From b3c22645bdef988ff569ae0e1f42c4cc6ae84548 Mon Sep 17 00:00:00 2001
From: Sem Van Broekhoven <144097969+dotsem@users.noreply.github.com>
Date: Thu, 12 Nov 2026 16:09:59 +0100
Subject: [PATCH 1/2] feat: integrate with tooling

---
 .github/dependabot.yml                      | 12 ++++++++++++
 .github/workflows/internal-actionlint.yml   | 19 +++++++++++++++++++
 .github/workflows/internal-check-refs.yml   | 19 +++++++++++++++++++
 .github/workflows/internal-lint.yml         | 20 ++++++++++++++++++++
 .github/workflows/internal-release.yml      | 19 +++++++++++++++++++
 .github/workflows/internal-test-scripts.yml | 21 +++++++++++++++++++++
 AGENTS.md                                   |  2 +-
 7 files changed, 111 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/internal-actionlint.yml
 create mode 100644 .github/workflows/internal-check-refs.yml
 create mode 100644 .github/workflows/internal-lint.yml
 create mode 100644 .github/workflows/internal-release.yml
 create mode 100644 .github/workflows/internal-test-scripts.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index df7cdaa..28b5765 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,3 +18,15 @@ updates:
         patterns:
           - "*"
 
+
+  # .tooling test harness
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "04:00"
+      timezone: "UTC"
+    target-branch: "main"
+    commit-message:
+      prefix: "ci(tooling)"
diff --git a/.github/workflows/internal-actionlint.yml b/.github/workflows/internal-actionlint.yml
new file mode 100644
index 0000000..3ad86d0
--- /dev/null
+++ b/.github/workflows/internal-actionlint.yml
@@ -0,0 +1,19 @@
+name: Lint Workflows
+
+on:
+  pull_request:
+    paths: &paths
+      - ".github/workflows/**"
+      - "**/action.yml"
+      - "**/action.yaml"
+  push:
+    branches: [main]
+    paths: *paths
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    uses: dotactions/tooling/.github/workflows/actionlint.yml@47e8ca68959cee5ae7b65b8110f4cf7d0a89decd # v1.1.0
diff --git a/.github/workflows/internal-check-refs.yml b/.github/workflows/internal-check-refs.yml
new file mode 100644
index 0000000..20d4123
--- /dev/null
+++ b/.github/workflows/internal-check-refs.yml
@@ -0,0 +1,19 @@
+name: Check References
+
+on:
+  pull_request:
+    paths: &paths
+      - ".github/workflows/**"
+      - "**/action.yml"
+      - "**/action.yaml"
+  push:
+    branches: [main]
+    paths: *paths
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check-refs:
+    uses: dotactions/tooling/.github/workflows/check-refs.yml@47e8ca68959cee5ae7b65b8110f4cf7d0a89decd # v1.1.0
diff --git a/.github/workflows/internal-lint.yml b/.github/workflows/internal-lint.yml
new file mode 100644
index 0000000..9f15ba9
--- /dev/null
+++ b/.github/workflows/internal-lint.yml
@@ -0,0 +1,20 @@
+name: Lint Scripts
+
+on:
+  pull_request:
+    paths: &paths
+      - "**.sh"
+      - "**.ps1"
+      - ".tooling"
+      - ".github/workflows/internal-lint.yml"
+  push:
+    branches: [main]
+    paths: *paths
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    uses: dotactions/tooling/.github/workflows/lint.yml@47e8ca68959cee5ae7b65b8110f4cf7d0a89decd # v1.1.0
diff --git a/.github/workflows/internal-release.yml b/.github/workflows/internal-release.yml
new file mode 100644
index 0000000..a72c2a6
--- /dev/null
+++ b/.github/workflows/internal-release.yml
@@ -0,0 +1,19 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to release (e.g. 0.1.0, v0.1.0 or 0.1.0-rc.1)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    uses: dotactions/tooling/.github/workflows/release.yml@47e8ca68959cee5ae7b65b8110f4cf7d0a89decd # v1.1.0
+    with:
+      version: ${{ inputs.version }}
+    secrets: inherit
diff --git a/.github/workflows/internal-test-scripts.yml b/.github/workflows/internal-test-scripts.yml
new file mode 100644
index 0000000..030e895
--- /dev/null
+++ b/.github/workflows/internal-test-scripts.yml
@@ -0,0 +1,21 @@
+name: Test Scripts
+
+on:
+  pull_request:
+    paths: &paths
+      - "**/scripts/**"
+      - "build/targets.json"
+      - "tests/*.sh"
+      - ".tooling"
+      - ".github/workflows/internal-test-scripts.yml"
+  push:
+    branches: [main]
+    paths: *paths
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test-scripts:
+    uses: dotactions/tooling/.github/workflows/test-scripts.yml@47e8ca68959cee5ae7b65b8110f4cf7d0a89decd # v1.1.0
diff --git a/AGENTS.md b/AGENTS.md
index 0b1a1de..47f9c6b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -62,7 +62,7 @@ Opinionated composite actions and reusable workflows for building and shipping F
 ## Testing
 
 - Composite actions are tested via `uses: ./<action>` in `internal-test.yml`, with assertions on outputs and produced files. Add or extend a test for every behavioural change.
-- Script logic is unit-tested in `tests/<name>.test.sh` using the harness from the `.tooling` submodule (`source "$(dirname "$0")/../.tooling/tests/lib.sh"`; run `git submodule update --init` first). `internal-test-scripts.yml` runs every one on ubuntu, macOS and Windows. Add cases for every branch you change.
+- Script logic is unit-tested in `tests/<name>.test.sh` using the harness from the `.tooling` submodule (`source "$(dirname "$0")/../.tooling/tests/lib.sh"`; run `git submodule update --init` first). Dependabot (`gitsubmodule`) bumps `.tooling` to tooling `main`; merge those PRs only when the script tests pass. `internal-test-scripts.yml` runs every one on ubuntu, macOS and Windows. Add cases for every branch you change.
 - Each `internal-*` workflow has a `paths:` filter. When adding files that a workflow should cover, update its filter.
 - Local checks before finishing (run whichever apply):
     - `shellcheck <changed .sh files>`

From d35161fd21fb0036c1c0a2f861fc73d7c2a57bcf Mon Sep 17 00:00:00 2001
From: Sem Van Broekhoven <144097969+dotsem@users.noreply.github.com>
Date: Thu, 12 Nov 2026 16:14:22 +0100
Subject: [PATCH 2/2] ci: add tooling submodule for the test harness

---
 .gitmodules | 3 +++
 .tooling    | 1 +
 2 files changed, 4 insertions(+)
 create mode 100644 .gitmodules
 create mode 160000 .tooling

diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..86dda26
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule ".tooling"]
+	path = .tooling
+	url = https://github.com/dotactions/tooling
diff --git a/.tooling b/.tooling
new file mode 160000
index 0000000..47e8ca6
--- /dev/null
+++ b/.tooling
@@ -0,0 +1 @@
+Subproject commit 47e8ca68959cee5ae7b65b8110f4cf7d0a89decd