ci-workflows

# CI Workflow Standards ## When to Use This Skill | Use this skill when... | Use a sibling skill instead when... | |---|---| | You need the canonical GitHub Actions workflow shapes (container build, test, release) | You want to audit or install workflows end-to-end as an interactive workflow — use `configure-workflows` | | You are checking whether existing `.github/workflows/*.yml` follows the documented conventions | You want pre-built reusable callers wired up — use `configure-reusable-workflows` | | Another skill needs to cite the standard workflow structure | The user asked you to actually create or repair CI workflows | ## Version: 2025.1 Standard GitHub Actions workflows for CI/CD automation. ## Display name convention Every workflow's `name:` follows `<Domain>: <Action> [<target>]` so the GitHub Actions sidebar groups related workflows alphabetically. Quote the value because YAML treats `:` inside an unquoted scalar as a key separator. See `.claude/rules/workflow-naming.md` for the canonical rule, the active domain list, and the cross-workflow rename procedure. Mirror the pattern in any workflow you scaffold here. ## Required Workflows Full YAML, key features, and prerequisites for each file live in [references/workflow-templates.md](references/workflow-templates.md) — read it when citing, diffing against, or scaffolding a specific workflow. | # | Workflow | File | Status | |---|----------|------|--------| | 1 | [Container Build](references/workflow-templates.md#1-container-build-workflow) | `.github/workflows/container-build.yml` | Required if Dockerfile | | 2 | Release Please | `.github/workflows/release-please.yml` | Required | | 3 | [ArgoCD Auto-merge](references/workflow-templates.md#3-argocd-auto-merge-workflow-optional) | `.github/workflows/argocd-automerge.yml` | Optional | | 4 | [Test](references/workflow-templates.md#4-test-workflow-recommended) | `.github/workflows/test.yml` | Recommended | | 5 | [Claude Auto-Fix](references/workflow-templates.md#5-claude-auto-fix-workflow-optional) | `.github/workflows/claude-auto-fix.yml` | Optional | ### 2. Release Please Workflow **File**: `.github/workflows/release-please.yml` See `configure-release-please` (its REFERENCE.md carries the standard workflow, token, and config templates) for details. ## Workflow Standards ### Action Versions | Action | Version | Purpose | |--------|---------|---------| | actions/checkout | v6 | Repository checkout | | docker/setup-buildx-action | v4 | Multi-platform builds | | docker/login-action | v4 | Registry authentication | | docker/metadata-action | v6 | Image tagging | | docker/build-push-action | v7 | Container build/push | | actions/setup-node | v6 | Node.js setup | | googleapis/release-please-action | v5 | Release automation | ### Permissions Minimal permissions required: ```yaml permissions: contents: read # Default for most jobs packages: write # For container push to GHCR pull-requests: write # For release-please PR creation ``` ### Triggers Standard trigger patterns: ```yaml # Build on push and PR to main on: push: branches: [main] pull_request: branches: [main] # Also build on release on: release: types: [published] ``` ### Build Caching Use GitHub Actions cache for Docker layers: ```yaml cache-from: type=gha cache-to: type=gha,mode=max ``` ### Multi-Platform Builds Build for both amd64 and arm64: ```yaml platforms: linux/amd64,linux/arm64 ``` ## Compliance Requirements ### Required Workflows | Workflow | Purpose | Required | |----------|---------|----------| | container-build | Container builds | Yes (if Dockerfile) | | release-please | Automated releases | Yes | | test | Testing and linting | Recommended | | argocd-automerge | Auto-merge image updates | Optional (if using ArgoCD Image Updater) | | claude-auto-fix | Automated CI failure remediation | Optional | ### Required Elements | Element | Requirement | |---------|-------------| | checkout action | v6 | | build-push action | v7 | | Multi-platform | amd64 + arm64 | | Caching | GHA cache enabled | | Permissions | Explicit and minimal | ## Status Levels | Status | Condition | |--------|-----------| | PASS | All required workflows present with compliant config | | WARN | Workflows present but using older action versions | | FAIL | Missing required workflows | | SKIP | Not applicable (no Dockerfile = no container-build) | ## Secrets Required | Secret | Purpose | Required | |--------|---------|----------| | GITHUB_TOKEN | Container registry auth | Auto-provided | | SENTRY_AUTH_TOKEN | Source map upload | If using Sentry | | MY_RELEASE_PLEASE_TOKEN | Release PR creation | For release-please | | CLAUDE_CODE_OAUTH_TOKEN | Claude Code Action auth | For claude-auto-fix | ## Troubleshooting Build failures, multi-platform issues, and cache misses: see [references/troubleshooting.md](references/troubleshooting.md) when a compliant workflow still fails at runtime.