♻️ use shared workflow linter

.github/workflows/_static-analysis.yml

@@ -10,12 +10,11 @@ jobs:
   static-check:
     name: Run Static Analysis
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: ["3.12"]
     steps:
     - uses: actions/checkout@v7
       with:
+        # Betterleaks scans git history across refs, so it needs the full
+        # history rather than the default shallow clone.
         fetch-depth: 0
 
     - name: Run Betterleaks
@@ -25,24 +24,27 @@ jobs:
       uses: dortort/betterleaks-action@cd0b905aa4befb8f42f8b1ab98150180c9e77515
       with:
         version: "v1.9.0"
+        report-path: betterleaks-report.sarif
         github-token: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Upload Betterleaks report
-      if: always()
       uses: actions/upload-artifact@v7
+      if: always()
       with:
         name: betterleaks-report
-        path: betterleaks-report.sarif
         if-no-files-found: warn
+        path: ${{ steps.betterleaks.outputs.report-path }}
 
     - name: Fail if Betterleaks found leaks
       if: steps.betterleaks.outcome == 'failure'
-      run: exit 1
+      run: |
+        echo "Betterleaks reported a failure in at least one scan."
+        exit 1
 
-    - name: Set up Python ${{ matrix.python-version }}
+    - name: Set up Python
       uses: actions/setup-python@v7
       with:
-        python-version: ${{ matrix.python-version }}
+        python-version: "3.12"
 
     - name: Cache dependencies
       uses: actions/cache@v6
@@ -71,6 +73,6 @@ jobs:
 
     - name: Run all static analysis
       env:
-        SKIP: sphinx-html,sphinx-linkcheck
+        SKIP: betterleaks,sphinx-html,sphinx-linkcheck
       run: |
         prek run --all-files

.github/workflows/pull-request.yml

@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   workflow-lint:
-    uses: ./.github/workflows/_workflow_lint.yml
+    uses: mindee/client-lib-actions/.github/workflows/workflow-lint.yml@main
   static-analysis:
     uses: ./.github/workflows/_static-analysis.yml
     needs: workflow-lint