ci(.github): refactor github actions workflows

[dclong]

Summary

• ci: refactor github actions workflows

Changed files

Added

• .github/workflows/check_workflow_template_extensions.yaml (+18/-0)
  Modified
• .github/workflows/auto_merge_pull_request.yaml (+1/-3)
  Removed
• .github/workflows/lint.yaml (+0/-34)
• .github/workflows/test.yaml (+0/-31)
  Renamed
• .github/workflows/pr-workflow.yaml (+16/-1)

Commits

• df6215f ci: refactor github actions workflows

[dclong]

Claude finished @dclong's task in 5m 57s —— View job

---

Claude's Task List

• Gather context (PR diff, files changed, CLAUDE.md)
• Run /code-review:code-review on PR ci(.github): refactor github actions workflows #133
• Cross-check findings against live CI run for this PR
• Post review feedback
• Decide on auto-merge eligibility

Review Summary

This PR consolidates the separate Lint Code / Run Tests workflows into a single PR Workflow that calls shared reusable workflows from legendu-net/.github, adds a check_workflow_template_extensions job, and syncs the corresponding template copies under github_rest_api/scripts/github/workflows/ (used when scaffolding new repos).

Checked and ruled out: The switch from the inline pytest step (which explicitly set env: GITHUB_TOKEN: ${{ secrets.ACTIONS_TOKEN }}) to the reusable legendu-net/.github/.github/workflows/test.yaml@main workflow looked like it could silently drop authenticated GitHub API access for tests/test_github.py (test_user_get_repositories, etc., which read os.environ.get("GITHUB_TOKEN", "")). I verified this against this PR's own live CI run (run 31925679490) — all test_code matrix jobs passed (337 passed) and the log confirms GITHUB_TOKEN was populated, so the reusable workflow already handles this correctly. Not an issue.

Found — template/live workflow drift:

• github_rest_api/scripts/github/workflows/pr-workflow.yaml (the scaffold template copied into new repos) is missing the permissions: {contents: read, pull-requests: read} block on the test_code job that .github/workflows/pr-workflow.yaml (the live copy added in this same commit) has. Since both files were introduced together in this PR and are otherwise identical, this looks like an unintentional omission rather than a deliberate difference. If the reusable test.yaml workflow needs pull-requests: read (which is presumably why it was added to the live copy), repos scaffolded from this template via create_github_repo.py could hit a permissions failure in their test_code job that this repo itself won't see.
  Fix this →

Other files reviewed (check_workflow_template_extensions.yaml, auto_merge_pull_request.yaml template, claude.yaml template, create_pr_to_main.yaml template) — content matches their live counterparts or is a straightforward move to a reusable workflow; no issues found.

Verdict

One real inconsistency (missing permissions block in the scaffold template) that could cause CI failures in repos generated from this template in the future. Not merge-blocking for this repo's own CI (which is green), but should be fixed before relying on the template for new repos.

[dclong]

Claude finished @dclong's task in 1m 42s —— View job

---

Claude's Task List

• Gather context (PR diff, files changed, CLAUDE.md)
• Run /code-review:code-review on PR ci(.github): refactor github actions workflows #133
• Cross-check findings against live CI run for this PR
• Decide on auto-merge eligibility

Review Summary

This PR consolidates the separate Lint Code / Run Tests / Claude Code Review workflows into a single PR Workflow that calls shared reusable workflows from legendu-net/.github, adds a check_workflow_template_extensions job, and syncs the corresponding template copies under github_rest_api/scripts/github/workflows/ (used when scaffolding new repos via create_github_repo.py).

Previously flagged issue is now resolved. An earlier review of this PR (for a prior commit) found that the scaffold template github_rest_api/scripts/github/workflows/pr-workflow.yaml was missing the permissions: {contents: read, pull-requests: read} block on its test_code job, while the live .github/workflows/pr-workflow.yaml had it. Re-diffing the current HEAD (eb29c03) shows both files are now identical for the test_code job's permissions block — the only remaining, intentional difference is that the live copy additionally has the check_workflow_template_extensions job (correctly excluded from the template since it hardcodes this repo's own github_rest_api/scripts/github/workflows/ path, which wouldn't apply to scaffolded repos).

Other checks performed:

• github_rest_api/scripts/github/workflows/auto_merge_pull_request.yaml (template) is byte-identical to .github/workflows/auto_merge_pull_request.yaml (live) — consistent.
• github_rest_api/scripts/github/workflows/claude.yaml (new template) is byte-identical to the existing live .github/workflows/claude.yml — consistent (naming extension .yml vs .yaml differs between live/template, but that's pre-existing and outside this PR's scope; the new check_workflow_template_extensions check only scans the template directory, so it doesn't flag it).
• check_workflow_template_extensions.yaml correctly greps github_rest_api/scripts/github/workflows/ for stray .yml files; confirmed no .yml files remain there.
• .github/workflows/auto_merge_pull_request.yaml's workflow_run.workflows trigger was correctly updated from [Claude Code Review, Lint Code, Run Tests] to [PR Workflow], matching the new consolidated workflow name.
• Live CI for this PR (run 31926365419) shows lint_code, test_code (all OS/Python matrix combinations), and check_workflow_template_extensions all green.

No correctness bugs or blocking issues found.

Verdict

Safe to auto-merge.
(branch: push-vtryqplwtqxx)

AUTO_MERGE_APPROVED