gh-actions

Structure

• actions/ — shared composite actions (recommended paths)
• .github/workflows/ — reusable workflows + self-tests

Actions

bws-fetch (gh-actions-shared)

Fetch secrets from Bitwarden Secrets Manager (BWS) into files and export *_FILE environment variables for downstream steps. This repo consumes the shared action from shared-common/gh-actions-shared.

Usage:

- uses: shared-common/gh-actions-shared/.github/actions/bws-fetch@9ab134ec04b39da8a91b39df5911048f7ae00c38
  with:
    access-token: ${{ secrets.BWS_ACCESS_TOKEN }}
    project-id: ${{ secrets.BWS_PROJECT_ID }}
    secrets: GH_ORG_RELEASE,GH_ORG_RELEASE_APP_ID,GH_ORG_RELEASE_APP_INSTALL_ID,GH_ORG_RELEASE_APP_PEM
    bws-version: ${{ vars.BWS_VERSION }}
    bws-sha256: ${{ vars.BWS_SHA256 }}

github-app-token

Creates a GitHub App installation token using secrets stored in BWS.

Usage:

- uses: emcram/gh-actions/actions/github-app-token@<sha>
  with:
    bws-access-token: ${{ secrets.BWS_ACCESS_TOKEN }}
    bws-project-id: ${{ secrets.BWS_PROJECT_ID }}
    bws-version: ${{ vars.BWS_VERSION }}
    bws-sha256: ${{ vars.BWS_SHA256 }}

require-release-tip

Ensures a tag points to the tip of a release branch; optionally requires it to not be a merge commit.

Usage (recommended: pin to SHA):

- uses: emcram/gh-actions/actions/require-release-tip@dde7f9b094c1abd78c58f1975b27cc953b62dba7
  with:
    release_branch: mcr/release

Optional inputs:
- `release_branch` (default: `mcr/release`)
- `remote` (default: `origin`)
- `allow_merge_commits` (default: `false`)

Security notes:
- Pin to a full commit SHA for supply-chain safety.
- Keep this repo free of secrets or internal endpoints.

### require-gl-tag

Ensures a workflow runs only on tags that match release-tag policy.

Usage:

```yaml
- uses: emcram/gh-actions/actions/require-gl-tag@<sha>
  with:
    tag_regex: '(^[0-9]{1,10}$|^.*[^0-9][0-9]{1,10}$)'

Default policy when tag_regex is omitted:

• Tag must end with a numeric suffix.
• Trailing numeric suffix length must be between 1 and 10 digits.
• Optional tag_prefix can still be used for stricter project-local matching.

validate-tag-version

Validates a release tag and (optionally) matches it to an expected version.

Usage:

- uses: emcram/gh-actions/actions/validate-tag-version@<sha>
  with:
    allow_revision_suffix: "true"

Notes:

• tag_prefix is optional.
• Default tag policy requires only a trailing numeric suffix of 1-10 digits.
• expected_version is optional and compares against the parsed base version.

Reusable workflows

release-from-workflow-run

Creates a GitHub release from artifacts produced by a prior workflow run.

Usage:

jobs:
  release:
    uses: emcram/gh-actions/.github/workflows/release-from-workflow-run.yml@<sha>
    with:
      tag: ${{ needs.resolve_tag.outputs.tag }}
      run_id: ${{ github.event.workflow_run.id }}
      artifact_prefix: your-project-linux-x86_64-
      tarball_prefix: your-project-linux-x86_64-
      checksum_prefix: your-project-sha256-checksums-
      release_name: your-project v{version}
    secrets: inherit

Notes:

• For tag-driven workflow_run callers, resolve the tag from github.event.workflow_run.head_sha (do not rely on head_branch).
• Tags must pass the default trailing 1-10 digit suffix policy unless a custom tag_regex is provided.
• Requires BWS_ACCESS_TOKEN and BWS_PROJECT_ID secrets (and the GitHub App secrets in BWS).
• bws_version/bws_sha256 default to vars.BWS_VERSION and vars.BWS_SHA256 when unset.
• Runs shared security-gates before publishing by default; disable with run_security_gates: false if needed.
• Deletes all workflow artifacts and caches in the repo (logs are retained).
  • This is destructive and will wipe caches for every ref; only use if that matches org policy.
• Allow-list the reusable workflow and the github-app-token action:
  • mattycramer/gh-actions/.github/workflows/release-from-workflow-run.yml@<sha>
  • mattycramer/gh-actions/actions/github-app-token@24fa0b1b9c20445eb84e314dde824752572595c0

security-gates

Runs shared dependency and vulnerability gates for repo-agnostic callers.

Usage:

jobs:
  security:
    uses: mattycramer/gh-actions/.github/workflows/security-gates.yml@<sha>
    with:
      caller_event_name: ${{ github.event_name }}
      checkout_ref: ${{ github.sha }}
      fail_on_severity: high
      osv_scan_args: |-
        -r
        .

Notes:

• Pass caller_event_name: ${{ github.event_name }} so PR-only checks evaluate correctly.
• dependency-review-action runs only when caller_event_name is pull_request.
• osv-scanner-action runs for any caller event unless disabled.