From ed18fae8f609d6e8dd20b051a0c74ebd234a488e Mon Sep 17 00:00:00 2001
From: Mablr <59505383+mablr@users.noreply.github.com>
Date: Mon, 13 Jul 2026 11:51:04 +0200
Subject: [PATCH] ci: use shared PR audit workflow

---
 .github/workflows/pr-audit.yml | 45 +++++++++++-----------------------
 1 file changed, 14 insertions(+), 31 deletions(-)

diff --git a/.github/workflows/pr-audit.yml b/.github/workflows/pr-audit.yml
index b2a7d63..53c4274 100644
--- a/.github/workflows/pr-audit.yml
+++ b/.github/workflows/pr-audit.yml
@@ -4,13 +4,14 @@ on:
   pull_request:
     types: [labeled]
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
-  publish:
+  authorize:
+    if: github.event.label.name == 'cyclops'
     runs-on: ubuntu-latest
-    if: github.event.action == 'labeled' && github.event.label.name == 'cyclops'
+    permissions:
+      contents: read
     steps:
       - name: Check admin permission
         env:
@@ -24,30 +25,12 @@ jobs:
             exit 1
           fi
 
-      - name: Publish event
-        env:
-          EVENTS_KEY: ${{ secrets.EVENTS_KEY }}
-          EVENTS_CERT: ${{ secrets.EVENTS_CERT }}
-          EVENTS_ARGS: ${{ secrets.EVENTS_ARGS }}
-          REPOSITORY: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          PR_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          set -euo pipefail
-
-          echo "$EVENTS_KEY" > "$RUNNER_TEMP/key"
-          echo "$EVENTS_CERT" > "$RUNNER_TEMP/cert"
-
-          read -r -a events_args <<< "${EVENTS_ARGS:-}"
-          curl -sf -o /dev/null -X POST "${events_args[@]}" \
-            -H "Content-Type: application/json" \
-            --key "$RUNNER_TEMP/key" \
-            --cert "$RUNNER_TEMP/cert" \
-            -d "{
-              \"repository\": \"${REPOSITORY}\",
-              \"event\": \"pr_audit\",
-              \"data\": {
-                \"pr_number\": ${PR_NUMBER},
-                \"sha\": \"${PR_SHA}\"
-              }
-            }"
+  pr-audit:
+    needs: authorize
+    permissions:
+      contents: read
+    uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@98b1081dcf34361b576aca2ab3041772708582ef
+    secrets:
+      EVENTS_KEY: ${{ secrets.EVENTS_KEY }}
+      EVENTS_CERT: ${{ secrets.EVENTS_CERT }}
+      EVENTS_ARGS: ${{ secrets.EVENTS_ARGS }}