ci: adopt shared CI tooling (#193)

* ci: adopt shared CI tooling

* ci: clarify lint workflow naming

Author: bytaesu

.cspell.jsonc

@@ -11,6 +11,7 @@
 		"changelogithub",
 		"elif",
 		"nvmrc",
+		"zizmor",
 
 		// auth words
 		"scim",

.github/workflows/ci.yml

@@ -11,24 +11,19 @@ on:
             - v*.x
     merge_group: {}
 
+permissions:
+    contents: read
+
 jobs:
     test:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                     fetch-depth: 0
+                    persist-credentials: false
 
-            - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
-            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-              with:
-                node-version-file: '.nvmrc'
-                registry-url: 'https://registry.npmjs.org'
-                cache: pnpm
-
-            - name: Install
-              run: pnpm install
+            - uses: better-auth/shared-workflows/.github/actions/setup-pnpm@08e5520e7a829b03bee1152913682b67d2ba44b1
 
             - name: Build
               run: pnpm build

.github/workflows/lint-github-actions.yml

@@ -0,0 +1,37 @@
+name: Lint GitHub Actions
+
+on:
+  pull_request:
+    paths:
+      - ".github/actions/**"
+      - ".github/workflows/**"
+      - ".github/zizmor.yml"
+  push:
+    branches: [main]
+    paths:
+      - ".github/actions/**"
+      - ".github/workflows/**"
+      - ".github/zizmor.yml"
+
+permissions: {}
+
+jobs:
+  lint:
+    permissions:
+      contents: read
+    uses: better-auth/shared-workflows/.github/workflows/lint-github-actions.yml@08e5520e7a829b03bee1152913682b67d2ba44b1
+
+  zizmor:
+    if: github.event_name == 'pull_request'
+    permissions:
+      actions: read
+      contents: read
+    uses: better-auth/shared-workflows/.github/workflows/zizmor.yml@08e5520e7a829b03bee1152913682b67d2ba44b1
+
+  zizmor-code-scanning:
+    if: github.event_name == 'push'
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: better-auth/shared-workflows/.github/workflows/zizmor-code-scanning.yml@08e5520e7a829b03bee1152913682b67d2ba44b1

.github/workflows/preview.yml

@@ -1,6 +1,9 @@
 name: Publish Any Commit
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -9,19 +12,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version-file: '.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
-          cache: pnpm
-
-      - name: Install
-        run: pnpm install
+      - uses: better-auth/shared-workflows/.github/actions/setup-pnpm@08e5520e7a829b03bee1152913682b67d2ba44b1
 
       - name: Build
         run: pnpm build
 
-      - run: pnpm dlx pkg-pr-new publish './packages/better-call'
+      - run: pnpm exec pkg-pr-new publish './packages/better-call'

.github/zizmor.yml

@@ -0,0 +1,5 @@
+rules:
+  use-trusted-publishing:
+    ignore:
+      # pkg.pr.new publishes preview packages to its own npm-compatible registry.
+      - preview.yml

package.json

@@ -26,6 +26,7 @@
 		"cspell": "^10.0.1",
 		"knip": "^6.29.0",
 		"lefthook": "^2.1.10",
+		"pkg-pr-new": "0.0.88",
 		"publint": "^0.3.22",
 		"tinyglobby": "^0.2.17",
 		"tsdown": "0.22.14",