Run nix fmt and fix workflow formatting

.github/renovate.json

@@ -0,0 +1 @@
+{"$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": ["config:best-practices", "security:openssf-scorecard"], "mix": {"enabled": true}, "nix": {"enabled": true}, "npm": {"enabled": true}, "postUpgradeTasks": {"nixFmt": {"commands": ["nix", "fmt"], "installTools": {"nix": {}}}}, "uv": {"enabled": true}}

.github/workflows/cleanup.yaml

@@ -1,32 +1,25 @@
+name: Cleanup
+permissions:
+  contents: read
+"on":
+  pull_request:
+    types:
+      - closed
 jobs:
   cleanup:
-    runs-on: ubuntu-latest
+    if: ${{ github.event.pull_request.head.repo.fork == false }}
+    runs-on: ubuntu-slim
     steps:
       - id: createGithubAppToken
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ vars.OPERATOR_APP_ID }}
+          permission-contents: write
           private-key: ${{ secrets.OPERATOR_PRIVATE_KEY }}
-      - uses: actions/checkout@v6
+      - uses: shikanime-studio/actions/nix/setup@v9
         with:
-          fetch-depth: 0
-          token: ${{ steps.createGithubAppToken.outputs.token }}
-      - env:
-          BASE_REF: ${{ github.base_ref }}
-          GITHUB_TOKEN: ${{ steps.createGithubAppToken.outputs.token }}
-          HEAD_REF: ${{ github.head_ref }}
-          REPO: ${{ github.repository }}
-        if: '!(startsWith(github.head_ref, ''gh/'') && endsWith(github.head_ref, ''/head''))'
-        run: git push origin --delete "$HEAD_REF"
-      - env:
-          BASE_REF: ${{ github.base_ref }}
-          GITHUB_TOKEN: ${{ steps.createGithubAppToken.outputs.token }}
-          HEAD_REF: ${{ github.head_ref }}
-          REPO: ${{ github.repository }}
-        if: startsWith(github.head_ref, 'gh/') && endsWith(github.head_ref, '/head')
-        run: "for role in base head orig; do\n  git push origin --delete \"${HEAD_REF%/head}/$role\" || true\ndone\n"
-name: Cleanup
-'on':
-  pull_request:
-    types:
-      - closed
+          github-token: ${{ steps.createGithubAppToken.outputs.token }}
+      - uses: shikanime-studio/actions/cleanup@v9
+        with:
+          github-token: ${{ steps.createGithubAppToken.outputs.token }}
+          pull-request-url: ${{ github.event.pull_request.html_url }}

.github/workflows/commands.yaml

@@ -0,0 +1,118 @@
+name: Commands
+permissions:
+  contents: read
+"on":
+  issue_comment:
+    types:
+      - created
+jobs:
+  backport:
+    if: github.event.issue.pull_request != null && contains(github.event.comment.body, '.backport')
+    runs-on: ubuntu-slim
+    steps:
+      - id: createGithubAppToken
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.OPERATOR_APP_ID }}
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
+          permission-workflows: write
+          private-key: ${{ secrets.OPERATOR_PRIVATE_KEY }}
+      - uses: shikanime-studio/actions/nix/setup@v9
+        with:
+          github-token: ${{ steps.createGithubAppToken.outputs.token }}
+      - uses: shikanime-studio/actions/command/backport@v9
+        with:
+          github-token: ${{ steps.createGithubAppToken.outputs.token }}
+          gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          sign-commits: true
+  close:
+    if: github.event.issue.pull_request != null && contains(github.event.comment.body, '.close')
+    runs-on: ubuntu-slim
+    steps:
+      - id: createGithubAppToken
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.OPERATOR_APP_ID }}
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
+          private-key: ${{ secrets.OPERATOR_PRIVATE_KEY }}
+      - uses: shikanime-studio/actions/nix/setup@v9
+        with:
+          github-token: ${{ steps.createGithubAppToken.outputs.token }}
+      - uses: shikanime-studio/actions/command/close@v9
+        with:
+          github-token: ${{ steps.createGithubAppToken.outputs.token }}
+          username: operator6o
+  land:
+    if: github.event.issue.pull_request != null && (contains(github.event.comment.body, '.land') || contains(github.event.comment.body, '.force-land'))
+    runs-on: ubuntu-slim
+    steps:
+      - id: createGithubAppToken
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.OPERATOR_APP_ID }}
+          permission-administration: read
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
+          permission-workflows: write
+          private-key: ${{ secrets.OPERATOR_PRIVATE_KEY }}
+      - uses: shikanime-studio/actions/nix/setup@v9
+        with:
+          github-token: ${{ steps.createGithubAppToken.outputs.token }}
+      - uses: shikanime-studio/actions/command/land@v9
+        with:
+          email: operator6o@shikanime.studio
+          fullname: Operator 6O
+          github-token: ${{ steps.createGithubAppToken.outputs.token }}
+          gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          sign-commits: true
+          username: operator6o
+  rebase:
+    if: github.event.issue.pull_request != null && contains(github.event.comment.body, '.rebase')
+    runs-on: ubuntu-slim
+    steps:
+      - id: createGithubAppToken
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.OPERATOR_APP_ID }}
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
+          permission-workflows: write
+          private-key: ${{ secrets.OPERATOR_PRIVATE_KEY }}
+      - uses: shikanime-studio/actions/nix/setup@v9
+        with:
+          github-token: ${{ steps.createGithubAppToken.outputs.token }}
+      - uses: shikanime-studio/actions/command/rebase@v9
+        with:
+          email: operator6o@shikanime.studio
+          fullname: Operator 6O
+          github-token: ${{ steps.createGithubAppToken.outputs.token }}
+          gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          sign-commits: true
+          username: operator6o
+  run:
+    if: github.event.issue.pull_request != null && contains(github.event.comment.body, '.run')
+    runs-on: ubuntu-slim
+    steps:
+      - id: createGithubAppToken
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.OPERATOR_APP_ID }}
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
+          private-key: ${{ secrets.OPERATOR_PRIVATE_KEY }}
+      - uses: shikanime-studio/actions/nix/setup@v9
+        with:
+          github-token: ${{ steps.createGithubAppToken.outputs.token }}
+      - uses: shikanime-studio/actions/command/run@v9
+        with:
+          github-token: ${{ steps.createGithubAppToken.outputs.token }}

.github/workflows/integration.yaml

@@ -0,0 +1,37 @@
+name: Integration
+permissions:
+  contents: read
+jobs:
+  javascript:
+    if: ${{ github.event_name == 'workflow_call' || github.event_name == 'workflow_dispatch' || github.event.pull_request.draft == false }}
+    secrets:
+      OPERATOR_PRIVATE_KEY: ${{ secrets.OPERATOR_PRIVATE_KEY }}
+    uses: ./.github/workflows/javascript.yaml
+  nix:
+    if: ${{ github.event_name == 'workflow_call' || github.event_name == 'workflow_dispatch' || github.event.pull_request.draft == false }}
+    permissions:
+      contents: read
+      packages: write
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      OPERATOR_PRIVATE_KEY: ${{ secrets.OPERATOR_PRIVATE_KEY }}
+    uses: ./.github/workflows/nix.yaml
+    with:
+      cachix-name: shikanime
+"on":
+  pull_request:
+    branches:
+      - main
+      - gh/*/*/base
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+  workflow_call:
+    secrets:
+      CACHIX_AUTH_TOKEN:
+        required: false
+      OPERATOR_PRIVATE_KEY:
+        required: true
+  workflow_dispatch: {}

.github/workflows/javascript.yaml

@@ -0,0 +1,54 @@
+name: JavaScript
+permissions:
+  contents: read
+"on":
+  workflow_call:
+    secrets:
+      OPERATOR_PRIVATE_KEY:
+        required: true
+  workflow_dispatch: {}
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - id: createGithubAppToken
+        continue-on-error: true
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.OPERATOR_APP_ID }}
+          permission-contents: read
+          private-key: ${{ secrets.OPERATOR_PRIVATE_KEY }}
+      - uses: shikanime-studio/actions/checkout@v9
+        with:
+          github-token: ${{ steps.createGithubAppToken.outputs.token || secrets.GITHUB_TOKEN }}
+      - uses: shikanime-studio/actions/nix/setup@v9
+        with:
+          github-token: ${{ steps.createGithubAppToken.outputs.token || secrets.GITHUB_TOKEN }}
+      - id: direnv
+        uses: shikanime-studio/actions/direnv@v9
+      - env: ${{ fromJSON(steps.direnv.outputs.env) }}
+        uses: shikanime-studio/actions/pnpm/integration@v9
+  build-workspace:
+    name: Build (Workspace)
+    runs-on: ubuntu-latest
+    steps:
+      - id: createGithubAppToken
+        continue-on-error: true
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.OPERATOR_APP_ID }}
+          permission-contents: read
+          private-key: ${{ secrets.OPERATOR_PRIVATE_KEY }}
+      - uses: shikanime-studio/actions/checkout@v9
+        with:
+          github-token: ${{ steps.createGithubAppToken.outputs.token || secrets.GITHUB_TOKEN }}
+      - uses: shikanime-studio/actions/nix/setup@v9
+        with:
+          github-token: ${{ steps.createGithubAppToken.outputs.token || secrets.GITHUB_TOKEN }}
+      - id: direnv
+        uses: shikanime-studio/actions/direnv@v9
+      - env: ${{ fromJSON(steps.direnv.outputs.env) }}
+        uses: shikanime-studio/actions/pnpm/integration@v9
+        with:
+          recursive: true