IceWhaleTech reusable workflows

This repository contains shared GitHub Actions workflows used by IceWhaleTech service repositories.

OpenAPI SDK Builder

The OpenAPI SDK workflows run the versioned Builder image ghcr.io/icewhaletech/openapi-sdk-builder:0.1.0. Service repositories own their OpenAPI documents, openapi-sdk.yaml, package version, and release trigger. The shared workflows own generation, compilation, packaging, and npm publishing behavior.

Check an SDK

The caller repository must have Read access under the Builder package's Manage Actions access settings.

name: Check OpenAPI SDKon:
pull_request:
paths:
- "api/**/*.yaml"
- openapi-sdk.yamlpush:
branches:
- mainpaths:
- "api/**/*.yaml"
- openapi-sdk.yamljobs:
check:
permissions:
contents: readpackages: readuses: IceWhaleTech/github/.github/workflows/openapi_sdk_check.yml@openapi-sdk-v1.0.2with:
config-path: openapi-sdk.yaml

Publish an SDK

The npm package's trusted publisher must name the caller repository and caller workflow file. npm validates the caller (for example, npm.yaml), not openapi_sdk_release.yml. Both the caller and reusable workflow must grant id-token: write.

name: Publish npmon:
push:
tags:
- "v*.*.*"workflow_dispatch:
inputs:
version:
description: Semver package versionrequired: truetype: stringjobs:
publish:
permissions:
contents: readpackages: readid-token: writeuses: IceWhaleTech/github/.github/workflows/openapi_sdk_release.yml@openapi-sdk-v1.0.2with:
config-path: openapi-sdk.yamlversion: ${{ inputs.version || github.ref_name }}

version may start with v; the Builder removes it before creating the npm package. npm-tag defaults to latest.

Repositories whose OpenAPI documents live in Git submodules can pass checkout-submodules: true. If those submodules are private, also pass the existing API_TOKEN_GITHUB secret:

with:
checkout-submodules: truesecrets:
API_TOKEN_GITHUB: ${{ secrets.API_TOKEN_GITHUB }}

Callers should pin these workflows to a release tag such as @openapi-sdk-v1.0.2 (or a full commit SHA), rather than @main.