Composite and Node GitHub Actions, reusable workflows and shared Renovate presets, each released under its own tag.
One repository holding the CI parts the other repositories in this account call: the actions under
actions/, the callable workflows under workflows/, and the Renovate presets and branch rulesets
under configs/.
Each directory is its own release-please component, so actions/rust/clippy and
actions/bun/setup-cached are versioned and tagged apart from each other. A tag names the component
it belongs to, as actions-<path>-vX.Y.Z or workflows-<path>-vX.Y.Z. The tables below carry the
current tag of every component and the uses: line that pins it.
Copy a uses: line from the tables below. It pins the released tag to the commit that tag points
at, and repeats the tag in a trailing comment.
Then extend the shared Renovate preset in your renovate.json:
{
"extends": ["github>TimSchoenle/actions//configs/renovate/base"]
}The preset installs a regex manager that matches exactly that shape. It also turns Renovate's
built-in github-actions manager off for this repository, so a pin written without its # tag=
comment matches nothing and never moves. The versioning regex carries the component prefix through
as its compatibility group. That is what stops a release of actions-rust-clippy being offered as
an upgrade to actions-bun-setup-cached.
The first column links to the action's directory. Its action.yaml declares the inputs and the
outputs. Where an action needs more than that, a README sits next to it.
| Action | Description | Version | Usage |
|---|---|---|---|
| Bun Setup-cached | Sets up Bun and manages dependency caching. | actions-bun-setup-cached-v1.1.11 | uses: TimSchoenle/actions/actions/bun/setup-cached@e16a1e466faf8ec751b26289c1898143a253269f # tag=actions-bun-setup-cached-v1.1.11 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Close Pull Request | Closes a pull request | actions-common-close-pull-request-v1.5.1 | uses: TimSchoenle/actions/actions/common/close-pull-request@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-close-pull-request-v1.5.1 |
| Commit Changes | Commits changes using the GitHub API to ensure verified bot commits. | actions-common-commit-changes-v1.5.1 | uses: TimSchoenle/actions/actions/common/commit-changes@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-commit-changes-v1.5.1 |
| Common Modify YAML | A action to modify a value in a YAML file while strictly preserving comments and structure | actions-common-modify-yaml-v1.5.1 | uses: TimSchoenle/actions/actions/common/modify-yaml@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-modify-yaml-v1.5.1 |
| Common Read YAML | A action to read a value from a YAML file using dot notation | actions-common-read-yaml-v1.3.1 | uses: TimSchoenle/actions/actions/common/read-yaml@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-read-yaml-v1.3.1 |
| Common Readme Variables | Collect the standard README render payload — repository facts, release, toolchain and a docs index — as strict JSON for render-template | actions-common-readme-variables-v1.2.1 | uses: TimSchoenle/actions/actions/common/readme-variables@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-readme-variables-v1.2.1 |
| Create Branch | Creates or resets a git branch using GitHub API. | actions-common-create-branch-v1.6.1 | uses: TimSchoenle/actions/actions/common/create-branch@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-create-branch-v1.6.1 |
| Create Pull Request | Creates or updates a pull request using GitHub App authentication with optional branch reset. | actions-common-create-pull-request-v1.0.16 | uses: TimSchoenle/actions/actions/common/create-pull-request@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-create-pull-request-v1.0.16 |
| Delete-Branch | Deletes a branch from a repository. Fails gracefully if the branch does not exist. | actions-common-delete-branch-v1.5.1 | uses: TimSchoenle/actions/actions/common/delete-branch@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-delete-branch-v1.5.1 |
| Get App Git Identity | Resolves the git identity (username, email, user ID) for a GitHub App bot. | actions-common-get-app-git-identity-v1.5.1 | uses: TimSchoenle/actions/actions/common/get-app-git-identity@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-get-app-git-identity-v1.5.1 |
| Render Template | A action to render a Handlebars template file to an output file from a JSON map of variables, deterministically | actions-common-render-template-v1.2.1 | uses: TimSchoenle/actions/actions/common/render-template@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-render-template-v1.2.1 |
| Render Template And Commit | Renders a Handlebars template to a file and commits the result as a verified bot commit, skipping the commit when the render changed nothing. | actions-common-render-template-and-commit-v1.1.7 | uses: TimSchoenle/actions/actions/common/render-template-and-commit@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-render-template-and-commit-v1.1.7 |
| Setup App Git Identity | Configures git with the identity of a GitHub App bot and outputs the bot details. | actions-common-setup-app-git-identity-v1.5.1 | uses: TimSchoenle/actions/actions/common/setup-app-git-identity@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-setup-app-git-identity-v1.5.1 |
| Upsert PR Comment | Posts a comment on a pull request, updating the previous comment carrying the same identifier. | actions-common-upsert-pr-comment-v1.1.1 | uses: TimSchoenle/actions/actions/common/upsert-pr-comment@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-common-upsert-pr-comment-v1.1.1 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Apply Helm Chart Updates | Applies a set of templated image updates to a Helm chart's values.yaml and bumps Chart.yaml, preserving comments and structure. Every image carries its own version and digest. | actions-helm-apply-chart-updates-v1.3.1 | uses: TimSchoenle/actions/actions/helm/apply-chart-updates@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-helm-apply-chart-updates-v1.3.1 |
| Update Helm Chart Version | Updates a Helm chart's image tags, version and appVersion, then opens a Pull Request. Every image carries its own version and digest, so one call can move a chart with many services. This action requires a bot account with access to the charts repo. | actions-helm-update-chart-version-v1.6.8 | uses: TimSchoenle/actions/actions/helm/update-chart-version@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-helm-update-chart-version-v1.6.8 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Helper Verify-branch-name | Verify the head branch of a pull request matches a pattern and check whether it comes from a fork | actions-helper-verify-branch-name-v1.4.1 | uses: TimSchoenle/actions/actions/helper/verify-branch-name@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-helper-verify-branch-name-v1.4.1 |
| Resolve Branch | Resolve the given base branch or return default branch. With optional existence check. | actions-helper-resolve-base-branch-v1.5.1 | uses: TimSchoenle/actions/actions/helper/resolve-base-branch@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-helper-resolve-base-branch-v1.5.1 |
| Verify Commit Authors | Verifies that all commits in a PR are authored by a specific set of users and are signed. | actions-helper-verify-commit-authors-v1.5.1 | uses: TimSchoenle/actions/actions/helper/verify-commit-authors@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-helper-verify-commit-authors-v1.5.1 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Java-gradle Auto-spotless | Automatically apply spotless formatting and commit changes. | actions-java-gradle-auto-spotless-v1.1.21 | uses: TimSchoenle/actions/actions/java-gradle/auto-spotless@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-java-gradle-auto-spotless-v1.1.21 |
| Java-Gradle default setup | Setup Java and Gradle environment for building, with opinionated default settings | actions-java-gradle-setup-base-environment-v1.2.11 | uses: TimSchoenle/actions/actions/java-gradle/setup-base-environment@0406974974a3aaf884e7c65866b091d266614b46 # tag=actions-java-gradle-setup-base-environment-v1.2.11 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Maintenance Auto-approve-pr | Auto approve Pull Requests with the given user ids and branches. | actions-maintenance-auto-approve-pr-v1.5.1 | uses: TimSchoenle/actions/actions/maintenance/auto-approve-pr@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-maintenance-auto-approve-pr-v1.5.1 |
| Maintenance Ensure-actions-are-executed | Ensures selected checks completed successfully when they were started. | actions-maintenance-ensure-actions-are-executed-v1.5.1 | uses: TimSchoenle/actions/actions/maintenance/ensure-actions-are-executed@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-maintenance-ensure-actions-are-executed-v1.5.1 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Rust Auto-format | Action that runs cargo fmt and commits changes. | actions-rust-auto-format-v1.1.15 | uses: TimSchoenle/actions/actions/rust/auto-format@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-rust-auto-format-v1.1.15 |
| Rust Cargo-check | Action that runs cargo check to verify Rust code compiles without errors. | actions-rust-cargo-check-v1.1.6 | uses: TimSchoenle/actions/actions/rust/cargo-check@e16a1e466faf8ec751b26289c1898143a253269f # tag=actions-rust-cargo-check-v1.1.6 |
| Rust Clippy | Action that runs clippy to catch common mistakes and improve your Rust code. | actions-rust-clippy-v1.1.10 | uses: TimSchoenle/actions/actions/rust/clippy@e16a1e466faf8ec751b26289c1898143a253269f # tag=actions-rust-clippy-v1.1.10 |
| Rust Config Contract | Action that checks a terrace-config contract, its Dockerfile LABEL block and a built image against the configuration types they claim to describe. | actions-rust-config-contract-v1.3.1 | uses: TimSchoenle/actions/actions/rust/config-contract@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-rust-config-contract-v1.3.1 |
| Rust Coverage (Codecov) | Action that runs cargo llvm-cov to generate code coverage and uploads to Codecov. | actions-rust-coverage-codecov-v1.1.45 | uses: TimSchoenle/actions/actions/rust/coverage-codecov@cf936b448984595778c82c079af93d0bb5d49297 # tag=actions-rust-coverage-codecov-v1.1.45 |
| Rust Test | Action that runs cargo nextest to verify Rust code passes tests. | actions-rust-test-v1.1.2 | uses: TimSchoenle/actions/actions/rust/test@e16a1e466faf8ec751b26289c1898143a253269f # tag=actions-rust-test-v1.1.2 |
| Action | Description | Version | Usage |
|---|---|---|---|
| Setup E2E Test | Sets up the environment for E2E testing: generates token, checks out test repo, and checks out actions code. | actions-test-setup-e2e-v1.2.3 | uses: TimSchoenle/actions/actions/test/setup-e2e@51bbb07f9ccf8d9f5a8de245e2d6f2812638e989 # tag=actions-test-setup-e2e-v1.2.3 |
Releasing one of these publishes it onto its tag at .github/workflows/<category>-<name>.yaml,
which is the path the uses: line resolves. Read and change the source under workflows/.
| Workflow | Description | Version | Usage |
|---|---|---|---|
| Auto Format | Reusable workflow to auto-format code by running a "bun run" script and commit changes. | workflows-maintenance-auto-bun-prettier-v1.1.32 | uses: TimSchoenle/actions/.github/workflows/maintenance-auto-bun-prettier.yaml@43ec2db1ec37dde702ff24ef2f8d25064a1d5d7f # tag=workflows-maintenance-auto-bun-prettier-v1.1.32 |
| Auto-Approve & Merge Timed PRs | Reusable workflow that automatically verifies, approves, and merges Pull Requests that match a specific branch pattern and have been open for a configurable duration. It ensures all commits are signed and authored by trusted users. | workflows-maintenance-timed-auto-pr-approve-v1.2.35 | uses: TimSchoenle/actions/.github/workflows/maintenance-timed-auto-pr-approve.yaml@dfe326713342286a585aa339e96afaa7d404483f # tag=workflows-maintenance-timed-auto-pr-approve-v1.2.35 |
| Maintenance Auto-approve-renovate | Reusable workflow to auto approve Renovate PRs, this is useful to auto merge Renovate PRs which have auto-merge enabled. | workflows-maintenance-auto-approve-renovate-v1.4.23 | uses: TimSchoenle/actions/.github/workflows/maintenance-auto-approve-renovate.yaml@5a0b3443c514efbae16e09e4e3431f74673cf50d # tag=workflows-maintenance-auto-approve-renovate-v1.4.23 |
| Maintenance Auto-rebase | Automatically rebases open PRs with a given label. | workflows-maintenance-auto-rebase-v1.1.7 | uses: TimSchoenle/actions/.github/workflows/maintenance-auto-rebase.yaml@112057eff67d583e17eda2b173bc5d67eb83fb4f # tag=workflows-maintenance-auto-rebase-v1.1.7 |
| Maintenance Wipe-cache | Workflow to wipe all cache entries for the given branch. | workflows-maintenance-wipe-cache-v1.1.13 | uses: TimSchoenle/actions/.github/workflows/maintenance-wipe-cache.yaml@103a601a6e8778074ac41d9dd03870d1989463b6 # tag=workflows-maintenance-wipe-cache-v1.1.13 |
The Renovate presets are consumed through extends. The ruleset files are GitHub's own export
format: download one and import it under the repository's Settings, then Rules.
| Config | Description |
|---|---|
| Default Branch: Default Protection Rules | Enforces standard protection rules on the default branch: requires PRs with 1 approval (squash only), signed commits, CodeQL scanning, and passing status checks. |
| Release Please Branches: Trusted Bots Only | Restricts access to release-please branches, allowing only trusted bots to create, update, or delete them, while enforcing code quality and signature requirements. |
| Release Tags: Only Allow Automatic Release Manager Bot | Enforces that only the Automatic Release Manager bot can create, update, or delete release tags. |
| Renovate Branches: Trusted Bots & Admins Only | Restricts access to Renovate branches, allowing only trusted bots (Renovate, Automatic Release Manager) and admins to manage them, while enforcing code quality and signature requirements. |
| Config | Description | Usage |
|---|---|---|
| actions | Versioning rules for all custom Github Actions defined in this repository | "extends": ["github>TimSchoenle/actions//configs/renovate/actions"] |
| base | Base configuration to handle custom versioning for all resources in this repository. | "extends": ["github>TimSchoenle/actions//configs/renovate/base"] |
| ci-automerge | Auto-merge rules for all none major Github Actions including custom actions defined in this repository. | "extends": ["github>TimSchoenle/actions//configs/renovate/ci-automerge"] |
| default | Default configuration for Renovate | "extends": ["github>TimSchoenle/actions//configs/renovate/default"] |
| workflows | Versioning rules for all custom Reusable Workflows defined in this repository | "extends": ["github>TimSchoenle/actions//configs/renovate/workflows"] |
Issues and pull requests are welcome. CONTRIBUTING.md covers the commit convention release-please reads, the interactive generators that scaffold a new action or workflow, and the checks CI runs. This file and SECURITY.md are generated. An edit to either is reverted on the next pull request.
Do not open a public issue for a vulnerability. SECURITY.md has the private reporting route and the list of supported versions.
Every action, workflow and config here is published under the terms in LICENSE.