From c5b6c601bc799a7d09eed4fde1d7ce33ff35c339 Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Mon, 2 Nov 2026 16:38:13 -0500
Subject: [PATCH] ci: Add required CI check

Pull requests could merge with a red or missing build because no check was
required. Call the shared ci-basic workflow from a job named ci so the
check reports as ci / Build and test.

It runs scripts/verify_manifests.py, which validates every manifest
against the schema and verifies each published release asset checksum.
The old validate.yaml is removed, as it ran the same script.
---
 .github/workflows/ci.yaml       | 15 +++++++++++++
 .github/workflows/validate.yaml | 39 ---------------------------------
 2 files changed, 15 insertions(+), 39 deletions(-)
 create mode 100644 .github/workflows/ci.yaml
 delete mode 100644 .github/workflows/validate.yaml

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..1839244
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,15 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    uses: datum-cloud/actions/.github/workflows/ci-basic.yaml@v1.26.0
+    with:
+      run: python3 -m venv "$RUNNER_TEMP/venv" && "$RUNNER_TEMP/venv/bin/pip" install --quiet 'jsonschema[format-nongpl]==4.26.0' 'PyYAML==6.0.3' && "$RUNNER_TEMP/venv/bin/python" scripts/verify_manifests.py
diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml
deleted file mode 100644
index 82f8edf..0000000
--- a/.github/workflows/validate.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: Validate catalog
-
-# Runs on every PR and on pushes to main. The catalog is small, so we validate
-# and verify the whole thing each time rather than trying to diff which plugins
-# changed — that keeps the check honest (a manifest can break for reasons
-# unrelated to the files a PR touched) and always exercises the real assets.
-on:
-  pull_request:
-    branches: [main]
-  push:
-    branches: [main]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || (startsWith(github.ref, 'refs/heads/') && github.ref != format('refs/heads/{0}', github.event.repository.default_branch)) }}
-
-jobs:
-  validate:
-    runs-on: ${{ (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && vars.MILO_LINUX_RUNNER || 'ubuntu-latest' }}
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.x"
-
-      - name: Install tooling
-        run: pip install --quiet "jsonschema[format-nongpl]>=4" "PyYAML>=6"
-
-      # Schema-validate every manifest and prove every advertised download
-      # actually resolves and matches its checksum. index.yaml is a generated
-      # artifact reconciled on merge (see generate-index.yaml), so it is not
-      # reviewed or gated here — contributors and the release bot only ever touch
-      # plugins/*.yaml.
-      - name: Validate manifests and verify release assets
-        run: python3 scripts/verify_manifests.py