Use the shared release and CI workflows

[akashlevy]

Summary

• Replaces the hand-rolled three-platform release and the CMake test matrix with calls into the new Silimate/actions reusable workflows: 283 lines removed.
• release.yml 271 lines down to 38, test.yml 32 down to 20.

Behaviour changes

• macOS bundling is now the same fixed-point implementation used across the org, and it re-signs after install_name_tool rewrites load paths. The previous version copied dylibs but never re-signed, which leaves arm64 binaries that macOS refuses to run.
• Ninja still comes from the upstream GitHub release on CentOS 7 rather than EPEL (which is archived alongside CentOS 7), but that is now the shared with-ninja input rather than an inline curl plus a Python one-liner to unzip.
• New smoke test unpacks each tarball to a throwaway prefix and runs prunefl --version.
• Pull requests build and smoke-test all three platforms without publishing.
• ctest now runs with --output-on-failure.

Test plan

• This PR's own run builds anylinux, manylinux2014 and macOS and passes the smoke test on each
• test.yml passes on ubuntu-24.04 and macos-15
• Compare tar tzf of the produced artifacts against the current latest release assets

Made with Cursor

[greptile-apps]

Greptile Summary

This PR replaces the repository's inline release packaging and CMake CI implementations with organization-wide reusable workflows.

• Adds build-and-smoke-test release runs for pull requests while retaining publication for main and manual runs.
• Adds optional draft publication and shared native tarball packaging across Linux and macOS.
• Moves the two-platform CMake test matrix to the shared C++ CI workflow.
• Leaves the privileged release workflow referenced through a mutable major-version tag.

Confidence Score: 4/5

The PR appears safe to merge, with the non-blocking recommendation to pin the write-privileged release workflow to an immutable reviewed commit.

The event expressions correctly disable publication for pull requests and default draft mode off, while the only accepted concern is the supply-chain exposure created by resolving privileged workflow code through a mutable v1 tag.

Files Needing Attention: .github/workflows/release.yml

Security Review

The release job grants repository write authority to workflow code resolved through mutable reference Silimate/actions/...@v1. Pinning the reusable workflow to a reviewed commit would prevent upstream tag movement from silently changing privileged code.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Replaces local cross-platform packaging and release logic with a shared reusable workflow; the privileged call should be pinned immutably.
.github/workflows/test.yml	Replaces the inline Ubuntu/macOS CMake matrix with the shared C++ CI workflow while retaining the existing runner and generator choices.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  E{Workflow event} -->|Pull request| R[Shared native tarball workflow]
  E -->|Push to main| R
  E -->|Manual dispatch| R
  R --> B[Build three platform tarballs]
  B --> S[Unpack and smoke-test prunefl]
  S --> P{publish input}
  P -->|false| N[Do not publish]
  P -->|true| D{draft input}
  D -->|false| L[Publish release and update latest]
  D -->|true| DR[Publish draft and preserve latest]
  T[Push event] --> C[Shared CMake CI workflow]
  C --> U[Ubuntu 24.04 build and tests]
  C --> M[macOS 15 build and tests]

Loading

_{Reviews (1): Last reviewed commit: "Use the shared release and CI workflows" | Re-trigger Greptile}