ci: Use reusable workflow instead of bash-generated yamls (leanprover-community#34590)

- Replace bash‑generated CI workflows with a [reusable workflow](https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows) template (build_template.yml) and thin callers (build.yml, bors.yml, build_fork.yml).
- Remove generator script and its actionlint check; update dependabot scope accordingly.
- Move caller‑specific if conditions to the top‑level jobs

Author: marcelolynch

.github/dependabot.yml

@@ -3,13 +3,13 @@ version: 2  # Specifies the version of the Dependabot configuration file format
 updates:
   # Configuration for dependency updates
   - package-ecosystem: "github-actions"  # Specifies the ecosystem to check for updates
-    directories: 
-      - "/.github/*" # covers `build.in.yml` as well, which is not in `.github/workflows/` because it shouldn't be run in CI.
+    directories:
+      - "/.github/workflows"
     schedule:
       # Check for updates to GitHub Actions every month
       interval: "monthly"
     groups:
-      # group updates into single PRs since we want to update both build.in.yml and its outputs at the same time
+      # group updates into single PRs
       actions-version-updates:
         applies-to: version-updates
         patterns:

.github/workflows/actionlint.yml

@@ -17,20 +17,3 @@ jobs:
         with:
           tool_name: actionlint
           fail_level: error
-
-  check_build_yml:
-    name: check workflows generated by build.in.yml
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: update workflows
-        run: |
-          cd .github/workflows/
-          ./mk_build_yml.sh
-
-      - name: suggester / build.in.yml
-        uses: reviewdog/action-suggester@aa38384ceb608d00f84b4690cacc83a5aba307ff # v1.24.0
-        with:
-          tool_name: mk_build_yml.sh
-          fail_level: error

.github/workflows/bors.yml

@@ -1,8 +1,21 @@
-### NB: This is the master file for autogenerating
-### NB: `.github/workflows/{bors, build_fork, build}.yml`.
-### NB: If you need to edit any of those files, you should edit this file instead,
-### NB: and regenerate those files by manually running
-### NB: .github/workflows/mk_build_yml.sh
+# Reusable workflow invoked by build.yml, bors.yml, and build_fork.yml.
+
+on:
+  workflow_call:
+    inputs:
+      concurrency_group:
+        type: string
+        required: true
+      pr_branch_ref:
+        type: string
+        required: true
+      job_name_suffix:
+        type: string
+        required: false
+        default: ""
+      runs_on:
+        type: string
+        required: true
 
 env:
   # Disable Lake's automatic fetching of cloud builds.
@@ -12,24 +25,10 @@ env:
   # not necessarily satisfy this property.
   LAKE_NO_CACHE: true
 
-concurrency:
-  # label each workflow run; only the latest with each label will run
-  # workflows on master get more expressive labels
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ (github.event_name == 'push' && contains(fromJSON('["refs/heads/master", "refs/heads/staging"]'), github.ref) && github.run_id) || '' }}
-  # cancel any running workflow with the same label
-  cancel-in-progress: true
-
-# Limit permissions for GITHUB_TOKEN for the entire workflow
-permissions:
-  contents: read
-  pull-requests: write  # Only allow PR comments/labels
-  # All other permissions are implicitly 'none'
-
 jobs:
   build:
-    if: FORK_CONDITION
-    name: BuildJOB_NAME
-    runs-on: RUNS_ON
+    name: Build${{ inputs.job_name_suffix }}
+    runs-on: ${{ inputs.runs_on }}
     outputs:
       build-outcome: ${{ steps.build.outcome }}
       archive-outcome: ${{ steps.archive.outcome }}
@@ -51,7 +50,7 @@ jobs:
           REF: ${{ github.ref }}
           EVENT_NAME: ${{ github.event_name }}
           RUN_ID: ${{ github.run_id }}
-          CONCURRENCY_GROUP: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ (github.event_name == 'push' && contains(fromJSON('["refs/heads/master", "refs/heads/staging"]'), github.ref) && github.run_id) || '' }}
+          CONCURRENCY_GROUP: ${{ inputs.concurrency_group }}
         shell: bash # there is no script body, so this is safe to "run" outside landrun.
         run: |
           # We just populate the env vars for this step to make them viewable in the logs
@@ -90,7 +89,7 @@ jobs:
       - name: Checkout PR branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: "${{ PR_BRANCH_REF }}"
+          ref: ${{ inputs.pr_branch_ref }}
           path: pr-branch
 
       - name: Prepare DownstreamTest directory
@@ -591,15 +590,14 @@ jobs:
           master-branch/scripts/lean-pr-testing-comments.sh batteries
 
   post_steps:
-    name: Post-Build StepJOB_NAME
-    if: FORK_CONDITION
+    name: Post-Build Step${{ inputs.job_name_suffix }}
     needs: [build]
     runs-on: ubuntu-latest # Note these steps run on disposable GitHub runners, so no landrun sandboxing is needed.
     steps:
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: "${{ PR_BRANCH_REF }}"
+          ref: ${{ inputs.pr_branch_ref }}
 
       - name: Configure Lean
         uses: leanprover/lean-action@c544e89643240c6b398f14a431bcdc6309e36b3e # v1.4.0
@@ -671,19 +669,17 @@ jobs:
       # We no longer run `lean4checker` in regular CI, as it is quite expensive for little benefit.
       # Instead we run it in a cron job on master: see `daily.yml`.
   style_lint:
-    name: Lint styleJOB_NAME
-    if: FORK_CONDITION
+    name: Lint style${{ inputs.job_name_suffix }}
     runs-on: ubuntu-latest
     steps:
       - uses: leanprover-community/lint-style-action@a7e7428fa44f9635d6eb8e01919d16fd498d387a # 2025-08-18
         with:
           mode: check
           lint-bib-file: true
-          ref: ${{ PR_BRANCH_REF }}
+          ref: ${{ inputs.pr_branch_ref }}
 
   final:
-    name: Post-CI jobJOB_NAME
-    if: FORK_CONDITION
+    name: Post-CI job${{ inputs.job_name_suffix }}
     needs: [style_lint, build, post_steps]
     runs-on: ubuntu-latest
     steps:

.github/workflows/build.yml

@@ -1,4 +1,4 @@
-status = ["Build", "Lint style", "Post-Build Step"]
+status = ["build / Build", "build / Lint style", "build / Post-Build Step"]
 use_squash_merge = true
 timeout_sec = 7200
 block_labels = ["WIP", "blocked-by-other-PR", "merge-conflict", "awaiting-CI"]