From 8c1f6bc13e30794933fbee09ee55fda0b11a6925 Mon Sep 17 00:00:00 2001
From: Sebastian Mendel <github@sebastianmendel.de>
Date: Wed, 22 Jul 2026 14:02:19 +0200
Subject: [PATCH] ci: route shell tests through the shared python-ci reusable

The shell-tests job was the last one in ci.yml with step-level action uses
(actions/checkout + an inline run block). It now calls
netresearch/.github python-ci.yml, so every job in ci.yml is a reusable
workflow call and actions live only inside reusables.

The two bash suites run via python-ci's test step; test_reconcile_dryrun.sh
drives `python3 audit.py`, so the caller installs the project (packaging,
PyYAML) on Python 3.14 instead of relying on the runner's system
interpreter.

Workflow-level permissions are now empty, with the grant declared on each
calling job.

Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
---
 .github/workflows/ci.yml | 30 ++++++++++++++++++------------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9a20960..ff727e9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,8 +7,7 @@ on:
     branches: [main, develop]
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   # Gold-standard meta-reusable pilot. python-app-ci composes lint /
@@ -59,18 +58,25 @@ jobs:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
 
+  # The bash suites are driven through python-ci's test step (it runs the
+  # command with `bash -c` from the repo root), so no step-level action is
+  # needed here. test_reconcile_dryrun.sh invokes `python3 audit.py`, which
+  # needs the runtime deps declared in pyproject (packaging, PyYAML) — hence
+  # the editable install and Python 3.14 (pyproject requires-python >=3.14).
   shell-tests:
     name: Shell Tests
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Run shell test suites
-        run: |
-          bash tests/test_guide_multi_install.sh
-          bash tests/test_reconcile_dryrun.sh
+    uses: netresearch/.github/.github/workflows/python-ci.yml@main
+    permissions:
+      contents: read
+    with:
+      python-versions: '["3.14"]'
+      install-cmd: "python -m pip install --upgrade pip && pip install -e ."
+      run-lint: false
+      run-type-check: false
+      run-tests: true
+      test-cmd: >-
+        bash tests/test_guide_multi_install.sh &&
+        bash tests/test_reconcile_dryrun.sh
 
   docs:
     name: Documentation Check