Composite and Node GitHub Actions and shared Renovate presets, each released under its own tag.
One repository holding the CI parts the other repositories in this account call: the actions under
actions/, and the Renovate presets and branch rulesets under configs/.
Each directory is its own release-please component, so actions/rust/clippy and
actions/bun/setup-cached are versioned and tagged apart from each other. A tag names the component
it belongs to, as actions-<path>-vX.Y.Z or configs-<path>-vX.Y.Z. The tables below carry the
current tag of every component and the uses: line that pins it.
main holds sources only. Each release tag points at a build commit on the releases branch: the
released source commit plus every action bundle, built from it in CI and attested. The
src-<component>-vX.Y.Z tags mark the released source commits on main for release-please and are
not meant to be pinned. docs/release-pipeline.md describes the pipeline,
and SECURITY.md how to verify a release.
Copy a uses: line from the tables below. It pins the released tag to the build commit that tag
points at, and repeats the tag in a trailing comment.
Then extend the shared Renovate preset in your renovate.json:
{
"extends": ["github>TimSchoenle/actions//configs/renovate/base"]
}The preset installs a regex manager that matches exactly that shape. It also turns Renovate's
built-in github-actions manager off for this repository, so a pin written without its # tag=
comment matches nothing and never moves. The versioning regex carries the component prefix through
as its compatibility group. That is what stops a release of actions-rust-clippy being offered as
an upgrade to actions-bun-setup-cached.
The first column links to the action's directory. Its action.yaml declares the inputs and the
outputs. Where an action needs more than that, a README sits next to it.
| Action | Description | Version | Usage |
|---|---|---|---|
| Bun Setup-cached | Sets up a pinned Bun and installs dependencies from the lockfile, with a node_modules cache that by default only trusted events write to. | actions-bun-setup-cached-v4.0.0 | uses: TimSchoenle/actions/actions/bun/setup-cached@49acdef9979f343817ec2a85ddd25e5f34befc8b # tag=actions-bun-setup-cached-v4.0.0 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Close Pull Request | Closes a pull request | actions-common-close-pull-request-v2.0.6 | uses: TimSchoenle/actions/actions/common/close-pull-request@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-close-pull-request-v2.0.6 |
| Commit Changes | Commits changes using the GitHub API to ensure verified bot commits. | actions-common-commit-changes-v3.1.1 | uses: TimSchoenle/actions/actions/common/commit-changes@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-commit-changes-v3.1.1 |
| Common Commit Generated Files | Commits the merged generator patch from a pull_request run to the pull request branch as a GitHub App, from a workflow_run job. | actions-common-commit-generated-files-v1.3.2 | uses: TimSchoenle/actions/actions/common/commit-generated-files@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-commit-generated-files-v1.3.2 |
| Common Commit Patch | Commits a common/create-patch artifact from this run or from the run run_id names as a verified commit, refusing any path outside allowed_paths, under .github/workflows/ or below a symbolic link. | actions-common-commit-patch-v3.1.1 | uses: TimSchoenle/actions/actions/common/commit-patch@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-commit-patch-v3.1.1 |
| Common Create Patch | Uploads the working-tree changes as a binary git patch against HEAD, for common/commit-patch to commit from a job that runs no repository code. Can also upload an empty patch for a given commit without a checkout. | actions-common-create-patch-v2.1.1 | uses: TimSchoenle/actions/actions/common/create-patch@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-create-patch-v2.1.1 |
| Common Download Release Asset | Downloads a GitHub release asset, through the REST API asset endpoint when the release download fails, and verifies it against a pinned SHA-256 or a pinned checksums file. | actions-common-download-release-asset-v1.1.5 | uses: TimSchoenle/actions/actions/common/download-release-asset@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-download-release-asset-v1.1.5 |
| Common Fetch Head | Fetches one commit into an empty repository and points HEAD at it without checking anything out, for steps that read only git objects. | actions-common-fetch-head-v2.0.3 | uses: TimSchoenle/actions/actions/common/fetch-head@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-fetch-head-v2.0.3 |
| Common Find Patch | Reports whether a run uploaded a non-empty common/create-patch artifact, without any secret, so a workflow_run job can skip minting a write token when there is nothing to commit. | actions-common-find-patch-v1.1.5 | uses: TimSchoenle/actions/actions/common/find-patch@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-find-patch-v1.1.5 |
| Common Generated Files Verdict | Fails a pull request while a generator job failed or left changes uncommitted, and merges every pending generator patch into one artifact for common/commit-patch. | actions-common-generated-files-verdict-v1.2.6 | uses: TimSchoenle/actions/actions/common/generated-files-verdict@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-generated-files-verdict-v1.2.6 |
| Common Modify YAML | A action to modify a value in a YAML file while strictly preserving comments and structure | actions-common-modify-yaml-v3.0.1 | uses: TimSchoenle/actions/actions/common/modify-yaml@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-modify-yaml-v3.0.1 |
| Common Read YAML | A action to read a value from a YAML file using dot notation | actions-common-read-yaml-v3.0.1 | uses: TimSchoenle/actions/actions/common/read-yaml@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-read-yaml-v3.0.1 |
| Common Readme Variables | Collect the standard README render payload — repository facts, release, toolchain and a docs index — as strict JSON for render-template | actions-common-readme-variables-v2.1.6 | uses: TimSchoenle/actions/actions/common/readme-variables@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-readme-variables-v2.1.6 |
| Common Render README | Renders README.md from its Handlebars template with the shared README payload, and either uploads the result as a create-patch artifact or fails when the committed file is stale. | actions-common-render-readme-v1.1.3 | uses: TimSchoenle/actions/actions/common/render-readme@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-render-readme-v1.1.3 |
| Create Branch | Creates or resets a git branch using GitHub API. | actions-common-create-branch-v2.0.6 | uses: TimSchoenle/actions/actions/common/create-branch@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-create-branch-v2.0.6 |
| Create Pull Request | Creates or updates a pull request using GitHub App authentication with optional branch reset. | actions-common-create-pull-request-v1.0.32 | uses: TimSchoenle/actions/actions/common/create-pull-request@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-create-pull-request-v1.0.32 |
| Delete-Branch | Deletes a branch from a repository. Fails gracefully if the branch does not exist. | actions-common-delete-branch-v2.0.7 | uses: TimSchoenle/actions/actions/common/delete-branch@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-delete-branch-v2.0.7 |
| Get App Git Identity | Resolves the git identity (username, email, user ID) for a GitHub App bot. | actions-common-get-app-git-identity-v2.0.6 | uses: TimSchoenle/actions/actions/common/get-app-git-identity@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-get-app-git-identity-v2.0.6 |
| Render Template | A action to render a Handlebars template file to an output file from a JSON map of variables, deterministically | actions-common-render-template-v3.0.6 | uses: TimSchoenle/actions/actions/common/render-template@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-render-template-v3.0.6 |
| Render Template And Commit | Renders a Handlebars template to a file and commits the result as a verified bot commit, skipping the commit when the render changed nothing. | actions-common-render-template-and-commit-v1.1.23 | uses: TimSchoenle/actions/actions/common/render-template-and-commit@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-render-template-and-commit-v1.1.23 |
| Setup App Git Identity | Configures git with the identity of a GitHub App bot and outputs the bot details. | actions-common-setup-app-git-identity-v2.0.6 | uses: TimSchoenle/actions/actions/common/setup-app-git-identity@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-setup-app-git-identity-v2.0.6 |
| Upsert Issue | Opens or updates a repository issue, updating the previous issue carrying the same identifier. | actions-common-upsert-issue-v3.0.1 | uses: TimSchoenle/actions/actions/common/upsert-issue@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-upsert-issue-v3.0.1 |
| Upsert PR Comment | Posts a comment on a pull request, updating the previous comment carrying the same identifier. | actions-common-upsert-pr-comment-v3.0.1 | uses: TimSchoenle/actions/actions/common/upsert-pr-comment@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-common-upsert-pr-comment-v3.0.1 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Docker Image Check | Measures a locally loaded image, warns past a size threshold, scans it with Trivy, uploads the SARIF to code scanning and reports the result on the pull request. | actions-docker-image-check-v1.1.17 | uses: TimSchoenle/actions/actions/docker/image-check@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-docker-image-check-v1.1.17 |
| Docker Image Check Summary | Collects the fragments docker/image-check legs uploaded with comment: summary and posts one table of every image on the pull request. | actions-docker-image-check-summary-v2.0.7 | uses: TimSchoenle/actions/actions/docker/image-check-summary@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-docker-image-check-summary-v2.0.7 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Apply Helm Chart Updates | Applies a set of templated image updates to a Helm chart's values.yaml and bumps Chart.yaml, preserving comments and structure. Every image carries its own version and digest. | actions-helm-apply-chart-updates-v2.0.6 | uses: TimSchoenle/actions/actions/helm/apply-chart-updates@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-helm-apply-chart-updates-v2.0.6 |
| Update Helm Chart Version | Updates a Helm chart's image tags, version and appVersion, then opens a Pull Request. Every image carries its own version and digest, so one call can move a chart with many services. This action requires a bot account with access to the charts repo. | actions-helm-update-chart-version-v1.8.1 | uses: TimSchoenle/actions/actions/helm/update-chart-version@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-helm-update-chart-version-v1.8.1 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Helper Verify-branch-name | Verify the head branch of a pull request matches a pattern and check whether it comes from a fork | actions-helper-verify-branch-name-v3.0.1 | uses: TimSchoenle/actions/actions/helper/verify-branch-name@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-helper-verify-branch-name-v3.0.1 |
| Resolve Branch | Resolve the given base branch or return default branch. With optional existence check. | actions-helper-resolve-base-branch-v2.0.6 | uses: TimSchoenle/actions/actions/helper/resolve-base-branch@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-helper-resolve-base-branch-v2.0.6 |
| Verify Commit Authors | Verifies that every commit in a PR is authored by a specific set of users and is either signed by GitHub or committed and signed by one of those users. | actions-helper-verify-commit-authors-v4.0.1 | uses: TimSchoenle/actions/actions/helper/verify-commit-authors@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-helper-verify-commit-authors-v4.0.1 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Java-gradle Auto-spotless | Runs Gradle spotlessApply and uploads the changes as a patch artifact for common/commit-patch to commit from a separate job. Holds no token. | actions-java-gradle-auto-spotless-v2.0.5 | uses: TimSchoenle/actions/actions/java-gradle/auto-spotless@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-java-gradle-auto-spotless-v2.0.5 |
| Java-Gradle Coverage (Codecov) | Action that measures Java and Kotlin test coverage with JaCoCo through Gradle, and uploads the coverage reports and the JUnit test results to Codecov. | actions-java-gradle-coverage-codecov-v1.2.0 | uses: TimSchoenle/actions/actions/java-gradle/coverage-codecov@49acdef9979f343817ec2a85ddd25e5f34befc8b # tag=actions-java-gradle-coverage-codecov-v1.2.0 |
| Java-Gradle default setup | Setup Java and Gradle environment for building, with opinionated default settings | actions-java-gradle-setup-base-environment-v1.2.15 | uses: TimSchoenle/actions/actions/java-gradle/setup-base-environment@dc5b395636dc1954383f11af4062a08814e9b15a # tag=actions-java-gradle-setup-base-environment-v1.2.15 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Maintenance Auto-approve-pr | Auto approve Pull Requests with the given user ids and branches. | actions-maintenance-auto-approve-pr-v3.0.6 | uses: TimSchoenle/actions/actions/maintenance/auto-approve-pr@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-maintenance-auto-approve-pr-v3.0.6 |
| Maintenance Auto-rebase | Updates open pull requests carrying a label with the latest commits of their base branch, oldest first, through the update-branch API, which merges the base into the head. | actions-maintenance-auto-rebase-v4.0.1 | uses: TimSchoenle/actions/actions/maintenance/auto-rebase@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-maintenance-auto-rebase-v4.0.1 |
| Maintenance Ensure-actions-are-executed | Ensures selected checks completed successfully when they were started. | actions-maintenance-ensure-actions-are-executed-v2.0.6 | uses: TimSchoenle/actions/actions/maintenance/ensure-actions-are-executed@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-maintenance-ensure-actions-are-executed-v2.0.6 |
| Maintenance Timed-auto-merge | Approve and enable auto-merge on aged pull requests whose head branch matches a pattern and whose commits are all signed by trusted authors. | actions-maintenance-timed-auto-merge-v3.1.0 | uses: TimSchoenle/actions/actions/maintenance/timed-auto-merge@cdf0c936c64b4c077d28fc78b083dc6d6f25c3c6 # tag=actions-maintenance-timed-auto-merge-v3.1.0 |
| Maintenance Trigger-coderabbit-review | Posts a CodeRabbit review command on a pull request as a user account, for repositories CodeRabbit no longer reviews automatically. Skips drafts, closed pull requests, forks and bot authors, and refuses a token that is not a user token. | actions-maintenance-trigger-coderabbit-review-v2.0.3 | uses: TimSchoenle/actions/actions/maintenance/trigger-coderabbit-review@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-maintenance-trigger-coderabbit-review-v2.0.3 |
| Maintenance Wipe-cache | Deletes every GitHub Actions cache entry recorded for one branch or one pull request merge ref. Refuses the default branch unless allow_default_branch is true. | actions-maintenance-wipe-cache-v3.1.1 | uses: TimSchoenle/actions/actions/maintenance/wipe-cache@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-maintenance-wipe-cache-v3.1.1 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Release Build Actions | Builds JavaScript actions from source with a caller-supplied command, checks that every bundle their manifests name exists, and uploads the bundles with a manifest of their SHA-256 digests as one artifact for release/install-built-actions. | actions-release-build-actions-v1.1.2 | uses: TimSchoenle/actions/actions/release/build-actions@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-release-build-actions-v1.1.2 |
| Release Install Built Actions | Downloads a release/build-actions artifact by ID, verifies every file against the manifest hash the build job published, and copies the bundles into a checkout, so the actions there run on bundles built from that commit. | actions-release-install-built-actions-v1.1.2 | uses: TimSchoenle/actions/actions/release/install-built-actions@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-release-install-built-actions-v1.1.2 |
| Release Plan Release Please | Reads release-please state at a commit, read-only. preflight checks that every package has the source tag of its manifest version; plan reports whether the commit merges a pending release pull request and, if so, every release with its tags, name and notes. | actions-release-plan-release-please-v1.1.2 | uses: TimSchoenle/actions/actions/release/plan-release-please@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-release-plan-release-please-v1.1.2 |
| Release Publish Build Commit | Publishes bundles built by release/build-actions: a build commit B with the source commit tree plus the bundles, a fast-forwarded releases branch, consumer tags on B, source tags on the source commit, and GitHub Releases with checksum assets. Every step is idempotent and no repository code runs. | actions-release-publish-build-commit-v2.0.1 | uses: TimSchoenle/actions/actions/release/publish-build-commit@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-release-publish-build-commit-v2.0.1 |
| Release Resolve Actions | Resolves which actions of a checkout have to be built for a set of actions or workflows to run, or which a set of changed files affects: the build directories, the bundle paths and the source paths to filter triggers on. | actions-release-resolve-actions-v1.1.2 | uses: TimSchoenle/actions/actions/release/resolve-actions@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-release-resolve-actions-v1.1.2 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Rust Auto-format | Runs cargo fmt and uploads the changes as a patch artifact for common/commit-patch to commit from a separate job. Holds no token. | actions-rust-auto-format-v2.0.5 | uses: TimSchoenle/actions/actions/rust/auto-format@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-rust-auto-format-v2.0.5 |
| Rust Cargo-check | Action that runs cargo check to verify Rust code compiles without errors. | actions-rust-cargo-check-v2.0.0 | uses: TimSchoenle/actions/actions/rust/cargo-check@49acdef9979f343817ec2a85ddd25e5f34befc8b # tag=actions-rust-cargo-check-v2.0.0 |
| Rust Clippy | Action that runs clippy to catch common mistakes and improve your Rust code. | actions-rust-clippy-v2.0.0 | uses: TimSchoenle/actions/actions/rust/clippy@49acdef9979f343817ec2a85ddd25e5f34befc8b # tag=actions-rust-clippy-v2.0.0 |
| Rust Config Contract | Action that checks a terrace-config contract, its Dockerfile LABEL block and a built image against the configuration types they claim to describe. | actions-rust-config-contract-v2.0.6 | uses: TimSchoenle/actions/actions/rust/config-contract@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-rust-config-contract-v2.0.6 |
| Rust Coverage (Codecov) | Action that measures Rust test coverage with cargo llvm-cov and nextest, and uploads the coverage report and the JUnit test results to Codecov. | actions-rust-coverage-codecov-v2.1.0 | uses: TimSchoenle/actions/actions/rust/coverage-codecov@49acdef9979f343817ec2a85ddd25e5f34befc8b # tag=actions-rust-coverage-codecov-v2.1.0 |
| Rust Test | Action that runs cargo nextest to verify Rust code passes tests. | actions-rust-test-v2.0.0 | uses: TimSchoenle/actions/actions/rust/test@49acdef9979f343817ec2a85ddd25e5f34befc8b # tag=actions-rust-test-v2.0.0 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Security CodeQL | Runs CodeQL on one language with build-mode none, excluding test sources so fixtures and assertion messages do not raise alerts, and uploads the result to code scanning. | actions-security-codeql-v1.1.12 | uses: TimSchoenle/actions/actions/security/codeql@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-security-codeql-v1.1.12 |
| Security Jactionlint | Installs a checksum-verified jactionlint release, checks the workflows, composite actions and Dependabot config, annotates the findings, uploads the SARIF to code scanning under the category jactionlint, and fails the job when a finding counts. | actions-security-jactionlint-v1.1.4 | uses: TimSchoenle/actions/actions/security/jactionlint@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-security-jactionlint-v1.1.4 |
| Security Zizmor | Runs zizmor over workflows and actions with strict collection, uploads the SARIF to code scanning under the category zizmor, and fails the job on an input zizmor cannot parse or a finding at or above a severity. | actions-security-zizmor-v2.0.7 | uses: TimSchoenle/actions/actions/security/zizmor@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-security-zizmor-v2.0.7 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Terrace Helm Check | Runs every offline configuration contract gate over the charts a change touched, with terrace-contract sync --check. Findings become annotations and a job summary. Writes nothing and needs no write token. | actions-terrace-helm-check-v1.1.4 | uses: TimSchoenle/actions/actions/terrace/helm-check@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-terrace-helm-check-v1.1.4 |
| Terrace Helm Diff | Reports how the vendored configuration contracts changed against a base revision and what each change costs the charts, with terrace-contract diff. The report goes to the job summary and, given a token, into one pull request comment that later runs update. Never fails on differences. | actions-terrace-helm-diff-v1.1.4 | uses: TimSchoenle/actions/actions/terrace/helm-diff@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-terrace-helm-diff-v1.1.4 |
| Terrace Helm Sync | Brings every file derived from the vendored configuration contracts up to date with terrace-contract sync: pulls each contract from the image its chart pins, then rewrites the value schemas and README credential references. Given a token, commits the result to the branch as a verified commit. | actions-terrace-helm-sync-v1.1.4 | uses: TimSchoenle/actions/actions/terrace/helm-sync@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-terrace-helm-sync-v1.1.4 |
| Terrace Image | Holds a service image to the configuration contract its build produced, in any language: the document against the specification, the committed document against its generator, the Dockerfile label block against the document, and the built image itself, read through oras. Optionally attaches the document to the image digest and signs it. | actions-terrace-image-v1.1.5 | uses: TimSchoenle/actions/actions/terrace/image@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-terrace-image-v1.1.5 |
| Terrace Setup | Installs a signature-verified terrace-contract release on PATH, together with cosign and, when asked, oras. The version comes from the version input or from the cli pin in terrace.yaml. | actions-terrace-setup-v4.0.2 | uses: TimSchoenle/actions/actions/terrace/setup@0b3967d3d992d12aa88da1f8facf412b162d5ab2 # tag=actions-terrace-setup-v4.0.2 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Setup E2E Test | Sets up the environment for E2E testing: generates token, checks out test repo, and checks out actions code. | actions-test-setup-e2e-v1.2.7 | uses: TimSchoenle/actions/actions/test/setup-e2e@daf766fd1ab9d48129210afc63b1a7353f6064fd # tag=actions-test-setup-e2e-v1.2.7 |
The Renovate presets are consumed through extends. The ruleset files are GitHub's own export
format: download one and import it under the repository's Settings, then Rules.
Each Checkstyle ruleset lives in its own directory under configs/checkstyle/, alongside a
configs/checkstyle/_shared/ directory holding Lombok-annotation suppressions common to every
ruleset. Checkstyle's ${config_loc} is a convention property your build tool sets to a local
directory (Gradle's checkstyle.configDirectory, Maven's propertyExpansion) — it is never
derived from a remote configLocation URL — so a ruleset only resolves its suppression files, its
../_shared/ sibling included, once you vendor both directories into your project and point your
build tool's config directory at your copy of the ruleset directory.
| Config | Description |
|---|---|
| Default Branch: Default Protection Rules | Enforces standard protection rules on the default branch: requires squash-merged PRs with 1 approval that a new push dismisses, plus an extra approval for unattributed changes, signed commits, no force pushes, CodeQL code scanning, and the required status checks listed in scripts/lib/required-checks.ts. |
| Release Please Branches: Trusted Bots & Admins Only | Restricts access to release-please branches, allowing only trusted bots and admins to create, update, or delete them, while enforcing code quality, code scanning and signature requirements. |
| Release Tags: Only Allow Automatic Release Manager Bot | Enforces that only the Automatic Release Manager bot can create, update, or delete release tags. |
| Releases Branch: Only Allow Release Bot | Protects the releases branch that every build commit is chained on: nobody else can create, update, delete or rewind it, or push an unsigned commit to it. The Automatic Release Manager bot bypasses every rule here; release/publish-build-commit only ever fast-forwards it with signed commits. |
| Renovate Branches: Trusted Bots & Admins Only | Restricts access to Renovate branches, allowing only trusted bots (Renovate and the repository's GitHub Apps) and admins to manage them, while enforcing code quality, code scanning and signature requirements. |
| Config | Description | Usage |
|---|---|---|
| actions | Versioning rules for all custom Github Actions defined in this repository | "extends": ["github>TimSchoenle/actions//configs/renovate/actions"] |
| base | Base configuration to handle custom versioning for all resources in this repository. | "extends": ["github>TimSchoenle/actions//configs/renovate/base"] |
| ci-automerge | Auto-merge rules for all none major Github Actions including custom actions defined in this repository. | "extends": ["github>TimSchoenle/actions//configs/renovate/ci-automerge"] |
| default | Default configuration for Renovate | "extends": ["github>TimSchoenle/actions//configs/renovate/default"] |
| rust-application | Rust applications: rust-toolchain plus rust-version in every Cargo.toml, moved in the same rust toolchain pull request. Not for libraries: there rust-version is the MSRV, a compatibility promise raised by decision, not a pin to keep current. |
"extends": ["github>TimSchoenle/actions//configs/renovate/rust-application"] |
| rust-toolchain | Rust toolchain for any Rust repository: channel in rust-toolchain.toml and every rust Docker image tag move in one pull request that cannot ship half-done. Never touches rust-version in Cargo.toml; applications that want it moved too extend rust-application instead. |
"extends": ["github>TimSchoenle/actions//configs/renovate/rust-toolchain"] |
| Config | Description | Version |
|---|---|---|
| Application | Latest Palantir Baseline Checkstyle plus strict final locals/parameters, explicit this qualification, and Lombok-annotation-aware suppressions, for application and service code. Unlike the Library ruleset, it omits DesignForExtension and JavadocMethod since this code has no public API surface to document or keep extension-safe. |
configs-checkstyle-application-v1.0.2 |
| Library | Latest Palantir Baseline Checkstyle plus strict final locals/parameters, explicit this qualification, and Lombok-annotation-aware suppressions. Enforces DesignForExtension and a strengthened JavadocMethod so every public and protected member of the library's API is documented and safe to extend. |
configs-checkstyle-library-v1.0.2 |
Vendor configs/checkstyle/application/ and configs/checkstyle/_shared/ into your project, then point your build tool's config directory (Gradle configDirectory, Maven config_loc) at your copy of configs/checkstyle/application/. Or depend on it directly via JitPack, no vendoring or config directory required:
Gradle (Kotlin DSL)
val checkstyleConfig: Configuration by configurations.creating
repositories {
maven { url = uri("https://jitpack.io") }
}
checkstyle {
toolVersion = "<your checkstyle version>"
config = resources.text.fromArchiveEntry(checkstyleConfig, "checkstyle.xml")
}
dependencies {
checkstyleConfig("de.timscho.actions:checkstyle-application:configs-checkstyle-application-v1.0.2")
checkstyle("de.timscho.actions:checkstyle-application:configs-checkstyle-application-v1.0.2")
checkstyle("com.puppycrawl.tools:checkstyle:${checkstyle.toolVersion}")
}Maven
<repositories>
<repository>
<id>jitpack.io</id>
<url>https://jitpack.io</url>
</repository>
</repositories>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>
<configuration>
<configLocation>checkstyle.xml</configLocation>
</configuration>
<dependencies>
<dependency>
<groupId>de.timscho.actions</groupId>
<artifactId>checkstyle-application</artifactId>
<version>configs-checkstyle-application-v1.0.2</version>
</dependency>
</dependencies>
</plugin>
</plugins>
</build>Vendor configs/checkstyle/library/ and configs/checkstyle/_shared/ into your project, then point your build tool's config directory (Gradle configDirectory, Maven config_loc) at your copy of configs/checkstyle/library/. Or depend on it directly via JitPack, no vendoring or config directory required:
Gradle (Kotlin DSL)
val checkstyleConfig: Configuration by configurations.creating
repositories {
maven { url = uri("https://jitpack.io") }
}
checkstyle {
toolVersion = "<your checkstyle version>"
config = resources.text.fromArchiveEntry(checkstyleConfig, "checkstyle.xml")
}
dependencies {
checkstyleConfig("de.timscho.actions:checkstyle-library:configs-checkstyle-library-v1.0.2")
checkstyle("de.timscho.actions:checkstyle-library:configs-checkstyle-library-v1.0.2")
checkstyle("com.puppycrawl.tools:checkstyle:${checkstyle.toolVersion}")
}Maven
<repositories>
<repository>
<id>jitpack.io</id>
<url>https://jitpack.io</url>
</repository>
</repositories>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>
<configuration>
<configLocation>checkstyle.xml</configLocation>
</configuration>
<dependencies>
<dependency>
<groupId>de.timscho.actions</groupId>
<artifactId>checkstyle-library</artifactId>
<version>configs-checkstyle-library-v1.0.2</version>
</dependency>
</dependencies>
</plugin>
</plugins>
</build>docs/ holds the two writing standards every repository in this account is held to, which other
repositories link from their own CONTRIBUTING.md instead of keeping a copy, and how this repository
releases.
| Document | Purpose |
|---|---|
| docs/readme/README.md | What a README contains and in what order, how its prose is written, the template it starts from and the CI job that keeps it rendered. |
| docs/doc-comments/README.md | What carries a doc comment and what it says, with an annex each for Rust, Java and TypeScript. |
| docs/release-pipeline.md | How a release is built, attested and published on a build commit, the runbook for a failed release, the repository settings it needs and how to roll it back. |
| docs/adopting-build-on-release.md | Reference release workflows for another repository: a single action at the root, and a release-please monorepo. |
Issues and pull requests are welcome. CONTRIBUTING.md covers the commit convention release-please reads, the interactive generators that scaffold a new action, and the checks CI runs. This file and SECURITY.md are generated. An edit to either is reverted on the next pull request.
Do not open a public issue for a vulnerability. SECURITY.md has the private reporting route and the list of supported versions.
Every action and config here is published under the terms in LICENSE.