vionix-github-platform

name

vionix-github-platform

description

Explain how the Viasat/vionix repository is organized (reusable workflows, reusable actions under actions/, products under products/) and enforce the GitHub Action mirror consolidation rules from . Use this skill whenever the user asks how this repo works, where to add a workflow/action/product, how mirrors are handled, or when replacing/removing a pre-LookinGlass mirror repo from the vionix organization — especially before deleting ANY mirror repository.

Vionix GitHub Platform Repository

This mono-repo is the DevSecOps platform for GitHub automation at Viasat. Everything is versioned together and consumed by reference (uses: org/repo/path@ref) from workflows across the enterprise (<git-host>).

Repository layout

Directory	What lives here	Who consumes it
.github/workflows/	Reusable workflows (workflow_call) and this repo's own CI	Our team AND any other enterprise org (e.g. docker-compose-devsecops-workflow.yaml, github-ghas-* workflows)
actions/	Reusable actions — better abstractions over raw actions/APIs, organized by category (ai/, build/, docker/, github/, messaging/, network/, oauth/, platform/, secrets/)	Primarily the reusable workflows in this repo; also usable by anyone else if desired
products/	Products — complete IssueOps/automation suites, one directory per product (lookinglass/, lift/)	Our org and other orgs that install the product workflows
skills/	Agent skills for working with this platform (github-lookinglass, create-reusable-action, this skill)	Agents/humans automating platform tasks
docs/	Long-lived records and documentation, e.g. docs/EXTERNAL-MIRROR-ACTIONS.md	Maintainers

Reference conventions:

• Reusable workflow: Viasat/vionix/.github/workflows/{workflow}.yaml@{version}
• Reusable action: Viasat/vionix/actions/{category}/{action}@{version}
• Product action: Viasat/vionix/products/{product}/{domain}/{action}@{version}

History: mirrors before LookinGlass

Before the Vionix LookinGlass product existed, github.com actions were mirrored ad hoc as standalone repositories under the vionix organization (repos with an About/description like "Mirror from https://github.com/ORG/REPO", or "forked from ..."). As a result the organization accumulated far too many local action repos that are:

• not maintained or synced by LookinGlass (stale references, old versions);
• scanned by GHAS/Dependabot, accumulating open CVEs that drag down the Vionix org security posture;
• in several cases, not used anywhere at all.

The full problem and solution are described in . The tracking record for this consolidation lives in docs/EXTERNAL-MIRROR-ACTIONS.md.

Mirror consolidation rules ()

1. Mirrors live in the github organization, managed by LookinGlass. The upstream github.com/ORG/REPO maps to <git-host>/github/ORG-REPO and is referenced as github/ORG-REPO@VERSION (e.g. pozil/auto-assign-issue@v1.4.0). See the github-lookinglass skill to file mirror requests.
2. Never create a new mirror under vionix. File a LookinGlass IssueOps request instead.
3. Migration procedure for each pre-LookinGlass mirror:
   1. Find the upstream URL in the old repo About/description ("Mirror from ...").
   2. Confirm where the mirror is referenced (this repo's reusable workflows, reusable actions, products — and other orgs such as github, Mobility-Engineering).
   3. If used, file the LookinGlass request with that upstream URL, using the referencing repo/file as the Primary Usecase Url.
   4. After the github/ORG-REPO mirror exists, swap references in separate PRs by kind: one PR for "GitHub Reusable Workflows" (.github/workflows/), one for "GitHub Reusable Actions" (actions/), one for "Vionix Products" (products/). Do them one by one and rebase each PR onto the previous one to avoid conflicts.
   5. Only after all references are migrated, retire the old repo following the BIG NOTE rules below.

BIG NOTE: retiring old mirror repositories

When an action is used outside of our GitHub organization (visible via our API), we must NOT delete that repository from vionix. We MUST change it to Archived, and then add an ARCHIVED.md file under the root directory of this workflows repository recording that.

Operationally, before retiring ANY old mirror repo:

1. Search GHES for references outside vionix (e.g. GH_HOST=<git-host> gh api 'search/code?q="Viasat/REPO"' ... and check consuming orgs, especially github and Mobility-Engineering).
2. External references found → archive the repo (never delete) and record it in ARCHIVED.md at this repo's root (create the file if it does not exist yet).
3. Internal references only → migrate them first (step 3.4 above), then delete the repo.
4. No references → record the evidence in docs/EXTERNAL-MIRROR-ACTIONS.md, then delete.
5. Update docs/EXTERNAL-MIRROR-ACTIONS.md status in the same change.

Useful commands

# List remaining mirror repos in the org (description-based)
GH_HOST=<git-host> gh api --paginate 'orgs/Viasat/repos?per_page=100' \
  --jq '.[] | select((.description // "") | test("mirror|fork"; "i")) | [.name, (.archived|tostring), .description] | @tsv'

# List every action referenced by this repo (tracked files only)
git grep -h 'uses:' HEAD | sed -E 's/.*uses:[[:space:]]*//; s/["'"'"']//g' | sort | uniq -c | sort -rn