SRE-1079: Use hashintel/actions for shared workflows and Renovate preset

[claude]

Requested by Tim Diekmann · Slack thread

Before: brunch called its reusable workflows from hashintel/.github at db03b98, extended the Renovate preset github>hashintel/.github:renovate-config, and ran the housekeeping (Renovate) workflow every two hours.

After: the reusable workflows come from hashintel/actions at 66c8121, Renovate extends github>hashintel/actions:renovate-config, and housekeeping runs once a day at 03:00 UTC, the same as hashintel/hash. This moves brunch onto the setup hashintel/internal-infra#374 already runs.

How

• uses: refs now point to hashintel/actions/.github/workflows/<name>.yml@66c812140c0f8f4a215c5f54dce5b40b476337d8 # main for preflight-dependencies, preflight-pr-title, preflight-todo-comments, preflight-actionlint and housekeeping-dependencies. Each of the five files is byte-identical to its hashintel/.github@db03b98 counterpart, so the inputs and secrets the callers pass are unchanged.
• .github/renovate.json extends github>hashintel/actions:renovate-config. That preset also lists hashintel/actions in the rule that hashintel/.github covered before, so Renovate keeps these pins up to date.
• housekeeping.yml schedule: 0 */2 * * * → 0 3 * * *. The staging Vault ci-renovate role already accepts the hashintel/actions housekeeping workflow path.
• No docs in the repo name hashintel/.github, so none changed.

Checked locally: actionlint on the three changed workflows, renovate-config-validator (renovate 44.34.3) and jq empty on .github/renovate.json.

🤖 Generated with Claude Code

https://claude.ai/code/session_012vhP8cbLCbnWdQP7LLFB5A

[cursor]

PR Summary

Low Risk
CI wiring and Renovate schedule only; reusable workflow contracts are unchanged per the PR description.

Overview
Moves brunch’s shared CI and Renovate setup from hashintel/.github to hashintel/actions, aligning with hashintel/hash and internal-infra.

Renovate now extends github>hashintel/actions:renovate-config. Preflight and housekeeping jobs call the same reusable workflows from hashintel/actions at commit 66c8121 instead of hashintel/.github at db03b98; caller inputs and secrets are unchanged.

Housekeeping (Renovate) schedule changes from every two hours (0 */2 * * *) to once daily at 03:00 UTC (0 3 * * *).

^{Reviewed by Cursor Bugbot for commit c284a83. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit c284a83. Configure here.}

[cursor]

Public repo cannot call private workflows

High Severity

Brunch is public, but the new uses refs point at hashintel/actions, which is not a public hashintel repo. GitHub blocks public callers from running reusable workflows in private or internal repositories, so these preflight and housekeeping jobs fail to start. The previous hashintel/.github source was public.

Additional Locations (2)

• .github/workflows/preflight-target.yml#L18-L25
• .github/workflows/housekeeping.yml#L67-L68

 

^{Reviewed by Cursor Bugbot for commit c284a83. Configure here.}