From d8fd8448d4ad40f7e699b3ca4e6334a459f16feb Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Thu, 18 Dec 2025 08:45:38 +0100
Subject: [PATCH] ci: centralize lint and security workflows via workflow_call

- Convert Hadolint and CodeQL workflows to reusable workflow_call
- Keep scheduled scans for Dockerfile hygiene and security analysis
- Integrate lint-docker and security-codeql into mark-stable gate
- Rename workflows for consistent lint/security naming

https://chatgpt.com/share/6943b12d-2c84-800f-b63d-68e4d1db6d0a
---
 .github/workflows/{hadolint.yml => lint-docker.yml}   | 6 +-----
 .github/workflows/mark-stable.yml                     | 6 ++++++
 .github/workflows/{codeql.yml => security-codeql.yml} | 5 +----
 3 files changed, 8 insertions(+), 9 deletions(-)
 rename .github/workflows/{hadolint.yml => lint-docker.yml} (90%)
 rename .github/workflows/{codeql.yml => security-codeql.yml} (98%)

diff --git a/.github/workflows/hadolint.yml b/.github/workflows/lint-docker.yml
similarity index 90%
rename from .github/workflows/hadolint.yml
rename to .github/workflows/lint-docker.yml
index be31d0cc1a..5d42e36e7c 100644
--- a/.github/workflows/hadolint.yml
+++ b/.github/workflows/lint-docker.yml
@@ -9,11 +9,7 @@
 name: Hadolint
 
 on:
-  push:
-    branches: [ "master" ]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ "master" ]
+  workflow_call:
   schedule:
     - cron: '33 10 * * 2'
 
diff --git a/.github/workflows/mark-stable.yml b/.github/workflows/mark-stable.yml
index 75650497e8..32561a3abe 100644
--- a/.github/workflows/mark-stable.yml
+++ b/.github/workflows/mark-stable.yml
@@ -11,10 +11,14 @@ on:
 jobs:
   lint-ansible:
     uses: ./.github/workflows/lint-ansible.yml
+  lint-docker:
+    uses: ./.github/workflows/lint-docker.yml
   lint-python:
     uses: ./.github/workflows/lint-python.yml
   lint-shell:
     uses: ./.github/workflows/lint-shell.yml
+  security-codeql:
+    uses: ./.github/workflows/security-codeql.yml
   test-code-integration:
     uses: ./.github/workflows/test-code-integration.yml
   test-code-lint:
@@ -35,6 +39,8 @@ jobs:
     needs:
       - lint-python
       - lint-shell
+      - lint-docker
+      - security-codeql
       - test-code-integration
       - test-code-lint
       - test-code-unit
diff --git a/.github/workflows/codeql.yml b/.github/workflows/security-codeql.yml
similarity index 98%
rename from .github/workflows/codeql.yml
rename to .github/workflows/security-codeql.yml
index 3be504d624..3c31ca32d2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/security-codeql.yml
@@ -12,10 +12,7 @@
 name: "CodeQL Advanced"
 
 on:
-  push:
-    branches: [ "master" ]
-  pull_request:
-    branches: [ "master" ]
+  workflow_call:
   schedule:
     - cron: '36 9 * * 6'