GitHub Actions CI/CD Kit

Copyable GitHub Actions templates for one delivery lifecycle across different technology stacks.

The kit standardizes:

• PR quality checks
• shared test delivery from test plus labeled feature PRs
• Git-tree-addressed artifact reuse
• strict manual test -> master production promotion
• manual deployment of an existing artifact
• lifecycle notifications with non-fatal notification failures

Projects implement their own build, artifact provider, deployment, and notification mechanics behind five local Actions.

Current Model

templates/unified/workflows/
  pr-quality.yml
  test-delivery.yml
  promote-production.yml
  deploy-existing.yml

templates/unified/actions/
  project-quality/action.yml
  project-build/action.yml
  project-artifact/action.yml
  project-deploy/action.yml
  project-notify/action.yml

Release identity is the Git root tree object ID:

git rev-parse "${commit}^{tree}"

Test and production reuse the same stored artifact. Artifact byte integrity uses SHA-256 separately from release identity.

Install

Preview differences:

./sync.sh --dry-run /path/to/project

Install missing workflows and project Action stubs:

./sync.sh --bootstrap /path/to/project

Copied workflows belong to the project. Add its existing secrets and variables directly to those files. Normal sync preserves local edits; use --force only after reviewing the dry-run diff.

See docs/quickstart.md, docs/architecture.md, and docs/specs/unified-cicd-workflows.md.

Security Warning: feature-build Is Privileged

The feature-build label grants ongoing trust to the PR author. While the label remains present, later commits can execute project Actions with configured test artifact, deployment, and notification credentials.

Only maintainers should manage this label, and they must add it only to PRs whose authors are fully trusted.

Verification

bash test/sync_test.sh
bash test/artifact_flow_test.sh
bash test/feature_merge_test.sh
bash test/promote_test.sh
ruby test/workflow_contract_test.rb
ruby test/notification_test.rb

Run actionlint over .github/workflows/*.yml and templates/unified/workflows/*.yml when installed.

License

MIT. See LICENSE.