{"id":28109084,"url":"https://github.com/workleap/wl-reusable-workflows","last_synced_at":"2026-05-24T06:03:09.602Z","repository":{"id":226060993,"uuid":"589739456","full_name":"workleap/wl-reusable-workflows","owner":"workleap","description":"Contains organization-wide reusable workflows like Renovate and Checkly.","archived":false,"fork":false,"pushed_at":"2026-05-20T19:12:39.000Z","size":403,"stargazers_count":1,"open_issues_count":5,"forks_count":0,"subscribers_count":21,"default_branch":"main","last_synced_at":"2026-05-21T00:16:15.304Z","etag":null,"topics":["product--idp","vertical--infra"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/workleap.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-01-16T20:28:41.000Z","updated_at":"2026-05-20T19:16:04.000Z","dependencies_parsed_at":"2024-05-07T15:29:42.418Z","dependency_job_id":"aa6a5621-eea8-405c-b94e-0c1cbed038d6","html_url":"https://github.com/workleap/wl-reusable-workflows","commit_stats":null,"previous_names":["gsoft-inc/wl-reusable-workflows","workleap/wl-reusable-workflows"],"tags_count":40,"template":false,"template_full_name":null,"purl":"pkg:github/workleap/wl-reusable-workflows","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workleap%2Fwl-reusable-workflows","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workleap%2Fwl-reusable-workflows/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workleap%2Fwl-reusable-workflows/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workleap%2Fwl-reusable-workflows/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/workleap","download_url":"https://codeload.github.com/workleap/wl-reusable-workflows/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workleap%2Fwl-reusable-workflows/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33423284,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-23T22:14:44.296Z","status":"online","status_checked_at":"2026-05-24T02:00:06.296Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["product--idp","vertical--infra"],"created_at":"2025-05-14T02:31:05.354Z","updated_at":"2026-05-24T06:03:09.589Z","avatar_url":"https://github.com/workleap.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Workleap's reusable GitHub Actions repository\n\nThis repository contains centralized workflows that are re-used across the organization's repositories.\n\n# Renovate daily workflow\n\nThis repository also hosts the daily [Renovate](https://docs.renovatebot.com/) workflow for the whole [workleap GitHub organization](https://github.com/workleap/).\n\nRepositories **must opt-in** to Renovate automated dependency updates by providing their own configuration file. Repositories without a Renovate configuration file will be ignored.\n\n# Reusable workflows\n\n## Semgrep\n\nThis workflow runs the semgrep security scanner against the given repo.\n\n## Jira\n\nThis workflow creates links between jira cards and pull requests based on branch names.\n\n## LinearB\n\nThis workflow will create a deployment entry in LinearB for the provided environment.\nExample usage in a workflow:\n```yaml\njobs:\n  deploy-\u003cyour_environment\u003e:\n    uses: workleap/wl-reusable-workflows/.github/workflows/linearb-deployment.yml@main\n    with:\n      environment: \"\u003cyour_environment\u003e\" # development, staging or release\n    secrets: inherit\n```\n\n## Send Slack notification\n\n```yml\njobs:\n  sample:\n    steps:\n      - uses: workleap/wl-reusable-workflows/send-slack-notification@main\n        with:\n          webhook_url: ${{secrets.SLACK_WEBHOOK_URL_IDP_DEV_ALERTS}}\n          # Use either text or messageTemplate\n          text: Sample message\n          messageTemplate: \"FailedJob\" # Support \"\", \"FailedJob\"\n```\n\n## Perform and deploy Checkly checks\nThis workflow requires two secrets to be set:\n- `CHECKLY_API_KEY`: The API key to access the Checkly API\n- `CHECKLY_ACCOUNT_ID`: The ID of the Checkly account\n\n```yml\njobs:\n  deploy-checkly:\n    uses: workleap/wl-reusable-workflows/.github/workflows/deploy-checkly.yml@main\n    permissions:\n      id-token: write\n      contents: read\n    with:\n      account-id: \"your-checkly-account-id\"\n      api-key: \"your-checkly-api-key\"\n      private-location-name: \"your-private-location-name\"\n```\n\n## Azure Artifacts Authenticate\nBefore using this action, make sure the managed identity associated with your repository has access to the ADO feed.\n- Your managed identity will need to be a user of your Organization with the `Stakeholder` access level\n- Then this user will need to have either contributor or reader access to your ADO feed\n\nThis action authenticates to Azure Artifacts feed using Azure CLI and configures the environment for package access. It sets up the necessary authentication tokens and credential providers for accessing Azure DevOps feeds.\n\nThis action requires the following repository variables to be configured:\n- `AZURE_CLIENT_ID`: The Azure service principal client ID\n- `AZURE_TENANT_ID`: The Azure tenant ID\n\n```yml\npermissions:\n  contents: read\n  id-token: write\n\njobs:\n  build:\n    runs-on: idp\n    steps:\n      - uses: actions/checkout@v4\n\n      - uses: workleap/wl-reusable-workflows/az-artifact-authenticate@main\n        with:\n          feed-url: \"https://pkgs.dev.azure.com/workleap/_packaging/your-feed/nuget/v3/index.json\"\n          variables: ${{ toJSON(vars) }}\n```\n\n## Azure Npm Registry Authenticate\nBefore using this action, make sure the managed identity associated with your repository has access to the ADO feed.\n- Your managed identity will need to be a user of your Organization with the `Stakeholder` access level\n- Then this user will need to have either contributor or reader access to your ADO feed\n\nThis action authenticates to an Azure Npm Registry using Azure CLI and configures the environment for package access through `npm`, `pnpm` and `yarn`.\n\nThis action requires the following repository variables to be configured:\n- `AZURE_CLIENT_ID`: The Azure service principal client ID\n- `AZURE_TENANT_ID`: The Azure tenant ID\n\n```yml\npermissions:\n  contents: read\n  id-token: write\n\njobs:\n  build:\n    runs-on: idp\n    steps:\n      - uses: actions/checkout@v4\n\n      - uses: workleap/wl-reusable-workflows/az-npm-registry-authenticate@main\n        with:\n          ado-organization-name: \"workleap\"\n          ado-feed-name: \"workleap\"\n          variables: ${{ toJSON(vars) }}\n```\n\n## Create GitHub releases from commits available since the last stable release\n\nThis reusable workflow is useful because we often forget to create new GitHub releases for libraries after merging pull requests. It is intended to be used with a schedule. It requires a secret named `token` that contains a personal access token with permissions to create GitHub releases on the targeted repo (`contents: write`).\n\nIf any commit message contains the following keywords, it will create a new release with the corresponding version bump:\n- `#major`: bump the major version,\n- `#minor`: bump the minor version,\n- `#patch`: bump the patch version (default behavior).\n\nAdditional features and behaviors:\n\n- Supports new repos without tags (will create `0.0.1`).\n- Gracefully exits if there's no commits since the last stable tag.\n- Automatically generates the release notes.\n- Only supports creating tags from the main branch of the targeted repo.\n\nHere's how to use it:\n\n```yaml\nname: Create stable release\n\non:\n  schedule:\n    - cron: \"0 3 * * 0\" # At 03:00 on Sunday (that's an example)\n\njobs:\n  create-release:\n    permissions:\n      contents: write\n    uses: workleap/wl-reusable-workflows/.github/workflows/create-stable-release.yml@main\n    secrets:\n      token: ${{ secrets.SOME_PAT }}\n```\n\n## Update downstream repositories from template\n\nThis workflow automatically synchronizes template files (`.github` folder, `CONTRIBUTING.md`, `SECURITY.md`, `renovate.json`) from a template repository to all downstream repositories with a specified prefix. It's useful for maintaining consistent configurations and documentation across multiple repositories.\n\nExample usage in a workflow:\n```yaml\nname: Sync from Template Repo\n\non:\n  workflow_dispatch:\n  push:\n    branches: [ main ]\n    paths:\n      - '.github/**'\n      - 'CONTRIBUTING.md'\n      - 'SECURITY.md'\n      - 'renovate.json'\n\njobs:\n   update-downstream-repositories:\n      uses: workleap/wl-reusable-workflows/.github/workflows/github-template-update-downstream.yml@main\n      with:\n        templateRepoName: 'terraform-template'\n        repoPrefix: 'terraform-'\n      secrets: inherit\n```\n\n## GitHub Status Check Policy\n\nWhen working with mono-repositories, you may need different pipelines to run based on which files have changed. However, GitHub only supports static required checks in repository settings. This reusable workflow helps you implement dynamic status checks as a workaround.\n\n1. Define your check policy\n\n  Create a JSON file describing which checks are required for specific paths. Example:\n\n  ````json\n  [\n    {\n      \"checks\": [\"build_service1\"],\n      \"paths\": [\"service1/**\"]\n    },\n    {\n      \"checks\": [\"build_service2\"],\n      \"paths\":\n      [\n        \"service2/**\",\n        \":(exclude)service2/folder1/**\"\n      ]\n    }\n  ]\n  ````\n\n  - `checks`: An array of status check names that must succeed if any files matching the specified `paths` are changed. To determine the correct check names, you can open a draft pull request and reference the exact names shown for checks in the pull request interface.\n  - `paths`: List of [pathspecs](https://git-scm.com/docs/gitglossary#Documentation/gitglossary.txt-aiddefpathspecapathspec) to match against files changed in the pull request.\n\n2. Add the workflow\n\n  ````yaml\n  name: Evaluate policy\n\n  on:\n    push:\n    pull_request:\n\n  jobs:\n    evaluate_policy:\n        uses: workleap/wl-reusable-workflows/.github/workflows/required_checks_policy.yml@main\n        with:\n          policyPath: ./policy.json # Relative to the root of the git repository\n        secrets: inherit\n        permissions:\n          contents: read\n          checks: read\n  ````\n\n3. Set required checks in repository settings\n\n\u003e [!NOTE]\n\u003e The policy file is fetched from the target branch for `pull_request` events and from the default branch for `push` events. This means you cannot update the policy without a code review.\n\n## Trigger Maintenance Page\n\nThis workflow enables or disables a maintenance or outage page for a specified Cloudflare zone and environment. It is useful for quickly toggling maintenance or outage states across different environments and endpoints managed by Cloudflare.\n\n**Inputs:**\n- `pageType`: Type of page to enable or disable (`maintenance` or `outage`).\n- `action`: Whether to `enable` or `disable` the page.\n- `zone`: The endpoint (zone) to target (e.g., `login`, or another subdomain).\n- `environment`: The environment to target (`dev`, `stg`, or `prod`).\n- `cloudflareApiToken`: Cloudflare API token with permissions to manage rulesets.\n\n**Example usage:**\n```yaml\njobs:\n  trigger-maintenance:\n    uses: workleap/wl-reusable-workflows/.github/workflows/trigger-maintenance-page.yml@main\n    with:\n      pageType: \"maintenance\"\n      action: \"enable\"\n      zone: \"login\"\n      environment: \"prod\"\n      cloudflareApiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n```\n\nThis workflow will call the Cloudflare API to enable or disable the specified rule for the given zone and environment.\n\n## License\n\nCopyright © 2025, Workleap. This code is licensed under the Apache License, Version 2.0. You may obtain a copy of this license at https://github.com/workleap/gsoft-license/blob/master/LICENSE.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fworkleap%2Fwl-reusable-workflows","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fworkleap%2Fwl-reusable-workflows","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fworkleap%2Fwl-reusable-workflows/lists"}