{"id":51579224,"url":"https://github.com/lfreleng-actions/workflows-template","last_synced_at":"2026-07-11T04:02:12.680Z","repository":{"id":368859005,"uuid":"1287013932","full_name":"lfreleng-actions/workflows-template","owner":"lfreleng-actions","description":"Template for Linux Foundation Release Engineering GitHub workflows","archived":false,"fork":false,"pushed_at":"2026-07-02T13:10:01.000Z","size":49,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-02T15:08:40.163Z","etag":null,"topics":["github","github-workflow","github-workflows","template"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lfreleng-actions.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-02T09:49:13.000Z","updated_at":"2026-07-02T13:09:28.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/lfreleng-actions/workflows-template","commit_stats":null,"previous_names":["lfreleng-actions/workflows-template"],"tags_count":1,"template":false,"template_full_name":"lfreleng-actions/actions-template","purl":"pkg:github/lfreleng-actions/workflows-template","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lfreleng-actions%2Fworkflows-template","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lfreleng-actions%2Fworkflows-template/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lfreleng-actions%2Fworkflows-template/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lfreleng-actions%2Fworkflows-template/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lfreleng-actions","download_url":"https://codeload.github.com/lfreleng-actions/workflows-template/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lfreleng-actions%2Fworkflows-template/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35350133,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-11T02:00:05.354Z","response_time":104,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["github","github-workflow","github-workflows","template"],"created_at":"2026-07-11T04:02:07.515Z","updated_at":"2026-07-11T04:02:12.657Z","avatar_url":"https://github.com/lfreleng-actions.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003c!--\nSPDX-License-Identifier: Apache-2.0\nSPDX-FileCopyrightText: 2025 The Linux Foundation\n--\u003e\n\n# 🔧 Workflows Template\n\n\u003c!-- prettier-ignore-start --\u003e\n\u003c!-- markdownlint-disable-next-line MD013 --\u003e\n[![Linux Foundation](https://img.shields.io/badge/Linux-Foundation-blue)](https://linuxfoundation.org/) [![Source Code](https://img.shields.io/badge/GitHub-100000?logo=github\u0026logoColor=white\u0026color=blue)](https://github.com/lfreleng-actions/workflows-template) [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) [![pre-commit.ci status badge]][pre-commit.ci results page] [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/lfreleng-actions/workflows-template/badge)](https://scorecard.dev/viewer/?uri=github.com/lfreleng-actions/workflows-template)\n\u003c!-- prettier-ignore-end --\u003e\n\nThe generic, language-agnostic starting point for reusable-workflow\nrepositories in this GitHub organisation (`go-workflows`,\n`node-workflows`, …). It carries the canonical Linux Foundation pipeline\n**skeletons and patterns** — not a real pipeline: language-specific\nsteps are `# TEMPLATE:`-marked placeholders that instantiators\nreplace with real actions. `python-workflows` is the language-specific\nreference implementation of these patterns.\n\n## Skeleton reusable workflows\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\n| Workflow | Purpose | Trigger style |\n| -------- | ------- | ------------- |\n| `.github/workflows/build-test.yaml` | Build, test, audit, SBOM and Grype scan skeleton | Pull request |\n| `.github/workflows/build-test-release.yaml` | Release skeleton (Model A, tag-driven): tag validation, release artefact attachment and draft-release promotion | Tag push |\n| `.github/workflows/merge.yaml` | Merge/publish skeleton (Model B, merge-driven): snapshot publish on every merge plus `releases/` file-triggered release publish | Merge / push to main |\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\nEach pipeline runs a `repository-metadata` job in parallel (an\ninformational step that does not gate the build). After `build`, the\ntest, audit and SBOM/Grype branches run in parallel - none gates\nanother, so a pull request surfaces every failure at once (jobs in\n`{ }` run concurrently; `-\u003e` denotes sequence):\n\n```text\nbuild -\u003e { tests | audit | sbom -\u003e grype }\n```\n\nThe release skeleton wraps this with `tag-validate` up front and a\nrelease-promotion chain at the end. It also **defers `tests` until\n`audit` and `grype` have both passed**, so a failing audit skips the\ntest suite and never reaches release promotion:\n\n```text\ntag-validate -\u003e build -\u003e { audit | sbom -\u003e grype } -\u003e tests\n  -\u003e attach-artefacts -\u003e promote-release\n```\n\nThe merge skeleton implements the Jenkins-heritage LF/Gerrit model:\n\n```text\n{ resolve-version | build } -\u003e snapshot-publish\ncheck-release -\u003e release-publish (when a release file merged)\n```\n\n## Dual release models\n\nRepositories built from this template support **both** release models\nso consumers can adopt either — or migrate between them — without\ndivergent behaviour:\n\n- **Model A — tag-driven** (`build-test-release.yaml`): the version\n  comes from a validated, signed semver tag; a GitHub release carries\n  the attested artefacts. Canonical for GitHub-native projects and\n  Gerrit projects whose tags replicate to the mirror.\n- **Model B — merge-driven** (`merge.yaml`): every merge publishes a\n  snapshot (version from committed metadata such as\n  `version.properties` → `X.Y.Z-SNAPSHOT`); a release triggers from a\n  committed release file (`releases/*.yaml`) in the merged change.\n  Canonical for Jenkins-heritage LF/Gerrit projects publishing to\n  Nexus.\n\n## Usage\n\nCopy a template from [`examples/`](examples/) into your project's\n`.github/workflows/` directory and replace the placeholder `uses:` SHA\nwith a pinned release. Each workflow ships in two forms:\n\n- `github.yaml` — a plain GitHub-native caller (pull-request, tag-push\n  or push-to-main triggered).\n- `gerrit.yaml` — a Gerrit-wrapped caller for projects where Gerrit is\n  the source of truth (SCM), integrating with `gerrit_to_platform`\n  voting/commenting.\n\n```text\nexamples/\n  build-test/          { github.yaml, gerrit.yaml }\n  build-test-release/  { github.yaml, gerrit.yaml }\n  merge/               { github.yaml, gerrit.yaml }\n```\n\nAll inputs are optional and default to the canonical behaviour; see the\n`inputs:` block at the top of each workflow file for the full,\ndocumented list.\n\n## How to instantiate this template\n\nWhen creating a new `\u003clang\u003e-workflows` repository from this template:\n\n1. Replace every `# TEMPLATE:` placeholder step in the three skeleton\n   workflows with the real language build/test/audit/SBOM/publish\n   actions, keeping the step ids and job outputs intact. The\n   surrounding job graph, harden-runner wiring, dual checkout, Gerrit\n   validation and Grype scan are generic — keep them as-is.\n2. Wire real fixture/consumer repositories into\n   [`testing.yaml`](.github/workflows/testing.yaml) so the workflows\n   run end-to-end against real projects on every pull request.\n3. Update this README and all badge/link slugs (`workflows-template` →\n   your repository name), and record your design decisions in\n   [`docs/BRIEF.md`](docs/BRIEF.md).\n4. When new work talks to new/external endpoints, follow the central\n   allow-list process: raise a PR against `lfreleng-actions/.github`\n   adding the hosts/ports to the org harden-runner allow-list, get it\n   released, then pin the new tag's commit SHA in the\n   `harden_runner_allowlist` defaults. Reserve `harden_runner_egress:\n   'audit'` for bring-up/endpoint discovery.\n5. Keep support for **both** release models (Model A and Model B),\n   factoring version resolution so the two share building blocks.\n6. Update the `examples/` callers to reference your repository and its\n   real input surface.\n\n## Gerrit support\n\nThe reusable workflows are Gerrit-aware: when a caller sets the\n`gerrit_refspec` input they check out the change with\n`checkout-gerrit-change-action` instead of `actions/checkout`. Vote and\ncomment casting live in the `gerrit.yaml` caller examples (clear vote →\nrun → report vote for verify; comments without votes for merge), never\ninside the reusable workflows.\n\n## Testing\n\n[`.github/workflows/testing.yaml`](.github/workflows/testing.yaml)\nexercises the build-test skeleton against fixture repositories of\ndifferent languages by calling it via its local path. The placeholder\nsteps are language-agnostic, so the self-test validates the generic\nscaffolding regardless of project language — which is the point of this\nrepository.\n\n## Design\n\nSee [`docs/BRIEF.md`](docs/BRIEF.md) for the design decisions behind the\ntemplate: what stays generic versus placeholder, the three skeleton\ncontracts, the dual release-model rationale and the instantiation\nchecklist.\n\n[pre-commit.ci results page]: https://results.pre-commit.ci/latest/github/lfreleng-actions/workflows-template/main\n[pre-commit.ci status badge]: https://results.pre-commit.ci/badge/github/lfreleng-actions/workflows-template/main.svg\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flfreleng-actions%2Fworkflows-template","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flfreleng-actions%2Fworkflows-template","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flfreleng-actions%2Fworkflows-template/lists"}