ci: consolidate workflow templates into lint and php

[turegjorup]

Draft. Groups the workflow templates by what a check needs instead of by which tool runs it, so a commit pays for two runner jobs rather than up to eleven.

Measured on itk-dev for August 2026: the eight private repos billed 1,828 Actions minutes, of which 1,399 were referenceregister alone. Actual compute was 1,167 minutes — 700 of the billed minutes were the per-job round-up, because 953 of 1,287 jobs finished in under 60 seconds. This PR targets that, not runtime.

Changes

• Newgithub/workflows/<type>/lint.yaml — replaces changelog.yaml, markdown.yaml, yaml.yaml, <type>/styles.yaml and <type>/javascript.yaml. Nothing in it needs the project's dependencies, so it runs markdownlint and prettier only.
• Absorbedcomposer.yaml and twig.yaml into github/workflows/<type>/php.yaml — composer install runs once and validate, normalize, audit, coding standards and Twig all reuse it.
• Removed the seven superseded templates and their symlinks across all ten project templates.
• task/scripts/github-actions-link — a workflow can now map to several configuration folders (php.yaml → php + twig, lint.yaml → markdown + yaml). The generic folder is linked before the project type specific one, so the specific one wins where both exist.
• docs/ regenerated, and the naming-convention prose updated (it referenced markdown.yaml, which no longer exists).

Estimated saving

Top ten repositories by Actions minutes in August 2026, taken from the org usage dashboard, with the model applied to each. Minutes are metered per job including GitHub's whole-minute round-up. Only private repositories are billed — public-repo minutes on standard runners are free, so they are runner time saved, not money.

Repository		Now	After	Saved
referenceregister	private	1,399	1,114	285
deltag.aarhus.dk	public	1,482	1,287	195
openid-connect-bundle	public	803	585	218
economics	public	470	373	97
selvbetjening.aarhuskommune.dk	public	271	200	71
iotlab-data-proxy	private	258	105	153
itk-projects	public	66	32	34
os2loop	public	58	51	7
promptfoo-python-utility	private	49	41	8
itk-workspace	private	47	23	24
Top ten		4,903	3,811	1,092

Of that 1,092, 470 minutes are billable (the four private repos) and 622 are free runner time.

Across all fourteen repositories that ran template workflows in August: 5,008 → 3,858, saving 1,150 minutes — 528 of them billable, 26% of the 2,000-minute quota. At a more conservative 15 s per eliminated job the total is 1,063.

Method and exclusions

• Measured from the runs and jobs APIs, summing each job's duration rounded up to a whole minute. This tracks the usage dashboard closely — openid-connect-bundle 803 vs 803, selvbetjening 271 vs 272, itk-projects 66 vs 67, os2loop 58 vs 56 — except deltag.aarhus.dk, which measures 1,482 against the dashboard's 1,377.
• Savings are modelled by merging the jobs of the grouped workflows per commit and charging 22 s of setup for each job removed, measured from the step timings (1.3 s job setup, 1.4 s checkout, 0.4 s network, plus ~19 s of docker compose warmup).
• Only the eight templates this PR changes are counted: changelog, markdown, yaml, styles, javascript, composer, php, twig. Repo-local workflows such as referenceregister's code-analysis.yaml, docs.yaml and user-manual.yaml are left out.
• openid-connect-bundle/php.yaml is excluded. It is not the template but a nine-job PHP-version matrix (unit tests across 8.3/8.4/8.5 × prefer-lowest/prefer-stable, mutation tests, PHPStan, coding standards). Consolidating that would defeat the matrix. Its 474 minutes stay as they are. Its composer.yamlis counted, and is worth a look on its own: four jobs, two of which are a prefer-lowest/prefer-stable matrix that no step ever reads.
• A repo whose copy of a template has more jobs than the template is treated the same way and left alone. Across these fourteen repos only openid-connect-bundle/php.yaml triggers that.

Relation to the open PRs

• ci: pull phpfpm and its dependencies up front in workflow templates #147 (up-front docker compose pull) — not adopted. @rimi-itk's review suggested --no-deps instead, which is better: with --no-deps the database and cache images are never pulled or started for checks that do not touch them, and there is no extra step to maintain. Every docker compose run here uses it.
• ci: cache Composer dependencies in workflow templates #146 (Composer cache) — adopted. actions/cache@v6 on vendor, keyed on composer.lock and docker-compose.yml, so we stop re-downloading dependencies and hitting registry rate limits.
• Both touch the files this PR restructures, so whichever lands first, the other needs rebasing. If ci: cache Composer dependencies in workflow templates #146/ci: pull phpfpm and its dependencies up front in workflow templates #147 merge first I will rebase onto them.
• actions/checkout@v7 and actions/cache@v6 are both the current latest (checkout v7.0.1, cache v6.1.0).

Open questions

1. Naming. The convention says a workflow is named for what it is concerned with, not how. php.yaml covering Composer and Twig is defensible; lint.yaml is more of a how. Better name welcome.
2. Required status checks.Markdown, YAML, Composer, Twig etc. disappear and Lint / PHP appear. Every repo with branch protection needs its required checks updated in step with the template update, or merges will block on checks that can never report.
3. Pre-existing violations surface at once. The old paths: filters meant styles.yaml only ran when CSS changed. lint.yaml runs on every pull request, so long-standing violations in untouched files appear immediately. Worth running each linter across the affected repos once before rolling this out.
4. Wall-clock goes up. Four parallel PHP jobs at ~46 s become one serial job at ~80 s. Fewer minutes billed, slower feedback.

Test plan

Not yet run against a real project — that is what keeps this a draft.

Done so far:

• task github-actions:link regenerates every symlink; each project template resolves to lint.yaml, php.yaml (+ site.yaml for Drupal) plus the right config files — .markdownlint.jsonc, .markdownlintignore, .prettierrc.yaml, .phpcs.xml.dist / .php-cs-fixer.dist.php, .twig-cs-fixer.dist.php
• task github-actions:template-headers:update leaves the headers unchanged
• task github-actions:documentation:update regenerates cleanly and task lint:markdown passes
• task lint:yaml passes

Still to do:

• run both workflows on a real Drupal, Drupal module and Symfony project
• confirm --no-deps is safe for every check in all three project types
• confirm the vendor cache actually hits, and that a restored vendor does not upset composer validate --strict