Reusable GitHub Actions workflows for building, testing, and releasing projects. Define a CI step once, version it, and consume it from many repositories with a short caller file.
Repositories tend to copy the same CI jobs: set up a runtime, lint, test, build a container, scan for secrets and dependencies. Copied YAML drifts, and every fix has to be repeated in every repository. This catalog holds each step once. A repository references a block by version and picks up fixes on the next version bump.
Reference a workflow from your own workflow file:
jobs:
ci:
uses: kalloeash/github-actions-templates/.github/workflows/<block>.yml@v0
with:
# block inputs, documented per blockPin to the moving major tag (@v0 today, @v1 from 1.0), to an exact release tag, or to a
full commit SHA. During 0.x a minor release may still change an interface, so pin an
exact @vX.Y.Z or a SHA if you are not watching the changelog. Do not reference @main.
Blocks are added as real projects adopt them. Each block documents its inputs, outputs, required permissions, and a copy-paste example.
Reusable workflows must be flat files, so each block's category is carried in its file name prefix rather than a folder.
| Block | Purpose |
|---|---|
| dotnet-build-and-test | Restore, build, and test a .NET solution or project. |
| node-build-and-test | Format-check, lint, type-check, test, and build a Node project. |
| Block | Purpose |
|---|---|
| docker-build | Build a container image with Buildx, and optionally push it. |
| Block | Purpose |
|---|---|
| terraform-format-validate-lint | Format-check, validate, and lint Terraform configuration. |
| terraform-plan | Plan a root configuration, read-only by default, with an optional saved plan artifact and Azure OIDC login. |
| terraform-apply | Apply the saved plan inside a caller-owned protected environment. |
| Block | Purpose |
|---|---|
| security-dependency-scan | Scan dependencies for known vulnerabilities with OWASP Dependency-Check. |
| security-iac-scan | Scan infrastructure configuration for misconfigurations with Trivy. |
| security-secret-scan | Scan the full git history for committed secrets with gitleaks. |
| Block | Purpose |
|---|---|
| precommit-run | Run the repository's pre-commit hooks in CI. |
| Action | Purpose |
|---|---|
| install-pinned-tool | Download, checksum-verify, and install a pinned tool binary; owns the catalog's tool pin table. |
Releases follow semver. A moving major tag (vN) tracks the latest release in that major
line, so consumers on @vN pick up compatible fixes without editing their caller files.
During 0.x, pin an exact @vX.Y.Z or a commit SHA. Published release tags are immutable.
The changelog is generated from Conventional Commit messages with git-cliff and published as the notes on each GitHub Release. See docs/releasing.md for how a release is cut.
Third-party actions used inside blocks are pinned to a full commit SHA and refreshed through Dependabot.
See CONTRIBUTING.md for the local setup, the workflow, and what a complete block change contains. In short: branch plus pull request, Conventional Commits, and pre-commit (actionlint, zizmor, and gitleaks) green locally before pushing.
CI runs two internal workflows on pushes to main and on every pull request (dot-prefixed
like all catalog-internal workflows):
.lint.yml: the pre-commit hooks, including actionlint and zizmor over the workflow files, plus the security-secret-scan block over the git history.test.yml: calls each block that has a fixture project undertests/, so a change that breaks a block fails in the catalog before it can be tagged
See docs/architecture.md for how the catalog is structured: the two kinds of building block, the repository layout, versioning and pinning, and how blocks are tested.
MIT. See LICENSE.