feat(ci): call the central workflow bodies instead of copying them

.github/workflows/ci.yml

@@ -1,50 +1,23 @@
 # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 
+# The checks come from package.json's `check` script — which here ends in
+# `pnpm validate`, a repo-specific step the body picks up without being told.
 name: CI
 
 on:
   pull_request:
     branches:
       - main
     types: [opened, synchronize, reopened, ready_for_review]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - LICENSE
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
-  lint:
-    name: Lint & Format
-    runs-on: ubuntu-latest
-    if: github.event.pull_request.draft == false
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 24
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Lint
-        run: pnpm lint
-
-      - name: Format check
-        run: pnpm format
-
-      - name: Typecheck
-        run: pnpm typecheck
-
-      # The gate the entries actually need: the schema plus the cross-file
-      # checks it cannot express. Without it a mistyped category or technology
-      # drops a project off the page, silently.
-      - name: Validate entries
-        run: pnpm validate
+  check:
+    name: CI
+    uses: kirchDev/workflows/.github/workflows/_ci-check.yml@c2c3c73a1b38c10e5d4a6dfa76c46749c03c1158 # v0.1.2

.github/workflows/codeql.yml

@@ -7,43 +7,17 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
   schedule:
     - cron: '34 23 * * 0'
   workflow_dispatch:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
+  codeql:
+    name: CodeQL
     permissions:
       security-events: write
       packages: read
       actions: read
       contents: read
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [actions, javascript-typescript]
-
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 1
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.9
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: none
-          queries: security-extended,security-and-quality
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.9
-        with:
-          category: '/language:${{ matrix.language }}'
+    uses: kirchDev/workflows/.github/workflows/_codeql.yml@c2c3c73a1b38c10e5d4a6dfa76c46749c03c1158 # v0.1.2