run: true
 
   dry-run-central:
-    uses: ./.github/workflows/java/publish-to-gradle.yml
+    uses: ./.github/workflows/java-publish-to-gradle.yml
     with:
       target: central
       dry-run: true

tests/java/publish-to-maven.yml

@@ -1,16 +1,16 @@
-name: Test — java/publish-to-maven
+name: Test — java-publish-to-maven
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/java/publish-to-maven.yml
+# Tests for .github/workflows/java-publish-to-maven.yml
 # Dry-run executes mvn package -DskipTests (no deploy, no GPG, no credentials).
 # Requires a pom.xml in the calling repo — callers that invoke this test
 # must have a Maven project at the repo root.
 
 jobs:
   dry-run:
-    uses: ./.github/workflows/java/publish-to-maven.yml
+    uses: ./.github/workflows/java-publish-to-maven.yml
     with:
       dry-run: true
     permissions:

tests/python/build-hatch.yml

@@ -1,13 +1,13 @@
-name: Test — python/build-hatch
+name: Test — python-build-hatch
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/python/build-hatch.yml
+# Tests for .github/workflows/python-build-hatch.yml
 # Requires pyproject.toml + src/ — validated by actionlint only in ci.yml.
 
 jobs:
   build:
-    uses: ./.github/workflows/python/build-hatch.yml
+    uses: ./.github/workflows/python-build-hatch.yml
     with:
       coverage-source: ""

tests/python/build-poetry.yml

@@ -1,14 +1,14 @@
-name: Test — python/build-poetry
+name: Test — python-build-poetry
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/python/build-poetry.yml
+# Tests for .github/workflows/python-build-poetry.yml
 # Requires pyproject.toml configured for Poetry — validated by actionlint only in ci.yml.
 
 jobs:
   build:
-    uses: ./.github/workflows/python/build-poetry.yml
+    uses: ./.github/workflows/python-build-poetry.yml
     with:
       coverage-source: ""
       install-self-as-plugin: false

tests/python/lint.yml

@@ -1,18 +1,18 @@
-name: Test — python/lint
+name: Test — python-lint
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/python/lint.yml
+# Tests for .github/workflows/python-lint.yml
 # Requires src/ and tests/ directories with Python source — validated by actionlint only.
 
 jobs:
   lint-hatch:
-    uses: ./.github/workflows/python/lint.yml
+    uses: ./.github/workflows/python-lint.yml
     with:
       package-manager: hatch
 
   lint-poetry:
-    uses: ./.github/workflows/python/lint.yml
+    uses: ./.github/workflows/python-lint.yml
     with:
       package-manager: poetry

tests/python/publish-to-python-test.yml

@@ -1,14 +1,14 @@
-name: Test — python/publish-to-python-test
+name: Test — python-publish-to-python-test
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/python/publish-to-python-test.yml
+# Tests for .github/workflows/python-publish-to-python-test.yml
 # Uses dry-run mode (twine check) with fake dist artifacts from tests/_resources/fake-python-dist/.
 
 jobs:
   dry-run:
-    uses: ./.github/workflows/python/publish-to-python-test.yml
+    uses: ./.github/workflows/python-publish-to-python-test.yml
     with:
       dry-run: true
     permissions:

tests/python/publish-to-python.yml

@@ -1,14 +1,14 @@
-name: Test — python/publish-to-python
+name: Test — python-publish-to-python
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/python/publish-to-python.yml
+# Tests for .github/workflows/python-publish-to-python.yml
 # Uses dry-run mode (twine check) with fake dist artifacts from tests/_resources/fake-python-dist/.
 
 jobs:
   dry-run:
-    uses: ./.github/workflows/python/publish-to-python.yml
+    uses: ./.github/workflows/python-publish-to-python.yml
     with:
       dry-run: true
     permissions:

tests/typescript/build.yml

@@ -1,14 +1,14 @@
-name: Test — typescript/build
+name: Test — typescript-build
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/typescript/build.yml
+# Tests for .github/workflows/typescript-build.yml
 # No xvfb, no dependency install — validates the standard npm build path.
 # Requires npm run test and npm run build scripts — validated by actionlint only in ci.yml.
 
 jobs:
   build:
-    uses: ./.github/workflows/typescript/build.yml
+    uses: ./.github/workflows/typescript-build.yml
     with:
       use-xvfb: false

tests/typescript/lint.yml

@@ -1,14 +1,14 @@
-name: Test — typescript/lint
+name: Test — typescript-lint
 
 on:
   workflow_call:
 
-# Tests for .github/workflows/typescript/lint.yml
+# Tests for .github/workflows/typescript-lint.yml
 # Uses tests/_resources/fake-npm-package which has a minimal package.json.
 # Requires npm run lint and npm run format scripts — validated by actionlint only in ci.yml.
 
 jobs:
   lint:
-    uses: ./.github/workflows/typescript/lint.yml
+    uses: ./.github/workflows/typescript-lint.yml
     with:
       node-version: "24"