github-actions

Shared, callable GitHub Actions reusable workflows for the ~/Developer workspace fleet. Public on purpose: the workflow definitions are non-sensitive (no secrets live here — callers forward their own CLAUDE_CODE_OAUTH_TOKEN), and a public host is the only way repos across separate owners/orgs can call one shared workflow.

Workflows

Tier A language CI

python-ci.yml and js-ci.yml are the Tier A language checks that sit above the floor. Both embed their own gitleaks step, so a repo calling one of them already has the floor covered and does not need a separate floor.yml caller.

jobs:
  python-ci:
    uses: mriechers/github-actions/.github/workflows/python-ci.yml@
    with:
      python-version: "3.12"
      test-paths: "tests/"

Both moved here from the-lodge on 2026-08-11 for the same reason as the floor: they were unreachable in a private repo and had zero callers fleet-wide.

The floor

Every non-archived repo in the fleet should call floor.yml. It is the Tier 0 check from the-lodge’s conventions/CI_STANDARDIZATION.md: don’t ship credentials. Nothing is forwarded — gitleaks runs on the caller’s own GITHUB_TOKEN.

name: Floor
on: [push, pull_request]
jobs:
  floor:
    permissions:
      contents: read
    uses: mriechers/github-actions/.github/workflows/floor.yml@

Why the floor lives here and not in the-lodge, which is where the tier model is documented: the-lodge is private, and a reusable workflow in a private repo cannot be called by other repos unless that repo’s Actions access is explicitly widened. A floor definition nothing can consume is not a floor — and that is what happened. As of 2026-08-10 exactly one repo in the fleet ran a secrets scan, and it did so by inlining gitleaks rather than calling the unreachable reusable.

Consuming

Add a caller workflow that forwards the token and grants permissions, e.g.:

name: Claude Code Review
on: