feat: inherit shared dev tooling from cr-upstream-repo

Add consumer config (.common-repo-upstream.yaml) to sync pre-commit
hooks and CI workflow from common-repo/cr-upstream-repo. Uses a
separate config file as a workaround until common-repo supports the
`self:` operator (common-repo/common-repo#253).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.common-repo-upstream.yaml

@@ -0,0 +1,16 @@
+# Consumer config: inherit shared dev tooling from cr-upstream-repo
+- repo:
+    url: https://github.com/common-repo/cr-upstream-repo
+    ref: v1
+
+- exclude:
+    # cr-semantic-release owns these — don't inherit from upstream
+    - ".releaserc.yaml"
+    - "commitlint.config.cjs"
+    - "src/commitlint.config.cjs"
+    - ".github/workflows/release.yaml"
+    - ".github/workflows/commitlint.yml"
+    # Upstream docs/metadata not relevant
+    - "CHANGELOG.md"
+    - "LICENSE"
+    - "README.md"

.github/workflows/ci.yaml

@@ -1,46 +1,38 @@
 name: CI
 
 on:
-  workflow_call:
   pull_request:
+  push:
     branches:
       - main
+  workflow_call:
+
+permissions:
+  contents: read
 
 jobs:
-  sync-check:
+  lint:
-    name: Verify src/ sync
+    name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@v4
-      - name: Check top-level files match src/
+
-        run: |
+      - uses: actions/setup-python@v5
-          # Verify distributed files in src/ match the repo's own copies
+        with:
-          status=0
+          python-version: "3.x"
-          for file in .releaserc.yaml commitlint.config.cjs; do
+
-            if ! diff -q "$file" "src/$file" > /dev/null 2>&1; then
+      - uses: pre-commit/action@v3.0.1
-              echo "❌ $file differs from src/$file"
+
-              diff --color "$file" "src/$file" || true
+  test:
-              status=1
+    name: Test
-            else
+    runs-on: ubuntu-latest
-              echo "✅ $file matches src/$file"
+    steps:
-            fi
+      - uses: actions/checkout@v4
-          done
+
-          for file in .github/workflows/commitlint.yml; do
+      - uses: common-repo/setup-common-repo@v1
-            if ! diff -q "$file" "src/$file" > /dev/null 2>&1; then
+
-              echo "❌ $file differs from src/$file"
+      - name: Validate configuration
-              diff --color "$file" "src/$file" || true
+        run: common-repo validate
-              status=1
+
-            else
+      - name: Dry-run apply
-              echo "✅ $file matches src/$file"
+        run: common-repo apply --dry-run
-            fi
-          done
-          # release.yaml intentionally differs: src/ uses template vars, top-level uses hardcoded defaults
-          echo "⏭️  .github/workflows/release.yaml skipped (template vars in src/)"
-          if [ $status -ne 0 ]; then
-            echo ""
-            echo "Top-level files and src/ are out of sync."
-            echo "Copy changes to both locations, or run: cp .releaserc.yaml commitlint.config.js src/ && cp .github/workflows/commitlint.yml .github/workflows/release.yaml src/.github/workflows/"
-            exit 1
-          fi
-          echo ""
-          echo "All distributed files in sync ✅"

.github/workflows/common-repo-check.yaml

@@ -0,0 +1,25 @@
+name: common-repo check
+
+on:
+  schedule:
+    # Run daily at 08:00 UTC
+    - cron: "0 8 * * *"
+  workflow_dispatch:
+
+jobs:
+  check:
+    name: Check for upstream updates
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: common-repo/setup-common-repo@v1
+
+      - name: Check for updates
+        run: common-repo check --updates --config .common-repo-upstream.yaml
+
+      - name: Show diff
+        run: |
+          common-repo diff --config .common-repo-upstream.yaml --summary || true
+          echo "---"
+          common-repo diff --config .common-repo-upstream.yaml || true

.pre-commit-config.yaml

@@ -0,0 +1,10 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+        args: [--allow-multiple-documents]
+      - id: check-merge-conflict
+      - id: check-added-large-files