fix(workflows): replace relative reusable paths with full org/repo refs

[YiWang24]

Summary

• GitHub Actions does not support the ./ relative path syntax for reusable workflows in subdirectories (reusable/)
• All 16 uses: ./.github/workflows/reusable/*.yml references replaced with uses: YiAgent/OpenCI/.github/workflows/reusable/*.yml@<SHA> (manifest-pinned SHA)
• Two BATS routing tests updated to match the new full-path format
• One pre-existing SC2016 shellcheck false positive suppressed (intentional grep BRE syntax)

Root Cause

GitHub's workflow parser rejects uses: ./.github/workflows/reusable/xxx.yml when the workflow is in a subdirectory, returning:

failed to parse workflow: invalid value workflow reference: workflows must be defined at the top level of the .github/workflows/ directory

This caused all affected workflows to display as file paths (.github/workflows/ci.yml) instead of their name: field values in the GitHub Actions UI.

Test Plan

• All pre-commit hooks pass (YAML lint, forbid-unpinned-actions, secrets scan)
• All pre-push hooks pass (actionlint, shellcheck, yamllint, verify-sha, 578 BATS tests)
• Verify workflow names display correctly in GitHub Actions sidebar after merge

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews

Summary by CodeRabbit

• Chores
  • Migrated CI/CD pipeline workflows to use upstream YiAgent/OpenCI reusable workflows pinned to commit d280a64 across all pipeline stages (agent, CI, deployments, documentation, issue operations, observability, and release).
  • Updated tests to reflect new workflow references.

[qodo-code-review]

ⓘ You've reached your Qodo monthly free-tier limit. Reviews pause until next month — upgrade your plan to continue now, or link your paid account if you already have one.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b0dbf4b4-1692-4d33-a01c-e444a7861191

📥 Commits

Reviewing files that changed from the base of the PR and between e166800 and 8b21871.

📒 Files selected for processing (12)

• .github/workflows/agent.yml
• .github/workflows/ci.yml
• .github/workflows/dependencies.yml
• .github/workflows/deploy.yml
• .github/workflows/docs.yml
• .github/workflows/issue-ops.yml
• .github/workflows/observability.yml
• .github/workflows/on-maintenance.yml
• .github/workflows/pull-request.yml
• .github/workflows/release.yml
• tests/actions/on-issue-routing.bats
• tests/actions/on-pr-routing.bats

---

📝 Walkthrough

Walkthrough

All local reusable workflow references across nine GitHub Actions workflows are switched to externally maintained workflows from the YiAgent/OpenCI repository, pinned to commit d280a64a392b7f1a3e906246286ca983e610f920. Corresponding test assertions are updated to expect the new external workflow references.

Changes

Reusable Workflow Externalization

Layer / File(s)	Summary
Workflow Configuration .github/workflows/agent.yml, ci.yml, dependencies.yml, deploy.yml, docs.yml, issue-ops.yml, observability.yml, on-maintenance.yml, pull-request.yml, release.yml	All uses: references in workflow jobs are updated from local relative paths (./.github/workflows/reusable/<name>.yml) to external pinned references (YiAgent/OpenCI/.github/workflows/reusable/<name>.yml@d280a64a392b7f1a3e906246286ca983e610f920). Job inputs and secrets inheritance remain unchanged across all workflows.
Test Assertions tests/actions/on-issue-routing.bats, on-pr-routing.bats	Test assertions updated to match the new external workflow references. Shellcheck suppression comment added for dynamic input forwarding validation.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~18 minutes

Possibly related PRs

• refactor(workflows): SDLC-standard naming + reusable/ subdirectory #27: Both PRs modify GitHub Actions workflow invocations (jobs.*.uses reusable-workflow references), with this PR switching local calls to upstream YiAgent/OpenCI pinned commit while the retrieved PR reorganizes those reusable workflows into a reusable/ subdirectory structure.
• feat: add Marketplace entry point and 11 reusable AI workflows #7: The upstream PR adds the reusable workflows to the YiAgent/OpenCI repository that this PR now references via commit SHA.
• refactor(workflows): inline 6 small underscore impls (30 -> 24 files) #15: Both PRs affect the same workflow jobs (ci, deploy, issue) through changes to reusable workflow implementations and their invocation patterns.

Poem

🐰 Local paths now roam afar,
Pinned commits guide our northern star,
Workflows dance in harmony true,
External, yet forever in view! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: replacing local relative reusable workflow paths with full external org/repo references pinned to a commit SHA across 16 workflow files and 2 test files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/reusable-workflow-paths

---

_{Review rate limit: 9/10 reviews remaining, refill in 6 minutes.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud