ci: move bioflow ci into nix checks

.github/workflows/ci.yml

@@ -1,125 +1,22 @@
-name: CI
+name: Nix CI
 
 on:
   push:
     branches: [main]
   workflow_dispatch:
 
-jobs:
-  determinism:
-    runs-on: ${{ fromJSON(vars.CI_RUNNER_LABELS) }}
-    strategy:
-      fail-fast: false
-      matrix:
-        node-version: ["20", "22"]
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - run: corepack enable
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: "pnpm"
-
-      - run: pnpm install --frozen-lockfile
-      - run: npm run verify:golden
+permissions:
+  contents: read
+  id-token: write
 
-  test:
-    runs-on: ${{ fromJSON(vars.CI_RUNNER_LABELS) }}
-    env:
-      BIOFLOW_DATABASE_URL: postgres://postgres@127.0.0.1:55432/postgres
+concurrency:
+  group: nix-ci-${{ github.ref }}
+  cancel-in-progress: true
 
-    steps:
-      - uses: actions/checkout@v4
-
-      - run: corepack enable
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          cache: "pnpm"
-
-      - run: pnpm install --frozen-lockfile
-      - name: Start local Postgres
-        env:
-          PGDATA: ${{ runner.temp }}/bioflow-pgdata
-          PGSOCKET_DIR: ${{ runner.temp }}/bioflow-pgsocket
-          PGPORT: "55432"
-          PGLOG: ${{ runner.temp }}/bioflow-postgres.log
-        run: nix shell nixpkgs#postgresql_16 --command bash scripts/ci-local-postgres.sh start
-      - run: npm run check:ci
-      - run: npm run demo:killer:ci
-      - run: npm run build
-      - name: Detect hosted-only scripts
-        id: hosted-scripts
-        run: |
-          node - <<'NODE'
-          const scripts = require('./package.json').scripts ?? {};
-          const enabled = Boolean(scripts['db:migrate'] && scripts['service:api'] && scripts['test:rls']);
-          const fs = require('node:fs');
-          fs.appendFileSync(process.env.GITHUB_OUTPUT, `enabled=${enabled}\n`);
-          NODE
-      - name: CLI autopilot flow (mock hosted)
-        env:
-          BIOFLOW_AUTOPILOT_FLOW_OUT: .bioflow_smoke_service/cli-autopilot-run-flow-summary.json
-        run: |
-          set -euo pipefail
-          npm run test -- test/cli-autopilot-run-flow.test.ts
-      - name: Upload CLI autopilot flow summary
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: cli-autopilot-run-flow-summary
-          path: .bioflow_smoke_service/cli-autopilot-run-flow-summary.json
-          if-no-files-found: warn
-      - name: Self-serve smoke (signup -> run -> verify -> share)
-        if: ${{ steps.hosted-scripts.outputs.enabled == 'true' }}
-        env:
-          BIOFLOW_SERVICE_DATA_DIR: .bioflow_smoke_service
-          BIOFLOW_RUNNER_MODE: inline
-          BIOFLOW_API_KEY_PEPPER: 0123456789abcdef0123456789abcdef
-          BIOFLOW_DEV_ALLOW_ORG_HEADER: "false"
-          BIOFLOW_HTTP_RATE_LIMIT_POINTS: "0"
-          BIOFLOW_SIGNUP_RATE_LIMIT_POINTS: "0"
-          BIOFLOW_REMOTE_URL: http://127.0.0.1:8080
-          BIOFLOW_AUTOPILOT_OUT: .bioflow_smoke_service/self-serve-autopilot.json
-        run: |
-          set -euo pipefail
-          npm run db:migrate
-          npm run service:api >/tmp/bioflow-api.log 2>&1 &
-          API_PID=$!
-          trap 'status=$?; kill "$API_PID" >/dev/null 2>&1 || true; wait "$API_PID" >/dev/null 2>&1 || true; if [ "$status" -ne 0 ]; then echo "=== /tmp/bioflow-api.log ==="; cat /tmp/bioflow-api.log || true; fi' EXIT
-          for _ in {1..60}; do
-            if curl -fsS http://127.0.0.1:8080/readyz >/dev/null; then
-              break
-            fi
-            sleep 1
-          done
-          curl -fsS http://127.0.0.1:8080/readyz >/dev/null
-          npm run bioflow -- autopilot:run \
-            --remote-url "$BIOFLOW_REMOTE_URL" \
-            --enforce-policy \
-            --out "$BIOFLOW_AUTOPILOT_OUT"
-          echo "=== self-serve autopilot summary ==="
-          cat "$BIOFLOW_AUTOPILOT_OUT"
-          npm run bioflow -- autopilot:gate --json
-      - name: Upload self-serve autopilot summary
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: self-serve-autopilot-summary
-          path: .bioflow_smoke_service/self-serve-autopilot.json
-          if-no-files-found: warn
-      - name: RLS integration
-        if: ${{ steps.hosted-scripts.outputs.enabled == 'true' }}
-        run: npm run test:rls
-      - name: Stop local Postgres
-        if: always()
-        env:
-          PGDATA: ${{ runner.temp }}/bioflow-pgdata
-          PGSOCKET_DIR: ${{ runner.temp }}/bioflow-pgsocket
-          PGPORT: "55432"
-          PGLOG: ${{ runner.temp }}/bioflow-postgres.log
-        run: nix shell nixpkgs#postgresql_16 --command bash scripts/ci-local-postgres.sh stop
+jobs:
+  nix-ci:
+    uses: OmnisGenomics/.github/.github/workflows/nix-ci.yml@main
+    with:
+      publish_cache: ${{ github.ref == 'refs/heads/main' }}
+    secrets:
+      MONARCHIC_GITHUB_PAT: ${{ secrets.MONARCHIC_GITHUB_PAT }}

.github/workflows/conventional-commits.yml

@@ -5,48 +5,22 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   conventional-commits:
-    name: Conventional Commits
-    runs-on: ${{ fromJSON(vars.CI_RUNNER_LABELS) }}
-    timeout-minutes: 15
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-
-      - name: Determine Revision Range
-        id: range
-        shell: bash
-        run: |
-          set -euo pipefail
-          if git rev-parse --verify HEAD~1 >/dev/null 2>&1; then
-            range="HEAD~1..HEAD"
-          else
-            range="HEAD"
-          fi
-          echo "range=$range" >> "$GITHUB_OUTPUT"
-
-      - name: Validate Commit Subjects
-        run: |
-          set -euo pipefail
-          ./scripts/conventional-commit-check.sh \
-            --rev-range "${{ steps.range.outputs.range }}" \
-            --output out/conventional-commits-summary.json \
-            --allow-merge-commits \
-            --allow-git-revert
-
-      - name: Upload Conventional Commit Summary
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: conventional-commits-${{ github.run_id }}-${{ github.run_attempt }}
-          path: out/conventional-commits-summary.json
-          if-no-files-found: warn
+    uses: OmnisGenomics/.github/.github/workflows/maintenance.yml@main
+    with:
+      check_flake: false
+      report_artifact_name: conventional-commits-${{ github.run_id }}-${{ github.run_attempt }}
+      maintenance_command: |
+        git fetch --no-tags --depth=2 origin "${GITHUB_REF_NAME}"
+        if git rev-parse --verify HEAD~1 >/dev/null 2>&1; then
+          rev_range=HEAD~1..HEAD
+        else
+          rev_range=HEAD
+        fi
+        nix run .#conventional-commits -- "$rev_range"
+    secrets:
+      MONARCHIC_GITHUB_PAT: ${{ secrets.MONARCHIC_GITHUB_PAT }}

.github/workflows/release-cli.yml

@@ -5,35 +5,19 @@ on:
     tags:
       - "cli-v*"
 
+permissions:
+  actions: read
+  contents: read
+  id-token: write
+
 jobs:
   publish:
-    runs-on: ${{ fromJSON(vars.CI_RUNNER_LABELS) }}
-    permissions:
-      contents: read
-      id-token: write
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - run: corepack enable
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          registry-url: "https://registry.npmjs.org"
-          cache: "pnpm"
-
-      - name: Validate tag matches package version
-        run: |
-          TAG_VERSION="${GITHUB_REF_NAME#cli-v}"
-          PKG_VERSION="$(node -e 'const fs=require(\"fs\");process.stdout.write(JSON.parse(fs.readFileSync(\"package.json\",\"utf8\")).version)')"
-          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
-            echo "tag version ($TAG_VERSION) must match package.json version ($PKG_VERSION)"
-            exit 1
-          fi
-
-      - run: pnpm install --frozen-lockfile
-      - run: npm run build
-      - run: npm publish --access public --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+    uses: OmnisGenomics/.github/.github/workflows/npm-publish.yml@main
+    with:
+      tag_pattern: '^cli-v[0-9]+[.][0-9]+[.][0-9]+$'
+      tag_prefix: cli-v
+      install_command: pnpm install --frozen-lockfile
+      required_workflow: Nix CI
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      MONARCHIC_GITHUB_PAT: ${{ secrets.MONARCHIC_GITHUB_PAT }}