mriechers/github-actions
Developer toolsこのページは AI により自動翻訳されています。技術的な詳細は原文をご確認ください。 原文を見る
Shared reusable GitHub Actions workflows for the ~/Developer fleet
概要
Shared, callable GitHub Actions for the ~/Developer workspace fleet. Public on purpose: the workflow definitions are non-sensitive (no secrets live here — callers forward their own CLAUDE_CODE_OAUTH_TOKEN), and a public host is the only way repos across separate owners/orgs can call one shared workflow. python-ci.yml and js-ci.yml are the Tier A language checks that sit above the floor. Both embed their own gitleaks step, so a repo calling one of them already has the floor covered and does not need a separate floor.yml caller. Both moved here from the-lodge on 2026-08-11 for the same reason as the floor: they were unreachable in a private repo and had . Every non-archived repo in the fleet should call floor.yml. It is the Tier 0 check from the-lodge's conventions/CI_STANDARDIZATION.md: don't ship credentials. Nothing is forwarded — gitleaks runs on the caller's own GITHUB_TOKEN.
README
以下は原文 README の抜粋です。原文を見る。
github-actions
Shared, callable GitHub Actions reusable workflows for the ~/Developer
workspace fleet. Public on purpose: the workflow definitions are non-sensitive
(no secrets live here — callers forward their own CLAUDE_CODE_OAUTH_TOKEN),
and a public host is the only way repos across separate owners/orgs can call one
shared workflow.
Workflows
| File | Purpose | Key inputs |
|---|---|---|
.github/workflows/floor.yml |
Tier 0 floor — full-history gitleaks secrets scan | gitleaks-config, fetch-depth (default 0) |
.github/workflows/claude-review.yml |
Auto Claude review with formal GitHub state | model (default sonnet), prompt, review_label, optional github_app_id |
.github/workflows/claude-interactive.yml |
Interactive @claude on issues/PRs |
model (default sonnet), claude_args |
.github/workflows/python-ci.yml |
Tier A Python CI — floor + ruff + pyright + pytest | python-version (default 3.11), test-paths, install-cmd, ruff-select, pyright-mode, run-tests |
.github/workflows/js-ci.yml |
Tier A JS/TS CI — floor + lint + typecheck + test | node-version, install-cmd, lint-cmd, test-cmd |
.github/workflows/star-curator.yml |
Files starred repos into star Lists, reports the rest | rules-path, dry-run, issue-label, engine-ref; secret stars-token |
Tier A language CI
python-ci.yml and js-ci.yml are the Tier A language checks that sit above the
floor. Both embed their own gitleaks step, so a repo calling one of them already
has the floor covered and does not need a separate floor.yml caller.
jobs:
python-ci:
uses: mriechers/github-actions/.github/workflows/python-ci.yml@
with:
python-version: "3.12"
test-paths: "tests/"
Both moved here from the-lodge on 2026-08-11 for the same reason as the floor: they were unreachable in a private repo and had zero callers fleet-wide.
The floor
Every non-archived repo in the fleet should call floor.yml. It is the Tier 0
check from the-lodge’s conventions/CI_STANDARDIZATION.md: don’t ship
credentials. Nothing is forwarded — gitleaks runs on the caller’s own
GITHUB_TOKEN.
name: Floor
on: [push, pull_request]
jobs:
floor:
permissions:
contents: read
uses: mriechers/github-actions/.github/workflows/floor.yml@
Why the floor lives here and not in the-lodge, which is where the tier model is documented: the-lodge is private, and a reusable workflow in a private repo cannot be called by other repos unless that repo’s Actions access is explicitly widened. A floor definition nothing can consume is not a floor — and that is what happened. As of 2026-08-10 exactly one repo in the fleet ran a secrets scan, and it did so by inlining gitleaks rather than calling the unreachable reusable.
Consuming
Add a caller workflow that forwards the token and grants permissions, e.g.:
name: Claude Code Review
on:推奨ツール
別のキーワードを試すか、フィルタを外してください。
インストール
npx skillfish add mriechers/github-actions