refactor(dev): reuse devkit hooks and release conventions

.cspell/words.txt

@@ -1,6 +1,7 @@
 acked
 acking
 acks
+agentic
 ALPN
 anthropics
 APFS
@@ -21,6 +22,7 @@ DECRC
 DECSC
 deque
 desync
+devkit
 direnv
 disambiguable
 doas
@@ -48,6 +50,7 @@ fsmonitor
 fullfsync
 getpgid
 Ghostty
+GHSA
 GOARCH
 GOEXPERIMENT
 gsub
@@ -103,6 +106,7 @@ pkgs
 pname
 popd
 POSIXLY
+prek
 procs
 pushd
 pytest
@@ -123,6 +127,7 @@ rustls
 serde
 serie
 sess
+shfmt
 shopt
 SIGTTIN
 smol

.github/renovate.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["github>hakula139/nixos-config//.github/renovate-preset"],
+  "extends": ["github>hakula139/devkit#v2"],
   "packageRules": [
     {
       "matchManagers": ["rust-toolchain"],

.github/workflows/ci.yml

@@ -27,21 +27,10 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Nix
-        uses: ./.github/actions/setup-nix
+        uses: hakula139/devkit/.github/actions/setup-nix@v2
         with:
           cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
-      - name: Format
-        run: nix develop .#lint -c pnpm format
-
-      - name: Lint Markdown
-        if: ${{ !cancelled() }}
-        run: nix develop .#lint -c pnpm lint
-
-      - name: Spell check
-        if: ${{ !cancelled() }}
-        run: nix develop .#lint -c pnpm spellcheck
-
       - name: Check dependencies
         if: ${{ !cancelled() }}
         run: nix develop .#lint -c cargo deny --locked check
@@ -173,7 +162,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Nix
-        uses: ./.github/actions/setup-nix
+        uses: hakula139/devkit/.github/actions/setup-nix@v2
         with:
           cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
@@ -195,33 +184,4 @@ jobs:
       actions: read
     steps:
       - name: Check results
-        # Unlike the default shell, `bash` sets pipefail, so a failed API call fails the gate.
-        shell: bash
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GATE_ID: ${{ job.check_run_id }}
-        run: |
-          # `needs` misses a matrix leg cancelled before it starts, so read each job from the API.
-          failed=$(
-            gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/jobs?filter=all&per_page=100" \
-              --paginate \
-              --slurp |
-              jq -r --argjson gate "$GATE_ID" '
-                [.[].jobs[]]
-                | group_by(.name)
-                | map(max_by(.run_attempt)) as $jobs
-                | first($jobs[] | select(.id == $gate))
-                  // error("job \($gate) is missing from this workflow run")
-                # Jobs of a calling workflow share this run, so check only names with this prefix.
-                | (.name | sub("[^/]*$"; "")) as $prefix
-                | $jobs[]
-                | select(.id != $gate and (.name | startswith($prefix)))
-                | select(.conclusion != "success" and .conclusion != "skipped")
-                | "::error::\(.name): \(.conclusion // .status)"
-              '
-          )
-
-          if [[ -n "$failed" ]]; then
-            echo "$failed"
-            exit 1
-          fi
+        uses: hakula139/devkit/.github/actions/ci-result@v2

.github/workflows/formula.yml

@@ -3,7 +3,6 @@ name: Homebrew Formula
 on:
   pull_request:
     paths:
-      - .github/actions/setup-nix/**
       - .github/workflows/formula.yml
       - .github/workflows/release.yml
       - Formula/oxide-code.rb
@@ -47,7 +46,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Nix
-        uses: ./.github/actions/setup-nix
+        uses: hakula139/devkit/.github/actions/setup-nix@v2
         with:
           cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 

.github/workflows/nix-cache.yml

@@ -43,7 +43,7 @@ jobs:
           ref: refs/tags/${{ inputs.tag }}
 
       - name: Set up Nix
-        uses: ./.github/actions/setup-nix
+        uses: hakula139/devkit/.github/actions/setup-nix@v2
         with:
           cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 

.github/workflows/release.yml

@@ -53,37 +53,7 @@ jobs:
       actions: read
     steps:
       - name: Wait for CI on the tagged commit
-        shell: bash
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Pull request runs test a merge commit, so only push and dispatched runs count.
-          while true; do
-            verdict=$(
-              gh api "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?head_sha=$GITHUB_SHA&per_page=100" \
-                --paginate \
-                --slurp |
-                jq -r '[.[].workflow_runs[] | select(.event == "push" or .event == "workflow_dispatch")]
-                  | if any(.[]; .conclusion == "success") then
-                      "passed \(map(select(.conclusion == "success"))[0].html_url)"
-                    elif any(.[]; .status != "completed") then "running"
-                    else "failed" end'
-            )
-            case "$verdict" in
-              passed*)
-                echo "CI passed on $GITHUB_SHA: ${verdict#passed }"
-                exit 0
-                ;;
-              running)
-                sleep 30
-                ;;
-              *)
-                echo "::error::No push or dispatched CI run passed on $GITHUB_SHA." \
-                  "Rerun its failed jobs, or run ci.yml on $GITHUB_REF_NAME, then rerun this job."
-                exit 1
-                ;;
-            esac
-          done
+        uses: hakula139/devkit/.github/actions/tagged-ci@v2
 
   build:
     name: Build (${{ matrix.target }})
@@ -244,28 +214,16 @@ jobs:
             release-assets/*.tar.gz
             release-assets/*.zip
 
-      - name: Install changelog parser
-        uses: taiki-e/install-action@parse-changelog
-
       - name: Publish release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          parse-changelog CHANGELOG.md "${GITHUB_REF_NAME#v}" > release-notes.md
-
-          options=(--verify-tag --title "$GITHUB_REF_NAME" --notes-file release-notes.md)
-          if [[ "$GITHUB_REF_NAME" == *-* ]]; then
-            options+=(--prerelease)
-          fi
-
-          gh release create "$GITHUB_REF_NAME" \
-            release-assets/oxide-code-x86_64-unknown-linux-gnu.tar.gz \
-            release-assets/oxide-code-x86_64-unknown-linux-gnu.sha256 \
-            release-assets/oxide-code-aarch64-apple-darwin.tar.gz \
-            release-assets/oxide-code-aarch64-apple-darwin.sha256 \
-            release-assets/oxide-code-x86_64-pc-windows-msvc.zip \
-            release-assets/oxide-code-x86_64-pc-windows-msvc.sha256 \
-            "${options[@]}"
+        uses: hakula139/devkit/.github/actions/publish-release@v2
+        with:
+          assets: |
+            release-assets/oxide-code-x86_64-unknown-linux-gnu.tar.gz
+            release-assets/oxide-code-x86_64-unknown-linux-gnu.sha256
+            release-assets/oxide-code-aarch64-apple-darwin.tar.gz
+            release-assets/oxide-code-aarch64-apple-darwin.sha256
+            release-assets/oxide-code-x86_64-pc-windows-msvc.zip
+            release-assets/oxide-code-x86_64-pc-windows-msvc.sha256
 
   formula:
     name: Check Homebrew Formula

.gitignore

@@ -3,10 +3,6 @@
 /mutants.out*/
 /target/
 
-# Dependencies
-.pnpm-store/
-node_modules/
-
 # Local environment
 .env.local
 .envrc.local

.markdownlint-cli2.jsonc

@@ -1,18 +1,5 @@
 {
   "config": {
-    "default": true,
-    "code-block-style": { "style": "fenced" },
-    "code-fence-style": { "style": "backtick" },
-    "emphasis-style": { "style": "underscore" },
-    // GitHub shows a PR's title above its body, so the PR template starts at `##`.
     "first-line-heading": false,
-    "heading-style": { "style": "atx" },
-    "line-length": false,
-    "no-duplicate-heading": { "siblings_only": true },
-    "ol-prefix": { "style": "ordered" },
-    "strong-style": { "style": "asterisk" },
-    "ul-style": { "style": "dash" },
   },
-
-  "gitignore": true,
 }

AGENTS.md

@@ -10,8 +10,6 @@ The tree lists only the top-level entries whose names leave their purpose unclea
 
 ```text
 .
-├── .agents/                                # Agent skills for the release procedure
-├── .claude/                                # Link to the agent skills for Claude Code
 ├── about.toml                              # Release dependency license selection
 ├── crates/ox/                              # The `ox` binary crate with the CLI and headless frontend, mapped in docs/design/architecture.md
 ├── crates/ox-core/                         # The `ox-core` library crate with the agent core, mapped in docs/design/architecture.md
@@ -57,9 +55,7 @@ cargo clippy                                          # Lint without test target
 cargo doc --no-deps                                   # Check rustdoc lints
 cargo llvm-cov                                        # Run tests and check coverage
 cargo deny check                                      # Check dependencies when they change
-pnpm format                                           # Check JSON, Markdown, and YAML formatting
-pnpm lint                                             # Lint Markdown
-pnpm spellcheck                                       # Spell check
+prek run --all-files                                  # Run the shared formatting and lint hooks
 ```
 
 [Development](docs/conventions/development.md#ci) lists which CI job runs each check.