{"id":20290612,"url":"https://github.com/notdodo/github-actions","last_synced_at":"2026-04-19T03:05:36.330Z","repository":{"id":214747476,"uuid":"737005258","full_name":"notdodo/github-actions","owner":"notdodo","description":"Collection of custom GHA and reusable workflows.","archived":false,"fork":false,"pushed_at":"2025-08-16T21:44:49.000Z","size":768,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-08-16T23:26:29.693Z","etag":null,"topics":["cicd-security","github-actions","reusable-workflows"],"latest_commit_sha":null,"homepage":"https://github.com/notdodo/github-actions","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/notdodo.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-12-29T14:14:13.000Z","updated_at":"2025-08-16T21:41:30.000Z","dependencies_parsed_at":"2024-04-25T11:29:44.893Z","dependency_job_id":"483b1808-11ce-4372-b093-1ec6d85edda5","html_url":"https://github.com/notdodo/github-actions","commit_stats":null,"previous_names":["notdodo/github-actions"],"tags_count":271,"template":false,"template_full_name":null,"purl":"pkg:github/notdodo/github-actions","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notdodo%2Fgithub-actions","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notdodo%2Fgithub-actions/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notdodo%2Fgithub-actions/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notdodo%2Fgithub-actions/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/notdodo","download_url":"https://codeload.github.com/notdodo/github-actions/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notdodo%2Fgithub-actions/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":271751922,"owners_count":24814707,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-23T02:00:09.327Z","response_time":69,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cicd-security","github-actions","reusable-workflows"],"created_at":"2024-11-14T15:08:28.792Z","updated_at":"2026-04-19T03:05:36.313Z","avatar_url":"https://github.com/notdodo.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Reusable GitHub Actions\n\nCollection of reusable workflows and custom actions designed to streamline automation.\n\n![Alt](https://repobeats.axiom.co/api/embed/39be58fe920770fc61a415d2a67806ee014f7d82.svg \"Repobeats analytics image\")\n\n## Available Workflows\n\n- `notdodo/github-actions/.github/workflows/clean-branch-cache.yml`: Use to cleanup the cache for a merge branch\n- `notdodo/github-actions/.github/workflows/docker-build-and-push.yml`: Builds a Dockerfile, optionally signs it with cosign, uploads the image to a registry, and performs a scan using [Trivy](https://trivy.dev/latest/)\n- `notdodo/github-actions/.github/workflows/gitleaks.yml`: Uses [Gitleaks](https://gitleaks.io/index.html) to scan the code for secrets\n- `notdodo/github-actions/.github/workflows/go-ci.yml`: Used for Golang CI linting and testing\n- `notdodo/github-actions/.github/workflows/go-security-scan.yml`: Used for Golang CI security scanning with Sarif support\n- `notdodo/github-actions/.github/workflows/infra-security-scan.yml`: Used for docker, Makefiles, Kubernetes security scanning with Sarif support\n- `notdodo/github-actions/.github/workflows/pulumi-preview.yml`: Used to run Pulumi preview with PR comments and OIDC authentication\n- `notdodo/github-actions/.github/workflows/pulumi-up.yml`: Used to run Pulumi up for stack deployments with OIDC authentication\n- `notdodo/github-actions/.github/workflows/python-ci.yml`: Used for Python CI linting and checking for [Poetry](https://python-poetry.org/) projects\n- `notdodo/github-actions/.github/workflows/rust-ci.yml`: Used for Rust CI linting, building and testing\n- `notdodo/github-actions/.github/workflows/sast.yml`: Used to run Semgrep on the repository with Sarif support\n- `notdodo/github-actions/.github/workflows/terraform-ci.yml`: Used for Terraform CI linting and show plan output on Pull Requests\n\n## Tagging\n\nThe repository is automatically tagged (tag for each workflow) using [notdodo/auto-tagger](https://github.com/notdodo/github-actions/tree/main/auto-tagger).\nTo increase a specific semver include in any of the commit messages:\n\n- `[#major]`\n- `[#minor]`\n- `[#patch]`\n- `[#skip]`\n\nIf no special string is used the default is `[#skip]`.\n\n## Usage examples\n\n### Clean up cache\n\n```yaml\nname: Cleanup caches by a branch\non:\n  pull_request:\n    types:\n      - closed\n\njobs:\n  cleanup:\n    uses: notdodo/github-actions/.github/workflows/clean-branch-cache.yml@cleanup-v0\n```\n\n### Gitleaks\n\n```yaml\nname: Gitleaks\non:\n  push:\n\njobs:\n  gitleaks:\n    uses: notdodo/github-actions/.github/workflows/gitleaks.yml@2e84638563b65587b42ba8ab87ccdf1922c412dd\n    # gitleaks-v0.0.0\n```\n\n### Infrastructure Security Scan\n\n```yaml\nname: Infrastructure Security Scan\non:\n  push:\n    branches:\n      - main\n  pull_request:\n    branches:\n      - main\n\nconcurrency:\n  group: your-repo-kics-${{ github.ref }}\n  cancel-in-progress: true\n\njobs:\n  infra-security-scan:\n    uses: notdodo/github-actions/.github/workflows/infra-security-scan.yml@2e84638563b65587b42ba8ab87ccdf1922c412dd\n    # infra-scan-v0.0.0\n```\n\n### Pulumi Preview\n\n```yaml\nname: Pulumi Preview\non:\n  pull_request:\n    branches:\n      - main\n\njobs:\n  pulumi-preview:\n    permissions:\n      contents: read\n      pull-requests: write\n      id-token: write\n    uses: notdodo/github-actions/.github/workflows/pulumi-preview.yml@pulumi-preview-v0\n    with:\n      stack-name: notdodo/my-project/dev\n      working-directory: infra\n      aws-role: arn:aws:iam::123456789012:role/github-actions-pulumi-preview\n      aws-region: eu-west-1\n```\n\n### Pulumi Up\n\n```yaml\nname: Pulumi Up\non:\n  push:\n    branches:\n      - main\n\njobs:\n  pulumi-up:\n    permissions:\n      contents: read\n      id-token: write\n    uses: notdodo/github-actions/.github/workflows/pulumi-up.yml@pulumi-up-v0\n    with:\n      stack-name: notdodo/my-project/prod\n      working-directory: infra\n      aws-role: arn:aws:iam::123456789012:role/github-actions-pulumi-up\n      aws-region: eu-west-1\n```\n\n### Python CI\n\n```yaml\nname: Python CI\non:\n  push:\n    branches:\n      - main\n    paths:\n      - auto-tagger/**\n  pull_request:\n    paths:\n      - auto-tagger/**\n      - .github/workflows/my-python-ci.yml\n\nconcurrency:\n  group: your-repo-python-ci-${{ github.ref }}\n  cancel-in-progress: true\n\njobs:\n  python-ci:\n    uses: notdodo/github-actions/.github/workflows/python-ci.yml@main\n    with:\n      poetry-version: 1.8.2\n      python-version: 3.11\n      working-directory: my-workdir\n```\n\n### Rust CI\n\n### Docker build and push\n\n```yaml\nname: \"Docker image builder and publisher\"\n\non:\n  push:\n    tags:\n      - \"new-version-v[0-9]+.[0-9]+.[0-9]+\"\n\njobs:\n  build-push-docker-image:\n    uses: notdodo/github-actions/.github/workflows/docker-build-and-push.yml@docker-build-and-push-v1\n    with:\n      image: notdodo/my-app\n      platforms: linux/amd64\n      push: true\n      registry: ghcr.io\n      working-directory: .\n      tags: |\n        type=match,pattern=new-version-v(.*),group=1\n    secrets:\n      registry-username: notdodo\n      registry-password: ${{ secrets.GITHUB_TOKEN }}\n```\n\nBy default, this workflow signs pushed images with cosign (`sign-image: true`) using the reusable workflow identity (the certificate identity belongs to the reusable workflow reference).\n\nTo skip signing in the reusable workflow:\n\n```yaml\njobs:\n  build-push-docker-image:\n    uses: notdodo/github-actions/.github/workflows/docker-build-and-push.yml@docker-build-and-push-v1\n    with:\n      image: notdodo/my-app\n      push: true\n      registry: ghcr.io\n      sign-image: false\n    secrets:\n      registry-username: notdodo\n      registry-password: ${{ secrets.GITHUB_TOKEN }}\n```\n\nExample: sign in the caller workflow instead of the reusable workflow.\n\nWhen used as a reusable workflow, these job outputs are available to the caller:\n\n- `image_name`: `\u003cregistry\u003e/\u003cimage\u003e`\n- `image_digest`: pushed digest (`sha256:...`), empty when `push: false`\n- `image_ref`: immutable image reference (`\u003cregistry\u003e/\u003cimage\u003e@\u003cdigest\u003e`), empty when `push: false`\n- `local_image_ref`: local image reference (`localimage:\u003csha\u003e`), only set when `push: false`\n\n```yaml\nname: Docker Build, Then Sign in Caller\non:\n  push:\n    branches: [main]\n\njobs:\n  build-image:\n    permissions:\n      attestations: write\n      contents: read\n      id-token: write\n      packages: write\n      security-events: write\n    uses: notdodo/github-actions/.github/workflows/docker-build-and-push.yml@docker-build-and-push-v1\n    with:\n      image: notdodo/my-app\n      push: true\n      registry: ghcr.io\n      sign-image: false\n    secrets:\n      registry-username: notdodo\n      registry-password: ${{ secrets.GITHUB_TOKEN }}\n\n  sign-image:\n    needs: [build-image]\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write\n      contents: read\n    steps:\n      - uses: sigstore/cosign-installer@v4.0.0\n      - name: Sign and verify\n        env:\n          COSIGN_YES: \"true\"\n          IMAGE_REF: ${{ needs.build-image.outputs.image_ref }}\n          CERT_OIDC_ISSUER: https://token.actions.githubusercontent.com\n          CERT_IDENTITY: ${{ format('https://github.com/{0}', github.workflow_ref) }}\n        run: |\n          cosign sign \"${IMAGE_REF}\"\n          cosign verify \\\n            --certificate-identity \"${CERT_IDENTITY}\" \\\n            --certificate-oidc-issuer \"${CERT_OIDC_ISSUER}\" \\\n            \"${IMAGE_REF}\"\n```\n\n### Auto tagger\n\n```yaml\nname: auto-tagger\non:\n  push:\n    branches:\n      - main\n\njobs:\n  auto-tagger:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f\n      - name: Run action\n        uses: notdodo/github-actions/auto-tagger@auto-tagger-v0\n        with:\n          bind_to_major: true\n          default_bump_strategy: skip\n          default_branch: main\n          prefix: test-v\n          github_token: ${{ secrets.GITHUB_TOKEN }}\n          dry_run: false\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnotdodo%2Fgithub-actions","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnotdodo%2Fgithub-actions","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnotdodo%2Fgithub-actions/lists"}