Default community health files, reusable workflows, and shared config for h13 repositories.
Call from any repo via uses: h13/.github/.github/workflows/<name>@<sha>:
| Workflow | Stack | Inputs | Steps |
|---|---|---|---|
ci-node.yml |
Node.js | node-version |
npm ci (cached) → npm run lint → npm test |
ci-go.yml |
Go | — | go test -race → golangci-lint |
ci-php.yml |
PHP | php-version, php-extensions, working-directory, composer-args, test-command |
composer install (cached) → composer test |
ci-terraform.yml |
Terraform | terraform-version |
terraform fmt/init/validate → tflint |
ci-markdown.yml |
Markdown | glob |
markdownlint-cli2 (org config auto-applied) |
All workflows enforce permissions: { contents: read } (least-privilege).
name: CI
on:
push:
branches: [main]
pull_request:
jobs:
ci:
uses: h13/.github/.github/workflows/ci-node.yml@c62d0eebefffc0d3ca156453f0fb7cd3dcb94f4c # main- All workflow references use SHA pinning (no
@v1tags) - SHA pins are auto-updated by Renovate (Dependabot is not used)
| Action | Description |
|---|---|
actions/apply-org-config |
Download org config if no local override exists |
| Workflow | Schedule | Description |
|---|---|---|
| Compliance Audit | Monthly (1st) | Checks all repos for renovate.json, CI, branch protection, LICENSE, CODEOWNERS |
| Repo Sync | On push to sync/ |
Syncs PR/issue templates to all non-archived repos (dynamic) |
Org-wide defaults (applied to all repos without their own):
| File | Purpose |
|---|---|
SECURITY.md |
Vulnerability reporting policy |
CONTRIBUTING.md |
Contribution guidelines |
CODEOWNERS |
Default code review ownership |
LICENSE |
MIT license |
All repositories use Renovate exclusively for dependency management. Dependabot is not used. Shared presets are maintained in h13/renovate-config.
h13/dotfiles ← Dev environment + repo-init
└─ repo-init --stack=node --github
├─ generates → renovate.json ──→ h13/renovate-config
├─ generates → .github/workflows/ci.yml (SHA-pinned)
└─ configures → GitHub settings (branch protection, labels, alerts)
h13/.github ← Reusable Workflows + shared config ★
├─ ci-{node,go,php,terraform,markdown}.yml (reusable, SHA-pinned)
├─ compliance-audit.yml (monthly)
├─ repo-sync.yml (dynamic sync to all repos)
└─ apply-org-config action
h13/renovate-config ← Shared Renovate presets
├─ default.json (config:best-practices)
├─ node.json / go.json / php.json / terraform.json
└─ Stack-specific dependency rules