feat(workflows): use-workflow_call-events

.flake8

@@ -3,4 +3,5 @@ filename =
     *.py
 max-line-length = 120
 extend-exclude =
+    .venv/
     venv/

.github/semantic.yml

@@ -12,3 +12,4 @@ titleAndCommits: false
 anyCommit: false
 allowMergeCommits: false
 allowRevertCommits: false
+targetUrl: https://docs.lizardbyte.dev/latest/developers/contributing.html#creating-a-pull-request

.github/workflows/README.md

@@ -0,0 +1,11 @@
+# LizardByte org workflows
+
+Files prefixed with `__` are only used in the `.github` repository and not replicated to other repositories;
+however some of they may be called from other workflows.
+
+Workflows that can be called from other repositories are prefixed with `__call-` and are not replicated
+to other repositories. They also have an accompanying workflow named `_<name>.yml` that is replicated to the
+respective repositories.
+
+Workflows that prefixed with a single `_` are replicated to other repositories and this indicates
+that the workflow should not be modified when inside the other repositories.

.github/workflows/codeql.yml → .github/workflows/__call-codeql.yml

@@ -1,27 +1,19 @@
 ---
-# This workflow is centrally managed in https://github.com/<organization>/.github/
-# Don't make changes to this file in this repo as they will be overwritten with changes made to the same file in
-# the above-mentioned repo.
-
 # This workflow will analyze all supported languages in the repository using CodeQL Analysis.
 
-name: "CodeQL"
+name: CodeQL (called)
 permissions:
   contents: read
 
 on:
-  push:
-    branches:
-      - master
   pull_request:
     branches:
       - master
-  schedule:
-    - cron: '00 12 * * 0'  # every Sunday at 12:00 UTC
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-  cancel-in-progress: true
+    types:
+      - opened
+      - synchronize
+      - reopened
+  workflow_call:
 
 jobs:
   languages:

.github/workflows/common-lint.yml → .github/workflows/__call-common-lint.yml

@@ -1,11 +1,8 @@
 ---
-# This workflow is centrally managed in https://github.com/<organization>/.github/
-# Don't make changes to this file in this repo as they will be overwritten with changes made to the same file in
-# the above-mentioned repo.
+# This workflow will lint the code in the repository using various tools. Most linting tools in LizardByte
+# should be included in this workflow; however there are cases where that is not true, such as with eslint.
 
-# Common linting.
-
-name: common lint
+name: common lint (called)
 permissions:
   contents: read
 
@@ -17,10 +14,7 @@ on:
       - opened
       - synchronize
       - reopened
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-  cancel-in-progress: true
+  workflow_call:
 
 jobs:
   lint:

.github/workflows/ci-docker.yml → .github/workflows/__call-docker.yml

@@ -1,8 +1,4 @@
 ---
-# This workflow is centrally managed in https://github.com/<organization>/.github/
-# Don't make changes to this file in this repo as they will be overwritten with changes made to the same file in
-# the above-mentioned repo.
-
 # This workflow is intended to work with all our organization Docker projects. A readme named `DOCKER_README.md`
 # will be used to update the description on Docker hub.
 
@@ -18,7 +14,7 @@
 #    `true` to build in two steps, stopping at `artifacts` build stage and extracting the image from there to the
 #    GitHub runner.
 
-name: CI Docker
+name: Docker (called)
 permissions:
   contents: read
 
@@ -30,14 +26,23 @@ on:
       - opened
       - synchronize
       - reopened
-  push:
-    branches:
-      - master
-  workflow_dispatch:
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-  cancel-in-progress: true
+  workflow_call:
+    secrets:
+      DOCKER_HUB_USERNAME:
+        description: 'Docker Hub username to use for the workflow.'
+        required: false
+      DOCKER_HUB_ACCESS_TOKEN:
+        description: 'Docker Hub access token to use for the workflow.'
+        required: false
+      GH_BOT_NAME:
+        description: 'GitHub bot name to use for the workflow.'
+        required: false
+      GH_BOT_TOKEN:
+        description: 'GitHub bot token to use for the workflow.'
+        required: false
+      GH_TOKEN:
+        description: 'GitHub token to use for the workflow.'
+        required: false
 
 jobs:
   check_dockerfiles:
@@ -126,7 +131,7 @@ jobs:
         uses: LizardByte/setup-release-action@v2025.426.225
         with:
           dotnet: ${{ needs.check_dockerfiles.outputs.dotnet }}
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ secrets.GH_TOKEN }}
 
   docker:
     name: Docker${{ matrix.tag }}

.github/workflows/release-notifier.yml → .github/workflows/__call-release-notifier.yml

@@ -1,18 +1,14 @@
 ---
-# This workflow is centrally managed in https://github.com/<organization>/.github/
-# Don't make changes to this file in this repo as they will be overwritten with changes made to the same file in
-# the above-mentioned repo.
-
-# Create a blog post for a new release and open a PR to the blog repo
-
-name: Release Notifications
+name: Release Notifications (called)
 permissions:
   contents: read
 
 on:
-  release:
-    types:
-      - released  # this triggers when a release is published, but does not include pre-releases or drafts
+  workflow_call:
+    secrets:
+      GH_TOKEN:
+        description: 'GitHub token to use for the workflow.'
+        required: true
 
 jobs:
   update-blog:
@@ -111,7 +107,7 @@ jobs:
           steps.check-release.outputs.isLatestRelease == 'true'
         uses: peter-evans/create-pull-request@v7
         with:
-          token: ${{ secrets.GH_BOT_TOKEN }}
+          token: ${{ secrets.GH_TOKEN }}
           commit-message: |
             chore: Add blog post for ${{ github.event.repository.name }} release ${{ github.event.release.tag_name }}
           branch: bot/add-${{ github.event.repository.name }}-${{ github.event.release.tag_name }}
@@ -124,7 +120,7 @@ jobs:
 
       - name: Automerge PR
         env:
-          GH_TOKEN: ${{ secrets.GH_BOT_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
         if: >-
           steps.check-label.outputs.hasTopic == 'true' &&
           steps.check-release.outputs.isLatestRelease == 'true'

.github/workflows/__call-update-changelog.yml

@@ -0,0 +1,25 @@
+---
+# Update changelog on release events.
+
+name: Update changelog (called)
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    secrets:
+      GH_TOKEN:
+        description: 'GitHub token to use for the workflow.'
+        required: true
+
+jobs:
+  update-changelog:
+    name: Update Changelog
+    runs-on: ubuntu-latest
+    steps:
+      - name: Update Changelog
+        uses: LizardByte/update-changelog-action@v2025.426.173858
+        with:
+          changelogBranch: changelog
+          changelogFile: CHANGELOG.md
+          token: ${{ secrets.GH_TOKEN }}

.github/workflows/update-docs.yml → .github/workflows/__call-update-docs.yml

@@ -1,32 +1,24 @@
 ---
-# This workflow is centrally managed in https://github.com/<organization>/.github/
-# Don't make changes to this file in this repo as they will be overwritten with changes made to the same file in
-# the above-mentioned repo.
-
-# To use, add the `rtd` repository label to identify repositories that should trigger this workflow.
-# If the project slug is not the repository name, add a repository variable named `READTHEDOCS_SLUG` with the value of
-# the ReadTheDocs project slug.
-
-# Update readthedocs on release events.
-
-name: Update docs
+name: Update docs (called)
 permissions: {}
 
 on:
-  release:
-    types:
-      - created
-      - edited
-      - deleted
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.event.release.tag_name }}"
-  cancel-in-progress: true
+  workflow_call:
+    inputs:
+      readthedocs_slug:
+        description: 'Read the Docs project slug (defaults to repository name in lowercase)'
+        required: false
+        type: string
+        default: ''
+    secrets:
+      READTHEDOCS_TOKEN:
+        description: 'Read the Docs API token with write access to the project'
+        required: true
 
 jobs:
   update-docs:
     env:
-      RTD_SLUG: ${{ vars.READTHEDOCS_SLUG }}
+      RTD_SLUG: ${{ inputs.READTHEDOCS_SLUG }}
       RTD_TOKEN: ${{ secrets.READTHEDOCS_TOKEN }}
       TAG: ${{ github.event.release.tag_name }}
     if: >-

.github/workflows/update-flathub-repo.yml → .github/workflows/__call-update-flathub-repo.yml

@@ -1,33 +1,22 @@
 ---
-# This workflow is centrally managed in https://github.com/<organization>/.github/
-# Don't make changes to this file in this repo as they will be overwritten with changes made to the same file in
-# the above-mentioned repo.
-
-# To use, add the `flathub-pkg` repository label to identify repositories that should trigger this workflow.
-
-# Update Flathub on release events.
-
-name: Update flathub repo
+name: Update Flathub repo (called)
 permissions:
   contents: read
 
 on:
-  release:
-    types:
-      - released
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.event.release.tag_name }}"
-  cancel-in-progress: true
+  workflow_call:
+    secrets:
+      GH_TOKEN:
+        description: 'GitHub token to use for the workflow.'
+        required: true
 
 jobs:
   update-flathub-repo:
     env:
       FLATHUB_PKG: dev.lizardbyte.app.${{ github.event.repository.name }}
-    if: github.repository_owner == 'LizardByte'
     runs-on: ubuntu-latest
     steps:
-      - name: Check if flathub repo
+      - name: Check if Flathub repo
         id: check-label
         env:
           TOPIC: flathub-pkg
@@ -164,7 +153,7 @@ jobs:
         uses: peter-evans/create-pull-request@v7
         with:
           path: "flathub/${{ env.FLATHUB_PKG }}"
-          token: ${{ secrets.GH_BOT_TOKEN }}
+          token: ${{ secrets.GH_TOKEN }}
           commit-message: "chore: Update ${{ env.FLATHUB_PKG }} to ${{ github.event.release.tag_name }}"
           branch: bot/bump-${{ env.FLATHUB_PKG }}-${{ github.event.release.tag_name }}
           delete-branch: true
@@ -173,7 +162,7 @@ jobs:
 
       - name: Automerge PR
         env:
-          GH_TOKEN: ${{ secrets.GH_BOT_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
         if: >-
           steps.check-label.outputs.hasTopic == 'true' &&
           steps.check-release.outputs.isLatestRelease == 'true' &&