Reusable GitHub Actions workflows for CI/CD pipelines across Mconf projects.
This repository provides a centralized collection of reusable GitHub Actions workflows for building, testing, linting, and deploying applications across multiple programming languages and platforms. All workflows are optimized for self-hosted runners and follow security best practices.
Jobs run on the org's self-hosted runner, [self-hosted, latest]. Most workflows take a runs-on input with that default; the others have it fixed.
- Private repositories: don't pass
runs-on; the default is the right runner. - Public repositories: never use the self-hosted runner, since anyone can open a pull request that runs code on it. Pass
runs-on: '["ubuntu-latest"]'; a workflow without the input can't be called from a public repository. - Jobs outside these workflows follow the same rule:
runs-on: [self-hosted, latest]in private repositories.
The ubuntu-22.04 label is retired.
Company-wide development practices and standards are documented in the guidelines/ directory. These guidelines provide:
- AI Collaboration - Best practices for working with AI coding tools
- General Development - Language-agnostic practices (linting, Makefiles, pre-commit hooks)
- Language-Specific - Guidelines for Ruby, Python, Go, and JavaScript
- Docker - Container best practices and multi-stage builds
- Testing - Testing strategies and AI-assisted test generation
- Git Workflow - Commit messages, branching, and pull requests
Templates: The templates/ directory contains starter configurations (Makefile, AGENTS.md, linter configs, Docker examples) that you can copy to your projects.
See guidelines/README.md for a complete index.
| Workflow | Action | Language/Tool | Registry | Security | Coverage | Private Repos | AI | Key Features |
|---|---|---|---|---|---|---|---|---|
| all-build-push-image | Build+Push | Docker | Harbor | Multi-platform, metadata extraction, GHA+registry caching | ||||
| all-build-push-scan-harbor | Build+Push+Scan | Docker, Trivy | Harbor | ✓ | ✓ | Push on tags, opt-in Trivy scan, SSH support, Trivy Explorer upload, custom context/target | ||
| all-create-tag | Release | Git | Version validation, annotated tags | |||||
| all-flux-validate | Validate | Flux, Kustomize, kubeconform | ✓ | Renders like source-controller, apiVersion allowlist, kubeconform schema check, SOPS coverage both ways | ||||
| all-gen-changelog-ai | Release | Git, Claude | ✓ | PR info gathering, Notion integration, Claude Code | ||||
| all-helm-lint | Lint | Helm | Chart validation, templating, packaging test | |||||
| all-helm-publish | Publish | Helm | Harbor | OCI registry push, version extraction, GitHub summary | ||||
| all-node-lint | Lint | Node.js, ESLint, Prettier, tsc | Optional type check, per-step command overrides, npm cache | |||||
| all-node-scan | Scan | Node.js, npm audit | ✓ | Reads the lockfile only, configurable severity threshold | ||||
| all-py-bandit | Scan | Python, Bandit | ✓ | Configurable severity/confidence, JSON+screen report artifact, PR job summary | ||||
| all-ruby-lint | Lint | Ruby, RuboCop | Full RuboCop by default, command input for binstubs, libpq-dev | |||||
| all-ruby-scan | Scan | Ruby, Brakeman, bundler-audit | ✓ | Fails on Brakeman warnings by default, gem advisory audit | ||||
| all-trufflehog | Scan | TruffleHog | ✓ | Git history secret scan, verified+unknown results | ||||
| data-py-uv-lint | Lint | Python, Flake8, Black, isort, uv | uv-based dependency management | |||||
| data-py-uv-tests | Test | Python, pytest, uv | ✓ | uv-based dependency management, configurable pytest markers | ||||
| lb-go-build | Build | Go | ✓ | CGO, private modules, build-essential | ||||
| lb-go-lint | Lint | Go, golangci-lint | ✓ | 10min timeout, private module support | ||||
| lb-go-tests | Test | Go, Gocov | ✓ | ✓ | Coverage XML, PR comments, file change detection, Docker Hub login for container-based tests | |||
| lb-node-build | Build | Node.js, npm | Custom env vars, npm cache | |||||
| lb-node-lint | Lint | Node.js, ESLint | Multiple file extensions (.js/.jsx/.ts/.tsx) | |||||
| lb-node-tests | Test | Node.js, npm | File change detection | |||||
| lb-py-lint | Lint | Python, Flake8, Black, isort | pip-based, libpq-dev | |||||
| lb-py-pdm-lint | Lint | Python, Flake8, Black, isort, PDM | PDM-based dependency management | |||||
| lb-py-tests | Test | Python, pytest, PDM | ✓ | Coverage XML, PR reports, env file loading, file detection | ||||
| lb-push-scan-image | Build+Push+Scan | Docker, Trivy | DockerHub | ✓ | ✓ | Dynamic tagging, Trivy scan on tags (opt-in elsewhere), Trivy Explorer upload, job summary | ||
| lb-ruby-lint | Lint | Ruby, RuboCop | Build tools, libpq-dev, Gemfile caching | |||||
| lb-scan | Scan | Trivy | ✓ | Filesystem scan, SARIF to PR comments | ||||
| portal-ruby-lint | Lint | Ruby, RuboCop, HAML | HAML views linting | |||||
| portal-ruby-scan | Scan | Ruby, Brakeman | ✓ | Rails security vulnerabilities | ||||
| portal-ruby-tests | Test | Ruby, RSpec, Rails | MySQL+Redis services, Chromium, ImageMagick, secrets |
lb-go-build.ymlBuilds Go applications with support for private modules via SSH. Usage: Seeexamples/lb-go-build.ymllb-go-lint.ymlRuns golangci-lint on Go code. Usage: Seeexamples/lb-go-lint.ymllb-go-tests.ymlRuns Go tests with coverage reporting to pull requests. Requirespull-requests: writepermission. Usage: Seeexamples/lb-go-tests.yml
all-node-lint.ymlRuns ESLint, a Prettier formatting check and an optional type check on JavaScript/TypeScript code. Each step takes a command input, so a repository points them at its own npm scripts; an empty command skips the step. Reads the Node version from.node-version. Usage: Seeexamples/all-node-lint.ymlall-node-scan.ymlAudits npm dependencies against the advisory database withnpm audit. Reads the lockfile, so nothing is installed. The severity that fails the job is an input. Usage: Seeexamples/all-node-scan.ymllb-node-build.ymlBuilds Node.js applications. Usage: Seeexamples/lb-node-build.ymllb-node-lint.ymlRuns ESLint on JavaScript/TypeScript code. Usage: Seeexamples/lb-node-lint.ymllb-node-tests.ymlRuns Node.js tests (only on modified JavaScript/TypeScript files). Usage: Seeexamples/lb-node-tests.yml
lb-py-lint.ymlRuns Flake8, Black, and isort on Python code (pip-based projects). Usage: Seeexamples/lb-py-lint.ymllb-py-pdm-lint.ymlRuns Flake8, Black, and isort on Python code (PDM-based projects). Usage: Seeexamples/lb-py-pdm-lint.ymllb-py-tests.ymlRuns Python tests with coverage reporting (PDM-based projects). Requirespull-requests: writepermission. Usage: Seeexamples/lb-py-tests.yml
data-py-uv-lint.ymlRuns Flake8, Black, and isort on Python code (uv-based projects). Usage: Seeexamples/data-py-uv-lint.ymldata-py-uv-tests.ymlRuns Python tests with coverage reporting (uv-based projects). Includes configurable pytest markers. Requirespull-requests: writepermission. Usage: Seeexamples/data-py-uv-tests.yml
all-ruby-lint.ymlRuns RuboCop on Ruby code. Unlikelb-ruby-lint.yml, it runs the full set of cops rather than theLintdepartment alone, so the CI check matches what a localmake lintenforces. The invocation is an input, so a repository can point it at its own binstub. Reads the Ruby version from.ruby-version. Usage: Seeexamples/all-ruby-lint.ymlall-ruby-scan.ymlScans Rails applications with Brakeman and audits gems with bundler-audit. The default Brakeman invocation carries--exit-on-warn, so a warning fails the job. Either step is skipped by passing an empty command. Reads the Ruby version from.ruby-version. Usage: Seeexamples/all-ruby-scan.ymllb-ruby-lint.ymlRuns RuboCop linter on Ruby code. Usage: Seeexamples/lb-ruby-lint.ymlportal-ruby-lint.ymlRuns RuboCop and HAML linting for Rails applications. Reads Ruby version from.ruby-versionfile. Usage: Seeexamples/portal-ruby-lint.ymlportal-ruby-scan.ymlScans Rails applications for security vulnerabilities using Brakeman. Reads Ruby version from.ruby-versionfile. Usage: Seeexamples/portal-ruby-scan.ymlportal-ruby-tests.ymlRuns Rails tests with MySQL and Redis services, generates a SimpleCov coverage report and posts it as a PR comment via octocov (readscoverage/.resultset.json). Reads Ruby version from.ruby-versionfile. Requires OAuth and Devise secrets. Coverage rules can be customized per repo with a.octocov.yaml; otherwise the workflow applies a default. Usage: Seeexamples/portal-ruby-tests.yml
all-build-push-image.ymlBuilds and pushes Docker images to Harbor with automatic tagging and caching. Supports multi-platform builds and optional DockerHub login for base images. Usage: Seeexamples/all-build-push-image.ymlall-build-push-scan-harbor.ymlBuilds and pushes Docker images to Harbor, pushing only on tag refs (push_enabled: falsedisables it). The Trivy scan is opt-in (scan_enabled: true, requires the Trivy Explorer secrets) because image scanning runs on push in Harbor. Supports SSH for private dependencies, custom build context and multi-stage targets. Usage: Seeexamples/all-build-push-scan-harbor.ymlall-py-bandit.ymlRuns Bandit (Python SAST) over a source tree and fails the build on findings at or above the configured severity and confidence. Publishes a JSON and screen report as an artifact and a findings table in the job summary. Usage: Seeexamples/all-py-bandit.ymlall-trufflehog.ymlScans git history for leaked secrets and credentials using TruffleHog. Reports verified and unknown results. Requires full git history (fetch-depth: 0). Usage: Seeexamples/all-trufflehog.ymllb-scan.ymlScans repository filesystem for security vulnerabilities using Trivy. Requirespull-requests: writepermission. Usage: Seeexamples/lb-scan.ymllb-push-scan-image.ymlBuilds Docker image and pushes to Docker Hub (on tags). Tag builds are always scanned with Trivy, since Harbor does not scan Docker Hub images; on other refs the scan is opt-in (scan_enabled: true). Includes optional SSH support for private dependencies. Usage: Seeexamples/lb-push-scan-image.yml
all-flux-validate.ymlValidates a Flux + Kustomize GitOps repository before it reaches main. Renders the repo the way source-controller does, checks every renderedapiVersionagainst an allowlist committed in the consuming repo, schema-validates the output with kubeconform, and asserts SOPS coverage in both directions (nothing unencrypted undersecrets/, nokind: Secretoutside it). The allowlist path, the secrets directory name and the tool versions are inputs. Usage: Seeexamples/all-flux-validate.yml
all-helm-lint.ymlLints, templates, and validates Helm charts. Auto-detects chart name and supports custom values files. Usage: Seeexamples/all-helm-lint.ymlall-helm-publish.ymlPackages and publishes Helm charts to Harbor OCI registry. Includes version extraction from tags and GitHub summary with install command. Usage: Seeexamples/all-helm-publish.yml
all-gen-changelog-ai.ymlGenerates changelog entries using Claude AI based on commits and pull requests between versions. Usage: Seeexamples/all-gen-changelog-ai.ymlall-create-tag.ymlCreates an annotated git tag for a specified version. Usage: Seeexamples/all-create-tag.yml
All workflows include:
- Minimal permissions: Only required permissions are granted
- Timeout protection: All jobs have timeout limits (15-30 minutes)
- Private module support: SSH agent configured when
SSH_PRIVATE_KEYsecret is provided - Dependency caching: Faster builds with intelligent caching
- Vulnerability scanning: Trivy integration for security checks
Workflows may require the following secrets (configured in your repository):
SSH_PRIVATE_KEY: SSH key for accessing private Git repositoriesHARBOR_USERNAME: Harbor registry usernameHARBOR_PASSWORD: Harbor registry passwordDOCKERHUB_USERNAME: DockerHub usernameDOCKERHUB_PASSWORD: DockerHub passwordREGISTRY_ACCESS_TOKEN: DockerHub access token for pushing images (will be deprecated in favor ofDOCKERHUB_PASSWORD)TRIVY_EXPLORER_AUTH_TOKEN: Authentication for Trivy ExplorerTRIVY_EXPLORER_URL: Trivy Explorer endpoint URLGITHUB_TOKEN: Automatically provided by GitHub Actions