Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

https://github.com/harisekhon/github-actions

GitHub Actions Reusable Workflows and Master Template
https://github.com/harisekhon/github-actions

checkov ci-cd ci-cd-pipeline cicd github github-actions github-actions-ci hacktoberfest jenkins jenkinsfile library semgrep tfsec tfsec-checks validation validation-library validations

Last synced: 15 days ago
JSON representation

GitHub Actions Reusable Workflows and Master Template

Awesome Lists containing this project

README 

        
# GitHub Actions



[![GitHub stars](https://img.shields.io/github/stars/HariSekhon/GitHub-Actions?logo=github)](https://github.com/HariSekhon/GitHub-Actions/stargazers)

[![GitHub forks](https://img.shields.io/github/forks/HariSekhon/GitHub-Actions?logo=github)](https://github.com/HariSekhon/GitHub-Actions/network)

[![LineCount](https://sloc.xyz/github/HariSekhon/GitHub-Actions/?badge-bg-color=2081C2)](https://github.com/boyter/scc/)

[![Cocomo](https://sloc.xyz/github/HariSekhon/GitHub-Actions/?badge-bg-color=2081C2&category=cocomo)](https://github.com/boyter/scc/)

[![License](https://img.shields.io/github/license/HariSekhon/GitHub-Actions)](https://github.com/HariSekhon/GitHub-Actions/blob/master/LICENSE)

[![My LinkedIn](https://img.shields.io/badge/LinkedIn%20Profile-HariSekhon-blue?logo=data:image/svg%2bxml;base64,PHN2ZyByb2xlPSJpbWciIGZpbGw9IiNmZmZmZmYiIHZpZXdCb3g9IjAgMCAyNCAyNCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48dGl0bGU+TGlua2VkSW48L3RpdGxlPjxwYXRoIGQ9Ik0yMC40NDcgMjAuNDUyaC0zLjU1NHYtNS41NjljMC0xLjMyOC0uMDI3LTMuMDM3LTEuODUyLTMuMDM3LTEuODUzIDAtMi4xMzYgMS40NDUtMi4xMzYgMi45Mzl2NS42NjdIOS4zNTFWOWgzLjQxNHYxLjU2MWguMDQ2Yy40NzctLjkgMS42MzctMS44NSAzLjM3LTEuODUgMy42MDEgMCA0LjI2NyAyLjM3IDQuMjY3IDUuNDU1djYuMjg2ek01LjMzNyA3LjQzM2MtMS4xNDQgMC0yLjA2My0uOTI2LTIuMDYzLTIuMDY1IDAtMS4xMzguOTItMi4wNjMgMi4wNjMtMi4wNjMgMS4xNCAwIDIuMDY0LjkyNSAyLjA2NCAyLjA2MyAwIDEuMTM5LS45MjUgMi4wNjUtMi4wNjQgMi4wNjV6bTEuNzgyIDEzLjAxOUgzLjU1NVY5aDMuNTY0djExLjQ1MnpNMjIuMjI1IDBIMS43NzFDLjc5MiAwIDAgLjc3NCAwIDEuNzI5djIwLjU0MkMwIDIzLjIyNy43OTIgMjQgMS43NzEgMjRoMjAuNDUxQzIzLjIgMjQgMjQgMjMuMjI3IDI0IDIyLjI3MVYxLjcyOUMyNCAuNzc0IDIzLjIgMCAyMi4yMjIgMGguMDAzeiIvPjwvc3ZnPgo=)](https://www.linkedin.com/in/HariSekhon/)

[![GitHub Last Commit](https://img.shields.io/github/last-commit/HariSekhon/GitHub-Actions?logo=github)](https://github.com/HariSekhon/GitHub-Actions/commits/master)



[![CI Builds Overview](https://img.shields.io/badge/CI%20Builds-Overview%20Page-blue?logo=circleci)](https://harisekhon.github.io/CI-CD/)

[![YAML](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/yaml.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/yaml.yaml)

[![Markdown Lint](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/markdown.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/markdown.yaml)

[![Validation](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/validate.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/validate.yaml)

[![Grype](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/grype.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/grype.yaml)

[![Kics](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/kics.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/kics.yaml)

[![SonarCloud](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/sonarcloud.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/sonarcloud.yaml)

[![Semgrep](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/semgrep.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/semgrep.yaml)

[![Semgrep Cloud](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/semgrep-cloud.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/semgrep-cloud.yaml)

[![URL Links](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/url_links.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/url_links.yaml)

[![Trivy](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/trivy.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/trivy.yaml)



[![Repo on GitHub](https://img.shields.io/badge/repo-GitHub-2088FF?logo=github)](https://github.com/HariSekhon/GitHub-Actions)

[![Repo on GitLab](https://img.shields.io/badge/repo-GitLab-FCA121?logo=gitlab)](https://gitlab.com/HariSekhon/GitHub-Actions)

[![Repo on Azure DevOps](https://img.shields.io/badge/repo-Azure%20DevOps-0078D7?logo=azure%20devops)](https://dev.azure.com/harisekhon/GitHub/_git/GitHub-Actions)

[![Repo on BitBucket](https://img.shields.io/badge/repo-BitBucket-0052CC?logo=bitbucket)](https://bitbucket.org/HariSekhon/GitHub-Actions)



GitHub Actions master template & GitHub Actions Reusable Workflows library.



- [main.yaml](https://github.com/HariSekhon/GitHub-Actions/blob/master/main.yaml) - GitHub Actions master workflow template

- [.github/workflows/](https://github.com/HariSekhon/GitHub-Actions/tree/master/.github/workflows) - GitHub Actions Reusable Workflows Library



See [Documentation](https://docs.github.com/en/actions/using-workflows/reusing-workflows#calling-a-reusable-workflow) for how to call these workflows directly from your own GitHub Actions workflow.



Fork this repo to have full control over all updates via Pull Requests.

Create environment branches to stage updates across dev / staging / production.



Forked from [HariSekhon/Templates](https://github.com/HariSekhon/Templates), for which this is now a submodule.



To see GitHub Contexts available, including undocumented fields, see [HariSekhon/GitHub-Actions-Contexts](https://github.com/HariSekhon/GitHub-Actions-Contexts).



## Examples



In your GitHub repo, import these workflows by adding small yaml files to the `.github/workflows/` directory.



These are slightly simplified for clarify, see the [.github/workflows/README.md](.github/workflows/README.md) for a

few more details like only running when relevant files have changed.



- [Lint YAML](#lint-yaml)

- [Lint JSON](#lint-json)

- [Lint XML](#lint-xml)

- [Lint Bash / Shell Scripts](#lint-bash--shell-scripts)

- [Lint Python](#lint-python)

  - [PyLint](#pylint)

  - [Flake8](#flake8)

- [Lint README / Markdown documentation](#lint-readme--markdown-documentation)

- [Lint GitHub CODEOWNERS](#lint-github-codeowners)

- [Security - Scan for Secrets and issues](#security---scan-for-secrets-and-issues)

  - [SonarCloud](#sonarcloud)

  - [Semgrep Local](#semgrep-local)

  - [Semgrep Cloud](#semgrep-cloud)

  - [Trivy Filesystem Scan](#trivy-filesystem-scan)

  - [Trivy Docker Image Scan](#trivy-docker-image-scan)

  - [Grype Filesystem Scan](#grype-filesystem-scan)

- [Analyze your Terraform code security & best practices](#analyze-your-terraform-code-security--best-practices)

  - [tfsec](#tfsec)

  - [tflint](#tflint)

  - [Checkov](#checkov)

- [Terraform Plan & Apply](#terraform-plan--apply)

- [Lint Ansible Playbooks](#lint-ansible-playbooks)

- [Lint Packer HCL](#lint-packer-hcl)

- [Lint Redhat Kickstart](#lint-redhat-kickstart)

- [Lint Debian Preseed](#lint-debian-preseed)

- [Lint Ubuntu AutoInstaller Cloud Init](#lint-ubuntu-autoinstaller-cloud-init)

- [Lint Jenkinsfiles](#lint-jenkinsfiles)

- [Lint Groovy](#lint-groovy)

- [Lint Javascript](#lint-javascript)

- [Docker Build and push to DockerHub](#docker-build-and-push-to-dockerhub)

- [Docker Build and push to AWS ECR](#docker-build-and-push-to-aws-ecr)

- [Docker Build and push to multiple registries](#docker-build-and-push-to-multiple-registries)

- [Check for Broken URL Links](#check-for-broken-url-links)

- [Auto-Merge Production hotfixes back to Staging](#auto-merge-production-hotfixes-back-to-staging)

- [Mirror Repos to GitLab for DR Backups](#mirror-repos-to-gitlab-for-dr-backups)

- [AWS CodeArtifact - Publish a Python Package](#aws-codeartifact---publish-a-python-package)

- [Kubernetes - Pluto - Check for Outdated APIs](#kubernetes---pluto---check-for-outdated-apis)

- [Kubernetes - Polaris - Security & Best Practices Check](#kubernetes---polaris---security--best-practices-check)

- [Production](#production)

  - [Option 1 - Hashref](#option-1---hashref)

  - [Option 2 - Public Fork (fully automated)](#option-2---public-fork-fully-automated)

  - [Option 3 - Private Copy (manual)](#option-3---private-copy-manual)

- [Star History](#star-history)

- [More Core Repos](#more-core-repos)

  - [Knowledge](#knowledge)

  - [DevOps Code](#devops-code)

  - [Containerization](#containerization)

  - [CI/CD](#cicd)

  - [DBA - SQL](#dba---sql)

  - [DevOps Reloaded](#devops-reloaded)

  - [Templates](#templates)

  - [Misc](#misc)



## Lint YAML



Finds all YAML in your repo and lints it.



[![YAML](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/yaml.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/yaml.yaml)



Copy this into `.github/workflows/yaml.yaml`:



```yaml

on: [push]

jobs:

  check_yaml:

    uses: HariSekhon/GitHub-Actions/.github/workflows/yaml.yaml@master

 ```



## Lint JSON



Finds all JSON in your repo and lints it.



[![JSON](https://github.com/HariSekhon/Templates/actions/workflows/json.yaml/badge.svg)](https://github.com/HariSekhon/Templates/actions/workflows/json.yaml)



Copy this into `.github/workflows/json.yaml`:



```yaml

on: [push]

jobs:

  check_json:

    uses: HariSekhon/GitHub-Actions/.github/workflows/json.yaml@master

```



## Lint XML



Finds all XML in your repo and lints it.



[![XML](https://github.com/HariSekhon/Templates/actions/workflows/xml.yaml/badge.svg)](https://github.com/HariSekhon/Templates/actions/workflows/xml.yaml)



Copy this into `.github/workflows/xml.yaml`:



```yaml

on: [push]

jobs:

  check_xml:

    uses: HariSekhon/GitHub-Actions/.github/workflows/xml.yaml@master

 ```



## Lint Bash / Shell Scripts



Finds all `*.sh` scripts in your repo and lints them.



[![Shellcheck](https://github.com/HariSekhon/DevOps-Bash-tools/actions/workflows/shellcheck.yaml/badge.svg)](https://github.com/HariSekhon/DevOps-Bash-tools/actions/workflows/shellcheck.yaml)



Copy this into `.github/workflows/shellcheck.yaml`:



```yaml

on: [push]

jobs:

  shellcheck:

    uses: HariSekhon/GitHub-Actions/.github/workflows/shellcheck.yaml@master

 ```



## Lint Python



### PyLint



Finds all `*.py` code in your repo and lints it.



[![PyLint](https://github.com/HariSekhon/pylib/actions/workflows/pylint.yaml/badge.svg)](https://github.com/HariSekhon/pylib/actions/workflows/pylint.yaml)



Copy this into `.github/workflows/pylint.yaml`:



```yaml

on: [push]

jobs:

  pylint:

    uses: HariSekhon/GitHub-Actions/.github/workflows/pylint.yaml@master

 ```



### Flake8



Finds all `*.py` code in your repo and lints it.



[![Flake8](https://github.com/HariSekhon/pylib/actions/workflows/flake8.yaml/badge.svg)](https://github.com/HariSekhon/pylib/actions/workflows/flake8.yaml)



Copy this into `.github/workflows/flake8.yaml`:



```yaml

on: [push]

jobs:

  flake8:

    uses: HariSekhon/GitHub-Actions/.github/workflows/flake8.yaml@master

 ```



## Lint README / Markdown documentation



Finds all markdown files in your repo and lints them.



[![Markdown](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/markdown.yaml/badge.svg)](https://github.com/HariSekhon/Templates/actions/workflows/markdown.yaml)



Copy this into `.github/workflows/markdown.yaml`:



```yaml

on: [push]

jobs:

  check_markdown:

    uses: HariSekhon/GitHub-Actions/.github/workflows/markdown.yaml@master

 ```



## Lint GitHub CODEOWNERS



Lints the GitHub `CODEOWNERS` / `.github/CODEOWNERS` files.



[![Codeowners](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/codeowners.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/codeowners.yaml)



Copy this into `.github/workflows/codeowners.yaml`:



```yaml

on: [push]

jobs:

  check_codeowners:

    uses: HariSekhon/GitHub-Actions/.github/workflows/codeowners.yaml@master

 ```



## Security - Scan for Secrets and issues



### SonarCloud



[![SonarCloud](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/sonarcloud.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/sonarcloud.yaml)



```yaml

on: [push]

jobs:

  SonarCloud:

    name: SonarCloud

    uses: HariSekhon/GitHub-Actions/.github/workflows/sonarcloud.yaml@master

    secrets:

      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

```



Alerts for the above badge appears in the SonarCloud dashboard at:



The badge will go red only if failing to run and publish to SonarCloud, whether there are any alerts of not.

You must check the dashboard.



### Semgrep Local



[![Semgrep](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/semgrep.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/semgrep.yaml)



Create `.github/workflows/semgrep.yaml` containing:



```yaml

on: [push]

jobs:

  semgrep:

    uses: HariSekhon/GitHub-Actions/.github/workflows/semgrep.yaml@master

```



Alerts for the above badge appear under the GitHub repo's `Security` tab -> `Code scanning alerts`.



The badge will go red if there are any alerts.



### Semgrep Cloud



[![Semgrep Cloud](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/semgrep-cloud.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/semgrep-cloud.yaml)



Create `.github/workflows/semgrep-cloud.yaml` containing:



```yaml

on: [push]

jobs:

  semgrep:

    uses: HariSekhon/GitHub-Actions/.github/workflows/semgrep-cloud.yaml@master

    secrets:

      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

```



Alerts for the above badge appears in the Semgrep dashboard at:



The badge will go red only if failing to run and publish to Semgrep Cloud, whether there are any alerts of not.

You must check the dashboard.



### Trivy Filesystem Scan



[![Trivy Filesystem Scan](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/trivy.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/trivy.yaml)



Alerts for the above badge appear under the GitHub repo's `Security` tab -> `Code scanning alerts`.



```yaml

on: [push]

jobs:

  trivy:

    uses: HariSekhon/GitHub-Actions/.github/workflows/trivy.yaml@master

```



### Trivy Docker Image Scan



[![Trivy Docker Image Scan](https://github.com/HariSekhon/DevOps-Bash-tools/actions/workflows/trivy_image.yaml/badge.svg)](https://github.com/HariSekhon/DevOps-Bash-tools/actions/workflows/trivy_image.yaml)



Alerts for the above badge appear under the GitHub repo's `Security` tab -> `Code scanning alerts`.



```text

on: [push]

jobs:

  trivy:

    uses: HariSekhon/GitHub-Actions/.github/workflows/trivy_image.yaml@master

    with:

      docker_image: harisekhon/bash-tools

      severity: ''

```



### Grype Filesystem Scan



[![Grype](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/grype.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/grype.yaml)



Alerts for the above badge appear under the GitHub repo's `Security` tab -> `Code scanning alerts`.



```yaml

on: [push]

jobs:

  grype:

    uses: HariSekhon/GitHub-Actions/.github/workflows/grype.yaml@master

```



## Analyze your Terraform code security & best practices



### tfsec



[![tfsec](https://github.com/HariSekhon/Terraform/actions/workflows/tfsec.yaml/badge.svg)](https://github.com/HariSekhon/Terraform/actions/workflows/tfsec.yaml)



Alerts appear under `Security` -> `Code scanning alerts`.



Create `.github/workflows/tfsec.yaml` containing:



```yaml

on: [push]

jobs:

  tfsec:

    uses: HariSekhon/GitHub-Actions/.github/workflows/tfsec.yaml@master

```



### tflint



[![tflint](https://github.com/HariSekhon/Terraform/actions/workflows/tflint.yaml/badge.svg)](https://github.com/HariSekhon/Terraform/actions/workflows/tflint.yaml)



Create `.github/workflows/tflint.yaml` containing:



```yaml

on: [push]

jobs:

  tfsec:

    uses: HariSekhon/GitHub-Actions/.github/workflows/tflint.yaml@master

```



### Checkov



[![checkov](https://github.com/HariSekhon/Terraform/actions/workflows/checkov.yaml/badge.svg)](https://github.com/HariSekhon/Terraform/actions/workflows/checkov.yaml)



Alerts appear under `Security` -> `Code scanning alerts`.



Create `.github/workflows/checkov.yaml` containing:



```yaml

on: [push]

jobs:

  checkov:

    uses: HariSekhon/GitHub-Actions/.github/workflows/checkov.yaml@master

```



## Terraform Plan & Apply



Plans - updates Pull Requests with the results of validation, format check and full Change Plan outputs



Apply - applies when merged to default branch, eg. `master` or `main`



```yaml

on: [push, pull_request]

jobs:

  terraform:

    uses: HariSekhon/GitHub-Actions/.github/workflows/terraform.yaml@master

    with:

      dir: path/to/terraform/code

    secrets:

      ...

```



For more sophisticated examples including approvals, secrets, branch and path selection etc. see my

[Terraform repo](https://github.com/HariSekhon/Terraform)'s templates for

[terraform-plan.yaml](https://github.com/HariSekhon/Terraform/blob/master/.github/workflows/terraform-plan.yaml.template) and

[terraform-apply.yaml](https://github.com/HariSekhon/Terraform/blob/master/.github/workflows/terraform-apply.yaml.template)



## Lint Ansible Playbooks



Finds all Ansible `playbook.y*ml` in your repo and lints them.



[![Ansible](https://github.com/HariSekhon/Ansible/actions/workflows/ansible-playbook-syntax.yaml/badge.svg)](https://github.com/HariSekhon/Ansible/actions/workflows/ansible-playbook-syntax.yaml)



Copy this into `.github/workflows/ansible-playbook-syntax.yaml`:



```yaml

on: [push]

jobs:

  check_ansible_playbook_syntax:

    uses: HariSekhon/GitHub-Actions/.github/workflows/ansible-playbook-syntax.yaml@master

 ```



## Lint Packer HCL



Finds all `*.pkr.hcl` Packer code in your repo and lints them.



[![Packer](https://github.com/HariSekhon/Packer/actions/workflows/packer.yaml/badge.svg)](https://github.com/HariSekhon/Packer/actions/workflows/packer.yaml)



Copy this into `.github/workflows/packer.yaml`:



```yaml

on: [push]

jobs:

  check_packer_hcl:

    uses: HariSekhon/GitHub-Actions/.github/workflows/packer.yaml@master

 ```



## Lint Redhat Kickstart



Lints Redhat Kickstart automated installer files.



[![Kickstart](https://github.com/HariSekhon/Packer/actions/workflows/kickstart.yaml/badge.svg)](https://github.com/HariSekhon/Packer/actions/workflows/kickstart.yaml)



Copy this into `.github/workflows/kickstart.yaml`:



```yaml

on: [push]

jobs:

  check_kickstart:

    uses: HariSekhon/GitHub-Actions/.github/workflows/kickstart.yaml@master

    with:

      files: installers/anaconda-ks.cfg

 ```



## Lint Debian Preseed



Lints Debian Preseed automated installer files.



[![Preseed](https://github.com/HariSekhon/Packer/actions/workflows/preseed.yaml/badge.svg)](https://github.com/HariSekhon/Packer/actions/workflows/preseed.yaml)



Copy this into `.github/workflows/preseed.yaml`:



```yaml

on: [push]

jobs:

  check_preseed:

    uses: HariSekhon/GitHub-Actions/.github/workflows/preseed.yaml@master

    with:

      files: installers/preseed.cfg

 ```



## Lint Ubuntu AutoInstaller Cloud Init



Lints Ubuntu AutoInstaller Cloud Init automated installer files.



[![AutoInstaller](https://github.com/HariSekhon/Packer/actions/workflows/autoinstall-user-data.yaml/badge.svg)](https://github.com/HariSekhon/Packer/actions/workflows/autoinstall-user-data.yaml)



Copy this into `.github/workflows/autoinstall-user-data.yaml`:



```yaml

on: [push]

jobs:

  check_cloudinit:

    uses: HariSekhon/GitHub-Actions/.github/workflows/autoinstall-user-data.yaml@master

    with:

      files: installers/autoinstall-user-data

 ```



## Lint Jenkinsfiles



Finds all files named `Jenkinsfile` in the repo and lints them using a live Jenkins in docker.



[![Jenkinsfile](https://github.com/HariSekhon/Jenkins/actions/workflows/jenkinsfile.yaml/badge.svg)](https://github.com/HariSekhon/Jenkins/actions/workflows/jenkinsfile.yaml)



Create `.github/workflows/jenkinsfile.yaml`:



```yaml

on: [push]

jobs:

  jenkinsfile:

    uses: HariSekhon/GitHub-Actions/.github/workflows/jenkinsfile.yaml@master

```



## Lint Groovy



Finds all Groovy files named `*.groovy` in the repo and lints them using `groovyc`.



This is a basic check but good for a Jenkins Groovy Shared Library.



[![Groovy](https://github.com/HariSekhon/Jenkins/actions/workflows/groovyc.yaml/badge.svg)](https://github.com/HariSekhon/Jenkins/actions/workflows/groovyc.yaml)



Create `.github/workflows/groovyc.yaml`:



```yaml

on: [push]

jobs:

  check_groovyc:

    uses: HariSekhon/GitHub-Actions/.github/workflows/groovyc.yaml@master

```



## Lint Javascript



Finds all Javascript files named `*.js` in the repo and lints them using `eslint`.



[![EsLint](https://github.com/HariSekhon/TamperMonkey/actions/workflows/eslint.yaml/badge.svg)](https://github.com/HariSekhon/TamperMonkey/actions/workflows/eslint.yaml)



Create `.github/workflows/eslint.yaml`:



```yaml

on: [push]

jobs:

  check_eslint:

    uses: HariSekhon/GitHub-Actions/.github/workflows/eslint.yaml@master

```



## Docker Build and push to DockerHub



[![Docker Build DevOps Bash Tools (Ubuntu)](https://github.com/HariSekhon/Dockerfiles/actions/workflows/docker_build_devops_bash_tools_ubuntu.yaml/badge.svg)](https://github.com/HariSekhon/Dockerfiles/actions/workflows/docker_build_devops_bash_tools_ubuntu.yaml)



Create `.github/workflows/dockerhub_build.yaml`:



```yaml

on: [push]

jobs:

  docker_build:

    uses: HariSekhon/GitHub-Actions/.github/workflows/dockerhub_build.yaml@master

    with:

      repo: user/repo  # your DockerHub user/repo

      tags: latest v1.1

    secrets:

      DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}

      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}

```



## Docker Build and push to AWS ECR



Create `.github/workflows/docker_build_aws_ecr.yaml`:



```yaml

on: [push]

jobs:

  docker_build:

    uses: HariSekhon/GitHub-Actions/.github/workflows/docker_build_aws_ecr.yaml@master

    with:

      repo: MY_ECR_REPO

    secrets:

      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}

      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}

```



Creates several useful tags, supports multi-stage build caching, see [README](https://github.com/HariSekhon/GitHub-Actions/blob/master/.github/workflows/README.md) for details.



## Docker Build and push to multiple registries



Supports building + pushing to any combination of the following, just add the relevant secrets, see [docker_build.yaml](https://github.com/HariSekhon/GitHub-Actions/blob/master/.github/workflows/docker_build.yaml) for details:



- ACR  - Azure Container Registry

- ECR  - AWS Elastic Container Registry

- GCR  - Google Container Registry

- GAR  - Google Artifact Registry

- GHCR - GitHub Container Registry

- GitLab Registry

- Quay.io Registry

- DockerHub



Create `.github/workflows/docker_build.yaml`:



```yaml

on: [push]

jobs:

  docker_build:

    uses: HariSekhon/GitHub-Actions/.github/workflows/docker_build.yaml@master

    with:

      repo_tags: |

        harisekhon/bash-tools:latest

        ghcr.io/harisekhon/bash-tools:latest

      context: devops-bash-tools-ubuntu  # path to dir containing the source and Dockerfile

    # GHCR uses the local github.token, for other registries, add secrets, see docker_build.yaml for details

    secrets:

      DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}

      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}

```



## Check for Broken URL Links



[![URL Links](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/url_links.yaml/badge.svg)](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/url_links.yaml)



Create `.github/workflows/url_links.yaml`:



```yaml

on: [push]

jobs:

  url_links:

    uses: HariSekhon/GitHub-Actions/.github/workflows/url_links.yaml@master

```



See [README](https://github.com/HariSekhon/GitHub-Actions/blob/master/.github/workflows/README.md) for details on ignoring inaccessible / partially constructed links or those containing variables



## Auto-Merge Production hotfixes back to Staging



Merges via a Pull Request for full auditing.



Create `.github/workflows/merge_production_to_staging.yaml`:



```yaml

on: [push]

jobs:

  merge:

    if: github.ref_name == 'production'

    uses: HariSekhon/GitHub-Actions/.github/workflows/merge-branch.yaml@master

    with:

      head: production  # from

      base: staging     # to

```



## Mirror Repos to GitLab for DR Backups



Mirrors all/given GitHub repos to GitLab - including all branches and tags, and GitHub repo description



```yaml

on:

  schedule:

    # mirror to GitLab hourly

    - cron: '0 0 * * *'



jobs:

  gitlab_mirror:

    uses: HariSekhon/GitHub-Actions/.github/workflows/gitlab-mirror.yaml@master

    with:

      #organization: my-org    # optional: mirror your company's repos instead of your personal repos

      #repos: repo1 repo2 ...  # list of repos to mirror, space separated, rather than all repos

    secrets:

      GH_TOKEN: ${{ secrets.GH_TOKEN }}

      GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}

```



## AWS CodeArtifact - Publish a Python Package



```yaml

on:

  tags:

    - v*



jobs:

  aws_codeartifact_python_publish:

    uses: HariSekhon/GitHub-Actions/.github/workflows/codeartifact_python_publish.yaml@master

    with:

      domain: mycompany     # your AWS CodeArtifact service domain name

      repo: mycompany-core  # your CodeArtifact repo name

      #command: make publish_package  # default. Can be any command using CODEARTIFACT_AUTH_TOKEN and CODEARTIFACT_REPO_URL

    secrets:

      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}

      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}

```



## Kubernetes - Pluto - Check for Outdated APIs



Checks all Kubernetes YAML files for outdated API objects using Pluto.



[![Pluto](https://github.com/HariSekhon/Kubernetes-configs/actions/workflows/pluto.yaml/badge.svg)](https://github.com/HariSekhon/Kubernetes-configs/actions/workflows/pluto.yaml)



Create `.github/workflows/pluto.yaml`:



```yaml

on: [push]

jobs:

  pluto:

    uses: HariSekhon/GitHub-Actions/.github/workflows/pluto.yaml@master

```



## Kubernetes - Polaris - Security & Best Practices Check



Checks all Kubernetes YAML files for security issues and best practices.



Polaris currently fails on very advanced patches such as found in my

[Kubernetes-configs](https://github.com/HariSekhon/Kubernetes-configs) repo.



[![Polaris](https://github.com/HariSekhon/Kubernetes-configs/actions/workflows/polaris.yaml/badge.svg)](https://github.com/HariSekhon/Kubernetes-configs/actions/workflows/polaris.yaml)



Create `.github/workflows/polaris.yaml`:



```yaml

on: [push]

jobs:

  polaris:

    uses: HariSekhon/GitHub-Actions/.github/workflows/polaris.yaml@master

```



## Production



### Option 1 - Hashref



Import the reusable workflows from this repo as shown above, replacing `@master` with `@` to fix to an immutable version (tags are not immutable). This is [GitHub Actions Security Best Practice](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions).



### Option 2 - Public Fork (fully automated)



Fork this repo for more control and visibility over all updates.



Enable the [fork-sync](https://github.com/HariSekhon/GitHub-Actions/blob/master/.github/workflows/fork-sync.yaml) github actions workflow in your fork to keep the master branch sync'd every few hours.



You can then create tags or environment branches in your forked repo to stage updates across dev/staging/production.



If using environment branches enable the [fork-update-pr](https://github.com/HariSekhon/GitHub-Actions/blob/master/.github/workflows/fork-update-pr.yaml) github actions workflow to automatically raise GitHub Pull Requests from master to your environment branches to audit, authorize & control updates.



### Option 3 - Private Copy (manual)



Copy `.github/workflows` to a private repo. Not recommended as it's the most manual legacy approach.



You will be responsible for committing and reconciling any divergences in your local copies.



## Star History



[![Star History Chart](https://api.star-history.com/svg?repos=HariSekhon/GitHub-Actions&type=Date)](https://star-history.com/#HariSekhon/GitHub-Actions&Date)



## More Core Repos



### Knowledge



[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=Knowledge-Base&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/Knowledge-Base)

[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=Diagrams-as-Code&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/Diagrams-as-Code)



### DevOps Code



[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=DevOps-Bash-tools&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/DevOps-Bash-tools)

[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=DevOps-Python-tools&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/DevOps-Python-tools)

[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=DevOps-Perl-tools&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/DevOps-Perl-tools)

[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=DevOps-Golang-tools&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/DevOps-Golang-tools)



### Containerization



[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=Kubernetes-configs&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/Kubernetes-configs)

[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=Dockerfiles&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/Dockerfiles)



### CI/CD



[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=GitHub-Actions&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/GitHub-Actions)

[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=Jenkins&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/Jenkins)



### DBA - SQL



[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=SQL-scripts&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/SQL-scripts)



### DevOps Reloaded



[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=Nagios-Plugins&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/Nagios-Plugins)

[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=HAProxy-configs&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/HAProxy-configs)

[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=Terraform&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/Terraform)

[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=Packer-templates&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/Packer-templates)

[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=Nagios-Plugin-Kafka&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/Nagios-Plugin-Kafka)



### Templates



[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=Templates&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/Templates)

[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=Template-repo&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/Template-repo)



### Misc



[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=Spotify-tools&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/Spotify-tools)

[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=Spotify-playlists&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/Spotify-playlists)



The rest of my original source repos are

[here](https://github.com/HariSekhon?tab=repositories&q=&type=source&language=&sort=stargazers).



Pre-built Docker images are available on my [DockerHub](https://hub.docker.com/u/harisekhon/).



![](https://hit.yhype.me/github/profile?user_id=2211051)