refactor: rename workflows and actions to the org naming convention

.github/actions/action-metadata-filename/check-action-metadata-filename.sh → .github/actions/check-action-filename/check-action-metadata-filename.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Every lane here (composite-run-shellcheck.sh, ci.yml's schema step) globs
+# Every lane here (composite-run-shellcheck.sh, pr-require-checks.yml's schema step) globs
 # action.yml only, so a GitHub-legal action.yaml would be skipped silently.
 set -uo pipefail
 

.github/actions/pr-contract/README.md → .github/actions/pr-require-checks/check-contract/README.md

@@ -99,13 +99,13 @@ Both steps go in the `ci-status` job, in this order:
       statuses: write
     runs-on: ubuntu-24.04
     steps:
-      - uses: melodic-software/ci-workflows/.github/actions/pr-contract@<sha> # vX.Y.Z
+      - uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@<sha> # vX.Y.Z
       - name: Aggregate lane results
         # `!cancelled()` so a failing pr-contract step does not skip the
         # aggregation: the job still fails on the contract step's exit code, and
         # the ci-lanes status lands on the SHA for the next contract-only run.
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/ci-status@<sha> # vX.Y.Z
+        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@<sha> # vX.Y.Z
         with:
           results: ${{ needs.lane-a.result }} ${{ needs.lane-b.result }}
 ```
@@ -132,12 +132,12 @@ branches on it before it looks at `same-repo`, so `contract-only: true` with
 `same-repo: false` is treated as a carry-forward even though the shipped
 defaults never produce that combination.
 
-This repository's own `.github/workflows/ci.yml` is the reference wiring.
+This repository's own `.github/workflows/pr-require-checks.yml` is the reference wiring.
 
 ## Tests
 
 `run.test.sh` drives `run.sh` against fixture JSON served by a `gh` shim placed
 first on `PATH`, which also logs every API call so the harness can assert on the
 writes that did and did not happen. Run it with
-`bash .github/actions/pr-contract/run.test.sh`; the `selector-contract` lane runs
+`bash .github/actions/pr-require-checks/check-contract/run.test.sh`; the `selector-contract` lane runs
 it in CI.

.github/scripts/Invoke-CompositeRunPssa.ps1

@@ -14,7 +14,7 @@
     to bash/sh: expression substitution, line-number mapping, and guards that
     stop a selector matching nothing from passing as a clean scan.
 
-    Analysis itself is delegated to .github/actions/powershell/Invoke-Pssa.ps1
+    Analysis itself is delegated to .github/actions/psscriptanalyzer/Invoke-Pssa.ps1
     so the repo keeps one analyzer invocation and one pinned version, read here
     from the `powershell` action's own `analyzer-version` default.
 
@@ -48,8 +48,8 @@ param(
 Set-StrictMode -Version 3.0
 $ErrorActionPreference = 'Stop'
 
-$actionMetadata = '.github/actions/powershell/action.yml'
-$runner = '.github/actions/powershell/Invoke-Pssa.ps1'
+$actionMetadata = '.github/actions/psscriptanalyzer/action.yml'
+$runner = '.github/actions/psscriptanalyzer/Invoke-Pssa.ps1'
 
 # The repo's own ruleset, applied unchanged: an embedded block is this repo's
 # PowerShell and is held to the same policy as a .ps1. The bash/sh sibling

.github/scripts/Invoke-CompositeRunPssa.test.ps1

@@ -30,7 +30,7 @@ $customFixture = 'fixtures/composite-action/pwsh-custom-shell/action.yml'
 $usesOnlyFixture = 'fixtures/composite-action/uses-only/action.yml'
 $mappingFixture = 'fixtures/composite-action/mapping-steps/action.yml'
 $noShellFixture = 'fixtures/composite-action/no-shell/action.yml'
-$coveredAction = '.github/actions/powershell/action.yml'
+$coveredAction = '.github/actions/psscriptanalyzer/action.yml'
 
 function Assert-Condition {
     [CmdletBinding()]
@@ -228,7 +228,7 @@ Assert-Condition -Condition ($noShell.Output.Contains('refusing to guess the dia
     -Message 'The missing shell: was not reported.' `
     -Context $noShell.Output
 
-$empty = Invoke-Check -Argument @('.github/workflows/ci.yml')
+$empty = Invoke-Check -Argument @('.github/workflows/pr-require-checks.yml')
 Assert-Condition -Condition ($empty.ExitCode -ne 0) `
     -Message 'A file set containing no composite pwsh run: block unexpectedly passed.' `
     -Context $empty.Output

.github/scripts/actionlint-shellcheck-pin.test.cjs

@@ -68,7 +68,7 @@ test("actionlint installs the canonical checksum-pinned ShellCheck release", ()
   );
 
   const ciWorkflow = fs.readFileSync(
-    path.join(workflowsRoot, "ci.yml"),
+    path.join(workflowsRoot, "pr-require-checks.yml"),
     "utf8",
   );
   assert.match(ciWorkflow, /actionlint-shellcheck\.txt/u);

.github/scripts/checks-markdown-globs.test.cjs

@@ -1,6 +1,6 @@
 "use strict";
 
-// `checks.yml` forwards markdownlint globs. Passing `globs` replaces the
+// `pr-run-checks.yml` forwards markdownlint globs. Passing `globs` replaces the
 // composite default, so the workflow repeats that default and appends
 // `markdown-extra-globs`. The expression is the GitHub `case`/`format` pair
 // pinned below; the arguments markdownlint-cli2 actually receives are that
@@ -20,11 +20,11 @@ function readRepo(relativePath) {
   return fs.readFileSync(path.join(repoRoot, relativePath), "utf8");
 }
 
-const checks = parseWorkflow(readRepo(".github/workflows/checks.yml"));
+const checks = parseWorkflow(readRepo(".github/workflows/pr-run-checks.yml"));
 const markdownAction = parseWorkflow(
-  readRepo(".github/actions/markdown/action.yml"),
+  readRepo(".github/actions/markdownlint/action.yml"),
 );
-const markdownStep = checks.jobs.checks.steps.find(
+const markdownStep = checks.jobs.check.steps.find(
   (step) => step?.id === "markdown",
 );
 const extraGlobs = checks.on.workflow_call.inputs["markdown-extra-globs"];
@@ -41,7 +41,7 @@ const DOTFILES_EXTRA = [
   ".chezmoitemplates/agent-instructions-shared",
 ].join(" ");
 
-assert.ok(markdownStep !== undefined, "checks.yml has no markdown step");
+assert.ok(markdownStep !== undefined, "pr-run-checks.yml has no markdown step");
 assert.ok(lintStep !== undefined, "markdown composite has no glob split");
 
 function forwardedGlobs(extra) {
@@ -71,7 +71,7 @@ function wordSplit(value) {
 }
 
 test("markdown-extra-globs is an optional string and defaults empty", () => {
-  assert.ok(extraGlobs, "checks.yml has no markdown-extra-globs input");
+  assert.ok(extraGlobs, "pr-run-checks.yml has no markdown-extra-globs input");
   assert.equal(extraGlobs.type, "string");
   assert.equal(extraGlobs.default, "");
   // Omitted `required` is optional. workflow_call inputs are required only

.github/scripts/checks-outcome.test.cjs

@@ -1,6 +1,6 @@
 "use strict";
 
-// The `checks.yml` outcome join decides the consolidated lane's verdict. It is
+// The `pr-run-checks.yml` outcome join decides the consolidated lane's verdict. It is
 // the one place where a bug is silently catastrophic rather than noisy: every
 // composite runs under `continue-on-error: true`, so a join that forgot a
 // composite reports success for a run in which that composite failed, and
@@ -20,11 +20,19 @@ const { test } = require("node:test");
 
 const { parseWorkflow } = require("./workflow-yaml.cjs");
 
-const workflowPath = path.join(__dirname, "..", "workflows", "checks.yml");
+const workflowPath = path.join(
+  __dirname,
+  "..",
+  "workflows",
+  "pr-run-checks.yml",
+);
 const workflow = parseWorkflow(fs.readFileSync(workflowPath, "utf8"));
-const steps = workflow.jobs.checks.steps;
+const steps = workflow.jobs.check.steps;
 const joinStep = steps.find((step) => step?.id === "outcome");
-assert.ok(joinStep !== undefined, "checks.yml has no `outcome` join step");
+assert.ok(
+  joinStep !== undefined,
+  "pr-run-checks.yml has no `outcome` join step",
+);
 
 // Every step the join owns: the composites, plus the input-combination guard
 // that must go red rather than let an enabled toggle skip silently.
@@ -89,17 +97,22 @@ test("the join reads every continue-on-error step", () => {
       `step ${step.id} is never reported by the join`,
     );
   }
+  const renamed = {
+    "change-detection": "detect-changes",
+    editorconfig: "editorconfig-checker",
+    markdown: "markdownlint",
+    "exec-bit": "check-exec-bit",
+    "eol-renormalize": "check-line-endings",
+  };
   for (const step of composites) {
     const name = step.id.replaceAll("_", "-");
-    assert.match(
-      String(step.uses ?? ""),
-      new RegExp(
-        `^melodic-software/ci-workflows/\\.github/actions/${name}@[0-9a-f]{40}$`,
-        "u",
-      ),
-      // A relative `./` reference inside a CALLED workflow resolves against the
-      // CALLER's checkout, so it would fail in every consumer.
-      `step ${step.id} does not reference its composite by pinned full path`,
+    const uses = String(step.uses ?? "");
+    // `$/` resolves against the repository and commit that host the called
+    // workflow, so it works in every consumer.
+    assert.equal(
+      uses,
+      `$/.github/actions/${renamed[name] ?? name}`,
+      `step ${step.id} does not reference its composite through the called workflow's own commit`,
     );
   }
   // The join reports nothing the steps do not produce: an env name left behind
@@ -184,7 +197,10 @@ test("an enabled toggle with no configuration fails, it does not skip quietly",
   // `check-jsonschema-files`; the join is what turns it into the job's verdict,
   // so a silently skipped schema gate cannot report success.
   const guard = steps.find((step) => step?.id === "configuration");
-  assert.ok(guard !== undefined, "checks.yml has no input-combination guard");
+  assert.ok(
+    guard !== undefined,
+    "pr-run-checks.yml has no input-combination guard",
+  );
   assert.equal(
     guard.if,
     `\${{ inputs.check-jsonschema && inputs.check-jsonschema-files == '' }}`,