Project

Github Workflows

Collection of reusable GitHub Actions workflows for automating CI/CD and repository tasks.

ci-cd
github-actions

Repository: KevinDeBenedetti/github-workflows
Language: Shell
Last update: October 2026

README

github-workflows

Reusable GitHub Actions workflows and composite actions for Node.js, Python, shell, Helm, Terraform, and Ansible projects.

Features

CI pipelines for Node.js (lint → typecheck → test → build), Python (lint → format → test), and shell (ShellCheck → actionlint → Bats)
CI pipelines for Helm (lint + template dry-run), Kubernetes (kubeconform validation), Terraform (validate + fmt check), and Ansible (lint + syntax check)
CD workflows for Docker/GHCR, Kaniko and BuildKit (self-hosted), GitHub Pages, and centralized docs sync
Composite actions for Node.js/Python setup with caching, ShellCheck, Bats, actionlint, kubeconform, monorepo change detection, hash-locked ansible installs, and a checksum-pinned Claude Code setup
Pull request descriptions written by Claude Code from the commits and the diff, on your Claude subscription
Scheduled GHCR cleanup that keeps releases and recent images, safe for multi-arch images and attestations
Automated releases via release-please
Security scanning: dependency audit, CodeQL, and secret detection
Pre-commit hooks via prek for local validation

Prerequisites

A GitHub repository
Appropriate secrets configured in your repo or organization (see each workflow's docs)
Self-hosted runners on 2.336.0 or newer: the workflows reach their own composite actions with GitHub's self-repository syntax (uses: $/…); GitHub-hosted runners already qualify

Usage

Reference any workflow from your caller workflow file.

Pinning strategy

Stability need	Recommended pin	Example
Development / fast-moving	`@main`	`ci-node.yml@main`
Follow a release line	Minor alias (pre-1.0)	`ci-node.yml@v0.<minor>` (e.g. `@v0.25`)
Production / reproducible	Release tag	`ci-node.yml@vX.Y.Z` (see releases)
Maximum reproducibility	Commit SHA	`ci-node.yml@abc1234`

The README and docs always reflect @main. When releasing, consumers should pin to a tag for reproducible builds.

The workflows reach the composite actions they use (setup-node, shellcheck, …) with uses: $/…, which GitHub resolves to the workflow's own commit: pinning a workflow to a tag or SHA pins the actions it runs too, and @main runs @main's actions.

Before 1.0, breaking changes are released as minor bumps: this repo moves only the v0.<minor> alias, not v0 (release.yml's pre-major-alias: minor).

jobs:
  ci:
    uses: KevinDeBenedetti/github-workflows/.github/workflows/ci-node.yml@main
    secrets: inherit

→ Full usage guide: docs

Available workflows

Workflow	Description	Doc
`ci-node.yml`	Node.js CI (lint → typecheck → test → build)	→
`ci-python.yml`	Python CI (lint → format → test)	→
`ci-shell.yml`	Shell CI (ShellCheck → actionlint → Bats)	→
`ci-ansible.yml`	Ansible CI (ansible-lint + syntax check)	→
`ci-helm.yml`	Helm CI (lint + template dry-run)	→
`ci-kubernetes.yml`	Kubernetes CI (kubeconform manifest validation)	→
`ci-terraform.yml`	Terraform CI (validate + fmt check)	→
`ci-prometheus.yml`	Prometheus CI (PromQL check + alert unit tests)	→
`perf-sitespeed.yml`	Core Web Vitals monitoring with sitespeed.io (budget + CSV history)	→
`perf-unlighthouse.yml`	Lighthouse audit of every page (perf, a11y, SEO) with Unlighthouse, scheduled	→
`perf-lighthouse.yml`	Lighthouse CI on chosen pages of a deployed site: per-category assertions, one commit status per page	→
`seo-crawl.yml`	SEO crawl: broken links, redirects, missing/duplicate tags	→
`ci-prek.yml`	prek / pre-commit hooks run server-side (`prek run --all-files`)	→
`cd-docker.yml`	Build & push multi-platform Docker image to GHCR	→
`cd-kaniko.yml`	Build & push image with Kaniko on self-hosted runners (upstream archived — see `cd-buildkit.yml`)	→
`cd-buildkit.yml`	Build & push image with BuildKit: rootless on self-hosted runners (experimental), Buildx on GitHub-hosted ones	→
`cd-pages.yml`	Build & deploy static site to GitHub Pages	→
`cd-docs.yml`	Sync docs to a centralized docs repository	→
`release.yml`	Automated releases via release-please	→
`security.yml`	Secret scan + CodeQL SAST + dependency audit	→
`check-bot-commits.yml`	Guard PRs against bot-authored commits	→
`pr-description.yml`	PR description written by Claude Code on every push (Claude subscription)	→
`cleanup-ghcr.yml`	Scheduled GHCR retention: keeps releases and recent images, deletes the rest and old layer caches	→

Documentation

Full documentation is available at https://kevindebenedetti.github.io/github-workflows/. It is generated from the docs/ directory and published automatically on push.

See examples/ for ready-to-copy caller workflows.

Contributing

See CONTRIBUTING.md.

Security

These workflows run with the tokens and secrets of the repositories that call them. See SECURITY.md to report a vulnerability and for safe-usage guidelines (pin a release, pass secrets explicitly, least-privilege permissions).