一键在 Manus 中运行任何 Skill

actions-reusable-workflows

星标2

分支2

更新时间2026年7月1日 10:28

Wire a repository to the bitwise-media-group/github-workflows reusable workflows — thin caller workflows for CI, CodeQL, release (release-please/GoReleaser), and the signature-preserving fast-forward /merge, merge-notice, and Dependabot auto-merge flows — plus the Makefile consumer contract, @v2 pinning, and FF Merge org setup. Use when setting up CI, CodeQL, releases, or auto-merge for a repo, adding a caller that uses the shared/reusable workflows, scaffolding a repo's .github/ with the org's standard automation, or asked which reusable workflow to call and what to grant it.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

bitwise-media-group

bitwise-media-group/skills

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

Wire the bitwise reusable workflows

The org centralises CI, CodeQL, release, and the fast-forward /merge automation in the bitwise-media-group/github-workflows library. A consuming repo keeps a thin caller in .github/workflows/ that owns its triggers and grants a permission ceiling, then delegates the work to a reusable workflow with uses:. Copy a caller from this skill's templates/ directory and pin it.

Author bespoke workflows with the actions-style skill, harden them with actions-security, and run actions-validate before committing.

1. The caller pattern

The caller declares on:, sets the permissions: ceiling the reusable workflow's jobs need (a reusable workflow can never exceed the caller's grant), and calls one workflow per job:

name: Continuous integration
on:
  push:
    branches: [main]
  pull_request:
    branches: ["main", "releases/*"]
permissions:
  contents: read
jobs:
  ci:
    uses: bitwise-media-group/github-workflows/.github/workflows/ci.yaml@v2

A caller may add product-specific jobs (an integration job, say) alongside the reusable-workflow job. None of these workflows use pull_request_target to run PR code.

2. Catalog

Each workflow has a ready-to-copy template; grant exactly the listed ceiling and nothing more. None of these run PR code or use pull_request_target unsafely.

ci.yaml (template) — canonical Makefile gates (lint/build/test) plus Codecov upload. Caller grants contents: read. Inputs: e2e (default false), go-version-file, node-version-file, cache-dependency-path. No secrets.
codeql.yaml (template) — CodeQL over actions + go + javascript-typescript, by detection. Caller grants security-events: write, packages: read, actions: read, contents: read. Inputs: go-version-file, config-file (pass ./.github/codeql/codeql-config.yaml, template, to exclude a bundled dist/). No secrets.
release.yaml (template) — release-please → GoReleaser (when a .goreleaser.yaml exists) or a dist/ rebuild + verify. Caller grants contents/issues/pull-requests: write, plus id-token/attestations/artifact-metadata: write for the GoReleaser path only. Inputs: vanity-tags (default false; set it for Actions/reusable repos pinned @v1). Optional secret homebrew-tap-token.
merge.yaml (template) — signature-preserving fast-forward /merge plus set-and-forget auto-merge. Caller grants permissions: {} (the App token does the privileged work). Inputs: app-client-id (required), require-approval/maintainer-only (default true), label, merge-command, arm-command. Required secret app-private-key.
merge-notice.yaml (template) — posts a one-time "this repo merges via /merge" comment on new PRs. Caller grants pull-requests: write. Input: pr-number (required). No secrets.
dependabot-merge.yaml (template) — auto-approves Dependabot minor/patch PRs and fast-forwards them once CI is green. Caller grants permissions: {}. Inputs: app-client-id (required), update-types. Required secret app-private-key.

The merge flows also need a dependabot.yaml and the org setup in §5.

3. The consumer contract

The reusable workflows stay config-free by assuming a small contract — the Makefile is the language boundary, and toolchains are set up from marker files at the repo root:

Makefile targets lint, build, test (emitting coverage/cobertura-coverage.xml), and e2e. Stub any that don't apply as a no-op so make <target> always succeeds:
```
build: ## no-op: nothing to build
	@:
```
Toolchain detection — a root go.mod selects Go (setup-go); a package.json selects Node (setup-node + npm ci). A tools-only go.work + tools/go.mod is dev tooling, not a Go product, so it does not trigger the Go path.
Release — release-please-config.json + .release-please-manifest.json; an optional .goreleaser.yaml (release-type: go, draft: true) selects the GoReleaser path, otherwise the publish path rebuilds via make build and verifies a committed dist/.

4. Pinning

The templates pin @v2, the floating major tag that moves to each release in the v2.x line (the matching minor tag @v2.1 moves too). Pin to a release tag (@v2.1.0) or a full commit SHA for stricter supply-chain guarantees; Dependabot's github-actions ecosystem can bump either. Avoid @main except for short-lived testing against a feature branch.

5. Fast-forward merge: org setup

merge.yaml, dependabot-merge.yaml, and merge-notice.yaml drive the bitwise-media-group/ff-merge action via a short-lived GitHub App token (so commit signatures survive). The one-time, org-wide setup — the "FF Merge" App, its ruleset bypass, the FF_MERGE_CLIENT_ID variable, and the FF_MERGE_PRIVATE_KEY secret — is documented in bitwise-media-group/ff-merge. The contract is input app-client-id (from vars.FF_MERGE_CLIENT_ID) + secret app-private-key (from secrets.FF_MERGE_PRIVATE_KEY); align older callers using client-id/app-key to these names. The merge flows also require branch protection that requires PR review.

同仓库更多 Skills

同仓库

demo-greeter

bitwise-media-group/skills

Render a friendly greeting banner for a named person into a GREETING.txt file. Use when asked to greet someone, write a welcome banner, or produce a personalized hello message saved to a file.

2026-07-012

workflow-commit

bitwise-media-group/skills

Commit changes the way a sandboxed agent must — write Conventional Commit messages and, because commit signing fails inside the sandbox, hand the real commit off through a generated commit.sh script. Inside a git worktree, commit normally (unsigned) and emit a commit.sh that re-signs the range; in the main checkout, do not commit at all — emit a commit.sh containing the exact git add and git commit invocations for the user to run. Use when committing changes, creating a git commit, staging and committing work, writing or formatting a commit message, splitting changes into separate commits, or when an agent or sandbox cannot sign commits and must hand the commit off to the user. Not for pushing, opening or merging pull requests, rebasing or amending existing history, tagging releases, or non-git version control.

2026-07-012

workflow-security-report

bitwise-media-group/skills

Triage a GitHub code-scanning (CodeQL) finding and produce an immutable Markdown triage report plus an index row, recommending remediation or dismissal, with a permalink pinned to the finding's commit SHA for every code reference so the report stays valid after the code moves. Use when triaging, dismissing, or remediating a code-scanning or CodeQL alert or finding; writing a security finding report; recording why an alert is a false positive or how it was fixed; or maintaining security/code-scanning/index.md and the SECURITY.md triage reference. Takes a finding number or finding URL, fetches details with the gh CLI, assumes the current repository when only a number is given, and refuses findings that do not exist or are already closed. Not for Dependabot or dependency alerts, secret-scanning alerts, runtime incident response, or writing a threat model.

2026-07-012

workflow-skill-evals

bitwise-media-group/skills

Write the evolve evaluation suite for an agent skill: its triggers (triggers.json — Tier 1 activation tests) and behavioral evals (evals.json — Tier 2 task tests), under evals/<skill>/. Use when asked to generate, write, author, scaffold, or balance an eval suite, evals, or triggers for a skill; to create or edit a triggers.json or evals.json; to add behavioral evals to a SKILL.md; to add or rebalance positive and near-miss negative trigger cases; or to measure or evaluate whether a skill activates and fires on the right prompts and does its job. Follows the evolve evaluations guide and the JSON Schemas it links, fetched at author time so it tracks new assertion types and fields. Prefers deterministic assertions (file_exists, regex, command, tool_call) over the LLM judge. Not for running or sweeping existing suites, writing application unit tests, or comparing model quality.

2026-07-012

go-docs

bitwise-media-group/skills

Go documentation conventions — a doc comment on every exported function, struct, type, and package, package comments in a dedicated doc.go for multi-file packages, godoc style (complete sentences beginning with the identifier's name), and LLM-ready CLI reference generation for cobra tools via a docgen helper built on cobra/doc. Use when writing or reviewing doc comments or godoc in Go code, adding a doc.go or writing a package comment for a Go package, documenting an exported Go API, package, function, or struct, deciding where a package comment or doc.go belongs, or generating markdown CLI documentation for a cobra-based Go tool. Not for OpenAPI/REST API specs.

2026-07-012

go-project

bitwise-media-group/skills

Scaffold a Go project with the canonical layout — cmd/ entrypoints with a thin main, private packages under internal/ (no pkg/), a separate tools module pinning Go developer CLIs (invoked directly via go tool -modfile=tools/go.mod, no GOBIN), Node tools pinned in package.json and run from node_modules/.bin, and a Makefile whose pr target runs the full local gate. Use when creating a new Go project, service, or repository, or restructuring an existing Go repo to the standard layout; pinning Go or Node developer tooling or adding a tools module to an existing repo; creating or adding a Makefile with the standard targets (pr, fmt, vet, test, fuzz, build); or deciding where Go code should live (internal vs pkg).

2026-07-012

name	actions-reusable-workflows
description	Wire a repository to the bitwise-media-group/github-workflows reusable workflows — thin caller workflows for CI, CodeQL, release (release-please/GoReleaser), and the signature-preserving fast-forward /merge, merge-notice, and Dependabot auto-merge flows — plus the Makefile consumer contract, @v2 pinning, and FF Merge org setup. Use when setting up CI, CodeQL, releases, or auto-merge for a repo, adding a caller that uses the shared/reusable workflows, scaffolding a repo's .github/ with the org's standard automation, or asked which reusable workflow to call and what to grant it.
license	MIT

Wire the bitwise reusable workflows

Author bespoke workflows with the actions-style skill, harden them with actions-security, and run actions-validate before committing.

1. The caller pattern

The caller declares on:, sets the permissions: ceiling the reusable workflow's jobs need (a reusable workflow can never exceed the caller's grant), and calls one workflow per job:

name: Continuous integration
on:
  push:
    branches: [main]
  pull_request:
    branches: ["main", "releases/*"]
permissions:
  contents: read
jobs:
  ci:
    uses: bitwise-media-group/github-workflows/.github/workflows/ci.yaml@v2

A caller may add product-specific jobs (an integration job, say) alongside the reusable-workflow job. None of these workflows use pull_request_target to run PR code.

2. Catalog

Each workflow has a ready-to-copy template; grant exactly the listed ceiling and nothing more. None of these run PR code or use pull_request_target unsafely.

ci.yaml (template) — canonical Makefile gates (lint/build/test) plus Codecov upload. Caller grants contents: read. Inputs: e2e (default false), go-version-file, node-version-file, cache-dependency-path. No secrets.
codeql.yaml (template) — CodeQL over actions + go + javascript-typescript, by detection. Caller grants security-events: write, packages: read, actions: read, contents: read. Inputs: go-version-file, config-file (pass ./.github/codeql/codeql-config.yaml, template, to exclude a bundled dist/). No secrets.
release.yaml (template) — release-please → GoReleaser (when a .goreleaser.yaml exists) or a dist/ rebuild + verify. Caller grants contents/issues/pull-requests: write, plus id-token/attestations/artifact-metadata: write for the GoReleaser path only. Inputs: vanity-tags (default false; set it for Actions/reusable repos pinned @v1). Optional secret homebrew-tap-token.
merge.yaml (template) — signature-preserving fast-forward /merge plus set-and-forget auto-merge. Caller grants permissions: {} (the App token does the privileged work). Inputs: app-client-id (required), require-approval/maintainer-only (default true), label, merge-command, arm-command. Required secret app-private-key.
merge-notice.yaml (template) — posts a one-time "this repo merges via /merge" comment on new PRs. Caller grants pull-requests: write. Input: pr-number (required). No secrets.
dependabot-merge.yaml (template) — auto-approves Dependabot minor/patch PRs and fast-forwards them once CI is green. Caller grants permissions: {}. Inputs: app-client-id (required), update-types. Required secret app-private-key.

The merge flows also need a dependabot.yaml and the org setup in §5.

3. The consumer contract

The reusable workflows stay config-free by assuming a small contract — the Makefile is the language boundary, and toolchains are set up from marker files at the repo root:

Makefile targets lint, build, test (emitting coverage/cobertura-coverage.xml), and e2e. Stub any that don't apply as a no-op so make <target> always succeeds:
```
build: ## no-op: nothing to build
	@:
```
Toolchain detection — a root go.mod selects Go (setup-go); a package.json selects Node (setup-node + npm ci). A tools-only go.work + tools/go.mod is dev tooling, not a Go product, so it does not trigger the Go path.
Release — release-please-config.json + .release-please-manifest.json; an optional .goreleaser.yaml (release-type: go, draft: true) selects the GoReleaser path, otherwise the publish path rebuilds via make build and verifies a committed dist/.