ci: use the shared pull request, release and autoupdate workflows (#19)

* ci(workflows): migrate to shared go-pr and go-release workflows

Replace the generic vet, staticcheck, govulncheck, gosec, test and release jobs with the shared go-pr and go-release workflows.
Keep the codegen-clean and audit jobs in ci.yml. Add an examples build job and the ci-success aggregator there.
Add autoupdate.yaml from the shared go-autoupdate workflow.
The release job now runs only on Go source changes and on manual dispatch.
The dry-run input and the Bot API note in the tag message no longer exist.

* ci(release): gate release on repo checks and export Bot API version

Move the codegen-clean, audit and examples jobs into the reusable checks.yml workflow. The ci.yml and release.yml workflows both call it.
The release job now needs the checks job. A failed or cancelled check blocks the release.
Add workflow-prepare.sh. It appends BOT_API_VERSION to GITHUB_ENV so the GoReleaser header shows the Bot API version.
The script does nothing when GITHUB_ENV is unset.

* ci(regen): name release.yml in the merge step comments

The release now runs from release.yml. The comments still named ci.yml as the workflow that cuts the release.

.github/workflows/autoupdate.yaml

@@ -0,0 +1,20 @@
+name: Autoupdate go.mod and go.sum
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 3 * * *"
+
+permissions:
+  contents: write
+  actions: write
+  pull-requests: write
+  security-events: write
+
+jobs:
+  autoupdate:
+    uses: lukaszraczylo/shared-actions/.github/workflows/go-autoupdate.yaml@main
+    with:
+      go-version: ">=1.25"
+      release-workflow: "release.yml"
+    secrets: inherit

.github/workflows/checks.yml

@@ -0,0 +1,61 @@
+name: checks
+
+# Repo-specific gates. Called by ci.yml (PR/push) and release.yml (release gate).
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  examples:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '>=1.25'
+          check-latest: true
+      - name: Build all examples
+        run: go build ./examples/...
+
+  codegen-clean:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '>=1.25'
+          check-latest: true
+      - name: Regenerate against pinned snapshot
+        run: make regen-from-fixture
+      - name: Assert clean diff
+        run: git diff --exit-code internal/spec/api.json api/ docs/reference/
+
+  audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0   # need history for drift comparison
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '>=1.25'
+          check-latest: true
+      - name: Audit fallbacks
+        run: make audit
+      - name: Audit drift vs base
+        # On PRs: compare against the merge base (origin/<base>).
+        # On push to main: compare against the parent commit.
+        # Drift is informational; doesn't fail CI.
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            BASE="origin/${{ github.base_ref }}"
+          else
+            BASE="HEAD~1"
+          fi
+          echo "Drift base: $BASE"
+          go run ./cmd/audit -ir internal/spec/api.json -drift -against "$BASE" || true

.github/workflows/ci.yml

@@ -1,20 +1,16 @@
 name: ci
 
+# Repo-specific checks run through checks.yml. Generic vet, staticcheck,
+# govulncheck, gosec and tests run in pr.yaml (shared go-pr). Releases run in
+# release.yml (shared go-release), gated by the same checks.yml.
 on:
   push:
     branches: [main]
   pull_request:
   workflow_dispatch:
-    inputs:
-      dry-run-release:
-        description: "Compute release version, do not tag or release"
-        type: boolean
-        default: false
 
 permissions:
-  contents: write
+  contents: read
-  pull-requests: read
-  packages: write
 
 # Cancel any in-flight CI runs for the same branch when a new push lands.
 concurrency:
@@ -22,163 +18,15 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  vet:
+  checks:
-    runs-on: ubuntu-latest
+    uses: ./.github/workflows/checks.yml
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-      - uses: actions/cache@v5
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }}
-      - run: go vet ./...
 
-  staticcheck:
+  # Aggregate gate for the repo-local checks. Keeps the `ci-success` name
-    runs-on: ubuntu-latest
+  # so an existing branch-protection rule keeps resolving.
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-      - uses: actions/cache@v5
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }}
-      - run: go install honnef.co/go/tools/cmd/[email protected]
-      - run: staticcheck ./...
-
-  govulncheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-      - uses: actions/cache@v5
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }}
-      # Pinned, matching staticcheck above. govulncheck@latest is v1.8.0,
-      # which declares go 1.26.0 and therefore cannot be installed by the
-      # 1.25.x toolchain this workflow pins - the install step fails before
-      # any scanning happens. v1.7.0 declares go 1.25.0. Pinning the binary
-      # does not freeze the vulnerability database, which govulncheck
-      # fetches at run time. Re-pin deliberately when bumping go-version.
-      - run: go install golang.org/x/vuln/cmd/[email protected]
-      - run: govulncheck ./...
-
-  gosec:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-      - uses: actions/cache@v5
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }}
-      - run: go install github.com/securego/gosec/v2/cmd/gosec@latest
-      # G404: math/rand/v2 jitter in transport/backoff.go — intentional (not crypto)
-      # G304: os.ReadFile from CLI flag variable — intentional (tool, not server)
-      # G306: 0o644 on generated doc artifacts in cmd/scrape — intentional
-      # G204: git subprocess in cmd/audit uses CLI flag path — intentional (operator tool)
-      # G706: log.Printf with values from Telegram/env in examples — illustrative,
-      #       library users are expected to sanitise before logging in production
-      - run: gosec -quiet -exclude=G404,G304,G306,G204,G706 -exclude-dir=testdata ./...
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-      - uses: actions/cache@v5
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }}
-      - run: go test -race -coverprofile=coverage.out ./...
-      - name: Build all examples
-        run: go build ./examples/...
-      - uses: actions/upload-artifact@v7
-        with:
-          name: coverage
-          path: coverage.out
-
-  codegen-clean:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-      - uses: actions/cache@v5
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }}
-      - name: Regenerate against pinned snapshot
-        run: make regen-from-fixture
-      - name: Assert clean diff
-        run: git diff --exit-code internal/spec/api.json api/ docs/reference/
-
-  audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0   # need history for drift comparison
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-      - uses: actions/cache@v5
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }}
-      - name: Audit fallbacks
-        run: make audit
-      - name: Audit drift vs base
-        # On PRs: compare against the merge base (origin/<base>).
-        # On push to main: compare against the parent commit.
-        # Drift is informational; doesn't fail CI.
-        run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            BASE="origin/${{ github.base_ref }}"
-          else
-            BASE="HEAD~1"
-          fi
-          echo "Drift base: $BASE"
-          go run ./cmd/audit -ir internal/spec/api.json -drift -against "$BASE" || true
-
-  # Aggregate gate — depends on every check above. Used as a single
-  # required status check in branch protection AND as a dependency for the
-  # release job below.
   ci-success:
     runs-on: ubuntu-latest
-    needs: [vet, staticcheck, govulncheck, gosec, test, codegen-clean, audit]
+    timeout-minutes: 5
+    needs: [checks]
     if: always()
     steps:
       - name: All checks passed
@@ -190,85 +38,3 @@ jobs:
           echo "Failed/cancelled jobs:"
           echo '${{ toJSON(needs) }}'
           exit 1
-
-  # Auto-release fires on every clean push to main (and on manual
-  # workflow_dispatch for testing). Computes next SemVer from commit
-  # history via lukaszraczylo/semver-generator, dual-tags
-  # (v<X.Y.Z> + bot-api-v<A.B>), runs GoReleaser.
-  release:
-    needs: ci-success
-    if: |
-      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
-      github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-
-      # Action interface from
-      # https://github.com/lukaszraczylo/semver-generator/blob/main/action.yml
-      #   Inputs:  repository_local: true   (use already-cloned repo)
-      #            existing: true           (respect existing tags as base)
-      #   Output:  semantic_version         (bare version string, no "v" prefix)
-      - name: Compute next SemVer
-        id: semver
-        uses: lukaszraczylo/semver-generator@v1
-        with:
-          repository_local: true
-          existing: true
-          config_file: .semver.yaml
-
-      - name: Read Bot API version
-        id: api_version
-        run: |
-          VERSION=$(python3 -c 'import json; print(json.load(open("internal/spec/api.json"))["version"])')
-          if [ -z "$VERSION" ] || [ "$VERSION" = "null" ]; then
-            echo "tag=" >> "$GITHUB_OUTPUT"
-          else
-            echo "tag=bot-api-v${VERSION}" >> "$GITHUB_OUTPUT"
-          fi
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Dry-run summary
-        if: github.event_name == 'workflow_dispatch' && inputs.dry-run-release == true
-        run: |
-          echo "Would release: v${{ steps.semver.outputs.semantic_version }}"
-          if [ -n "${{ steps.api_version.outputs.tag }}" ]; then
-            echo "Would also tag: ${{ steps.api_version.outputs.tag }} (Bot API ${{ steps.api_version.outputs.version }})"
-          fi
-          echo "Skipping tag + release (dry-run)."
-
-      - name: Tag library + bot-api versions
-        if: github.event_name != 'workflow_dispatch' || inputs.dry-run-release == false
-        env:
-          LIB_TAG: v${{ steps.semver.outputs.semantic_version }}
-          API_TAG: ${{ steps.api_version.outputs.tag }}
-          API_VER: ${{ steps.api_version.outputs.version }}
-        run: |
-          # Bot API version (currently $API_VER) is intentionally NOT
-          # tagged separately. semver-generator picks the most recent
-          # tag as the version base; a non-SemVer marker like
-          # bot-api-vX.Y poisons that and restarts numbering from
-          # v0.0.x. Bot API version stays as a comment in the lib tag
-          # message and in the release notes.
-          git config user.name  "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -a "$LIB_TAG" -m "Release $LIB_TAG (Bot API $API_VER)"
-          git push origin "$LIB_TAG"
-
-      - name: Run GoReleaser
-        if: github.event_name != 'workflow_dispatch' || inputs.dry-run-release == false
-        uses: goreleaser/goreleaser-action@v7
-        with:
-          distribution: goreleaser
-          version: '~> v2'
-          args: release --clean
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BOT_API_VERSION: ${{ steps.api_version.outputs.version }}

.github/workflows/pr.yaml

@@ -0,0 +1,22 @@
+name: Pull Request
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - "**"
+      - "!main"
+
+permissions:
+  contents: write
+  actions: write
+  pull-requests: write
+  security-events: write
+
+jobs:
+  pr-checks:
+    uses: lukaszraczylo/shared-actions/.github/workflows/go-pr.yaml@main
+    with:
+      go-version: ">=1.25"

.github/workflows/regen.yml

@@ -128,11 +128,11 @@ jobs:
             `make regen` (which fails on any audit fallback) and `go test -race ./...`,
             both run in this job before the PR opens.
 
-      # A PR opened with GITHUB_TOKEN does not trigger `ci.yml`, so waiting for
+      # A PR opened with GITHUB_TOKEN does not trigger `ci.yml` or `pr.yaml`, so waiting for
       # PR checks would wait forever. The gates already ran in this job: `make
       # regen` fails on any audit fallback, and the test step runs the full race
       # suite. Merging here therefore means "merged because the checks passed".
-      # `ci.yml` then runs on the push to main and cuts the release.
+      # `release.yml` then runs on the push to main and cuts the release.
       - name: Merge regen PR
         if: steps.diff.outputs.no_changes != 'true' && steps.pr.outputs.pull-request-number != ''
         env:

.github/workflows/release.yml

@@ -0,0 +1,28 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "**.go"
+      - "go.mod"
+      - "go.sum"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  packages: write
+  id-token: write
+
+jobs:
+  checks:
+    uses: ./.github/workflows/checks.yml
+
+  release:
+    needs: checks
+    uses: lukaszraczylo/shared-actions/.github/workflows/go-release.yaml@main
+    with:
+      go-version: ">=1.25"
+      semver-config: ".semver.yaml"
+    secrets: inherit

workflow-prepare.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Exports BOT_API_VERSION for the .goreleaser.yaml release header.
+set -euo pipefail
+
+[ -n "${GITHUB_ENV:-}" ] || exit 0
+
+ver=$(python3 -c 'import json; print(json.load(open("internal/spec/api.json"))["version"])')
+if [ -z "$ver" ] || [ "$ver" = "null" ]; then
+  exit 0
+fi
+echo "BOT_API_VERSION=${ver}" >> "$GITHUB_ENV"