| name | actions-ci |
| description | Author and debug GitHub Actions workflows, automated tests, and CI pipelines the CEDA way. Covers the reusable-workflow orchestration pattern, the uv + matrix test setup, security scanning (bandit/semgrep/codeql/sonarcloud), and release/publish. Use when adding or fixing a workflow, test job, or pipeline in a GitHub repo. |
actions-ci
CEDA GitHub repos use uv-based Python CI. There are two generations — match
the one the repo already uses rather than mixing them.
When this applies
This is a knowledge skill — it loads (explicitly via /actions-ci, or
automatically) when you add or fix a GitHub Actions workflow, a test job, a
coverage/security-scan step, or a release workflow in a CEDA GitHub repo. It is
reference/convention, not a step-by-step procedure. For the GitLab config repos,
use /gitlab-ci instead.
Which generation is this repo on?
- Modern / orchestrated (e.g.
1cijferho): a thin ci.yml that calls
reusable workflows via uses: ./.github/workflows/<name>.yml + workflow_call.
Uses ruff (blocking), uv sync --group dev, and a security suite. Prefer this
for new/serious repos.
- Legacy quartet (e.g.
eencijfer, minio-file, sdp-tools):
dev.yml / preview.yml / release.yml / test.yml, uv pip install -e ".[dev,test]",
flake8/black/isort/mypy run non-blocking (|| true), Codecov upload.
Extend in place; don't rewrite to the modern style unless asked.
Conventions that hold across both
- uv for everything:
astral-sh/setup-uv, actions/setup-python@v5,
Python 3.13 on modern repos (matrix 3.9–3.12 + multi-OS on legacy).
- Triggers:
push/pull_request on main (modern also scans feat/**,fix/**).
actions/checkout@v4; fetch-depth: 0 when a tool needs full history (Sonar).- Windows in the matrix matters here — past pain with
ErrorActionPreference
and Scoop writing to stderr (treat stderr as non-fatal unless exit code≠0).
- Env
PYTHONUTF8: "1" on Windows jobs.
Reusable workflow pattern (modern)
- A leaf workflow declares
on: workflow_call: and does one thing (unit tests,
a MinIO integration run, a pipeline config).
ci.yml wires them as jobs with uses: ./.github/workflows/<leaf>.yml.- Add a new check = new leaf workflow + one
uses: line in ci.yml.
- A workflow under
tests/eencijferho/ is auto-collected by the unit job — no CI
edit needed to add a test file there.
Tests & coverage
uv run pytest tests/... --cov=<import_name> --cov-report=xml (cov target is
the package import name, not a filesystem path).- Integration tests needing services: start MinIO via
docker run, Postgres via
a services: container; install extras with uv sync --group dev --extra minio --extra postgres.
- Merge unit+integration coverage with
--cov-append before uploading to Sonar/Codecov.
- See /gate for reading a failing SonarCloud/CodeQL gate.
Security scanning (modern repos)
- bandit (
bandit[sarif], --severity-level medium), semgrep, codeql,
sonarcloud — each uploads SARIF via github/codeql-action/upload-sarif@v3
with a distinct category. Dependabot for deps.
- Scan steps are typically non-blocking on findings but surface results in the
Security tab.
Release / publish (legacy quartet)
release.yml triggers on v* tags → PyPI trusted publishing
(permissions: id-token: write, environment: pypi). No stored token.
Debugging CI
unset GITHUB_TOKEN && gh run list/view/watch to inspect runs (an invalid
$GITHUB_TOKEN can shadow the gh login, so prefix gh with unset GITHUB_TOKEN &&).- Reproduce failures locally where possible before pushing fix-attempts — avoid
guess-and-check CI loops. Verify a fix actually resolves the failure before
calling it done.
- Heavy Polars tests can segfault under local x86/Rosetta emulation — that's the
dev machine, not CI (native runners are fine).
GitLab note
The *-config GitOps repos use GitLab CI (.gitlab-ci.yml, reusable
.gitlab/*.yaml with spec.inputs), not Actions — see /surf-sdp-helm-flux and /gitlab-ci.
Don't apply Actions patterns there.
Important
- Match the repo's existing generation (modern orchestrated vs legacy
quartet); don't rewrite one style into the other unless asked.
- This skill covers GitHub Actions only — it does NOT apply to the GitLab
config repos (use /gitlab-ci there).
- Reproduce CI failures locally where possible; avoid guess-and-check loops.
- gh auth: prefix
gh with unset GITHUB_TOKEN && (an invalid token may
shadow the login).
- Applies to cedanl repos.
