add: add basic workflow template

[rredgrave11621]

betterleaks-Scan: passed

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 644e37cb-c14c-4d54-a6ec-d47c7b9af7d5

Summary by CodeRabbit

• New Features

  • Added a reusable CI/CD pipeline for building, scanning, testing, and publishing container images.
  • Added configurable manual options for commit selection, testing, and image retention.
  • Added automated semantic-release promotion to versioned and latest image tags.
  • Added chart and stacked-chart update publishing.
  • Added scheduled and manual cleanup of expired test images while preserving release images.
  • Added workflow templates and metadata for easier setup and discovery.

• Maintenance

  • Updated workflow security scanning and artifact tools to newer versions.

Walkthrough

Added reusable container build, CI/CD, chart publication, and GHCR cleanup automation. The change also updates GitHub Actions versions used by security workflows.

Changes

Container workflow automation

Layer / File(s)	Summary
Shared container build action actions/run_build/action.yml	The action prepares image metadata, parses commit flags, checks GHCR, builds and scans images, optionally starts a container, and publishes image tags.
CI/CD pipeline workflow workflow-templates/ci_cd_pipeline.properties.json, workflow-templates/ci_cd_pipeline.yml	The workflow invokes the shared action, runs repository tests, uploads test reports, removes failed images when allowed, and promotes successful images through semantic releases.
Chart publication action actions/publish_chart_updates/action.yml	The action updates chart image tags, generates stacked-chart metadata, and signs and pushes chart repository changes.
GHCR test image cleanup workflow-templates/cleanup.properties.json, workflow-templates/cleanup.yml	The workflow validates retention settings, filters expired test tags while preserving release tags, and deletes matching GHCR versions.
Security workflow action updates .github/workflows/scan-secret.yml, actions/run_trivy_scan_dockerfile/action.yml, actions/run_trivy_scan_image/action.yml, actions/trivy-scan/action.yml	The workflows use newer checkout, SARIF upload, and artifact upload action versions. The Trivy failure exit behavior remains unchanged.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant SharedBuildAction
  participant GHCR
  participant TestJob
  participant SemanticRelease
  participant ChartUpdater
  GitHubActions->>SharedBuildAction: build, scan, and publish image
  SharedBuildAction->>GHCR: push commit-tagged image
  GitHubActions->>TestJob: pull and test image
  TestJob->>GHCR: delete failed image when allowed
  GitHubActions->>SemanticRelease: run release after successful tests
  SemanticRelease->>GHCR: promote versioned and latest tags
  SemanticRelease->>ChartUpdater: publish chart updates

Loading

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[kiennkt]

+1