.github

This repository acts as a fallback for all repositories under my crazy-max handle that don't have an actual .github directory with issue templates and other community health files.

It also contains a collection of GitHub Actions and reusable workflows that can be used in your own repositories.

---

• Actions
  • container-logs-check
  • docker-scout
  • gotest-annotations
  • install-k3s
• Reusable workflows
  • list-commits
  • pr-assign-author
  • releases-json
  • zizmor

Actions

container-logs-check

container-logs-check composite action checks for a string in a Docker container or Swarm service logs. This can be used as a poor man's e2e testing helper for long-running Docker workloads.

name: testpermissions:
contents: readon:
push:
jobs:
test:
runs-on: ubuntu-lateststeps:
-
name: Run containerrun: | docker run -d --name test crazymax/samba:4.18.2 -
name: Check container logsuses: crazy-max/.github/.github/actions/container-logs-check@v1with:
name: testlog_check: " started."timeout: 20

Action logs:

Setting timezone to UTC
Initializing files and folders
Setting global configuration
Creating user foo/foo (1000:1000)
Added user foo.
Creating user yyy/xxx (1100:1200)
Added user yyy.
Add global option: force user = foo
Add global option: force group = foo
Creating share public
Creating share share
Creating share foo
# Global parameters
[global]
disable netbios = Yes
...
strict locking = No
vfs objects = fruit streams_xattr
wide links = Yes
smbd version 4.18.2 started.
🎉 Found " started." in container logs

Swarm service example:

 -
name: Check service logsuses: crazy-max/.github/.github/actions/container-logs-check@v1with:
name: swarm-cronjobtype: servicelog_check: "Number of cronjob tasks: 7"timeout: 120

docker-scout

docker-scout composite action scans Docker images for vulnerabilities using Docker Scout.

name: cipermissions:
contents: readon:
push:
jobs:
scout:
runs-on: ubuntu-latestpermissions:
contents: readsecurity-events: writesteps:
-
name: Scoutid: scoutuses: crazy-max/.github/.github/actions/docker-scout@v1with:
format: sarifimage: alpine:latest
-
name: Upload SARIF reportuses: github/codeql-action/upload-sarif@v4with:
sarif_file: ${{ steps.scout.outputs.result-file }}

You can find the list of available inputs directly in the action configuration.

gotest-annotations

gotest-annotations composite action generates GitHub annotations for generated Go JSON test reports.

name: cipermissions:
contents: readon:
push:
jobs:
go:
runs-on: ubuntu-lateststeps:
-
name: Checkoutuses: actions/checkout@v6
-
name: Testrun: | mkdir -p ./testreports go test -coverprofile ./testreports/cover.out -json ./... > ./testreports/test-report.json -
name: Generate annotationsuses: crazy-max/.github/.github/actions/gotest-annotations@v1with:
directory: ./testreports

install-k3s

install-k3s composite action installs k3s on a runner.

name: cipermissions:
contents: readon:
push:
jobs:
install-k3s:
runs-on: ubuntu-lateststeps:
-
name: Install k3suses: crazy-max/.github/.github/actions/install-k3s@v1with:
version: v1.32.2+k3s1

Reusable workflows

list-commits

list-commits reusable workflow generates a JSON matrix with the list of commits for a pull request.

name: cipermissions:
contents: readon:
push:
pull_request:
jobs:
list-commits:
uses: crazy-max/.github/.github/workflows/list-commits.yml@v1with:
limit: 10validate:
runs-on: ubuntu-latestneeds:
- list-commitsstrategy:
fail-fast: falsematrix:
commit: ${{ fromJson(needs.list-commits.outputs.matrix) }}steps:
-
name: Checkoutuses: actions/checkout@v6with:
ref: ${{ matrix.commit }}

Note

limit input is optional and defaults to 0 (unlimited).

pr-assign-author

pr-assign-author reusable workflow assigns the author of a pull request as an assignee.

name: assign-authorpermissions:
contents: readon:
pull_request_target:
types:
- opened
- reopenedjobs:
run:
uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@v1permissions:
contents: readpull-requests: write

releases-json

releases-json reusable workflow generates a JSON file with the list of releases for a given repository. Releases tags should ideally be semver compliant and should not contain latest or edge tags that are handled internally by this action. Non-compliant tags are coerced when possible for version comparison, otherwise they are skipped for edge resolution.

name: cipermissions:
contents: readon:
push:
jobs:
releases-json:
uses: crazy-max/.github/.github/workflows/releases-json.yml@v1with:
repository: docker/buildxartifact_name: buildx-releases-jsonfilename: buildx-releases.jsonreleases-json-check:
runs-on: ubuntu-latestneeds:
- releases-jsonsteps:
-
name: Downloaduses: actions/download-artifact@v8with:
name: buildx-releases-jsonpath: .
-
name: Check filerun: | jq . buildx-releases.json

Typical usage is to generate and put this file on your repository if you don't want to use the GitHub API to get the list of releases and therefore avoid hitting the rate limit (see docker/buildx#1563 for more info).

For example on crazy-max/ghaction-hugo repo, I use this workflow to generate a JSON file with the list of Hugo releases and then use it in the action to check for latest and tagged releases:

asyncfunctiongetRelease(version){consturl=`https://raw.githubusercontent.com/crazy-max/ghaction-hugo/master/.github/hugo-releases.json`;constresponse=awaitfetch(url);constreleases=awaitresponse.json();console.log(JSON.stringify(releases[version],null,2));}getRelease('latest');

{
"id": 89231061,
"tag_name": "v0.110.0",
"html_url": "https://github.com/gohugoio/hugo/releases/tag/v0.110.0",
"assets": [
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_0.110.0_checksums.txt",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_0.110.0_darwin-universal.tar.gz",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_0.110.0_dragonfly-amd64.tar.gz",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_0.110.0_freebsd-amd64.tar.gz",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_0.110.0_Linux-64bit.tar.gz",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_0.110.0_linux-amd64.deb",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_0.110.0_linux-amd64.tar.gz",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_0.110.0_linux-arm.tar.gz",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_0.110.0_linux-arm64.deb",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_0.110.0_linux-arm64.tar.gz",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_0.110.0_netbsd-amd64.tar.gz",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_0.110.0_openbsd-amd64.tar.gz",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_0.110.0_windows-amd64.zip",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_0.110.0_windows-arm64.zip",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_extended_0.110.0_darwin-universal.tar.gz",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_extended_0.110.0_Linux-64bit.tar.gz",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_extended_0.110.0_linux-amd64.deb",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_extended_0.110.0_linux-amd64.tar.gz",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_extended_0.110.0_linux-arm64.deb",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_extended_0.110.0_linux-arm64.tar.gz",
"https://github.com/gohugoio/hugo/releases/download/v0.110.0/hugo_extended_0.110.0_windows-amd64.zip"
]
}

This workflow runs on push and schedule event, generates the JSON file and opens a pull request if it contains new releases, so it's kept in sync with https://github.com/gohugoio/hugo.

zizmor

zizmor reusable workflow scans GitHub Actions workflows in the repository with Zizmor and uploads the SARIF report to GitHub code scanning.

name: cipermissions:
actions: readcontents: readon:
push:
pull_request:
jobs:
zizmor:
uses: crazy-max/.github/.github/workflows/zizmor.yml@v1permissions:
actions: readcontents: readsecurity-events: writewith:
min-severity: mediummin-confidence: mediumpersona: pedanticno-online-audits: true

Here are the main inputs for this reusable workflow:

Name	Type	Default	Description
path	String	.	Path passed to zizmor as the scan target.
version	String	latest	Install latest or a specific zizmor version.
collect	List		Extra artifact collection modes passed as repeated --collect= flags.
min-severity	String		Minimum severity to report.
min-confidence	String		Minimum confidence to report.
persona	String		Zizmor persona to use for findings and output tuning.
config	String		Explicit zizmor configuration file path.
offline	Bool	false	Disable network access for audits.
no-config	Bool	false	Disable zizmor configuration loading.
no-ignores	Bool	false	Do not honor ignore comments or ignore rules in configuration.
no-online-audits	Bool	false	Skip online audits while keeping the rest of the scan enabled.
strict-collection	Bool	false	Fail when artifact collection cannot be completed.
gh-hostname	String		GitHub hostname passed to zizmor for GitHub Enterprise scans.
github-app-client-id	String		GitHub App client ID used to mint an installation token for online audits.
github-app-owner	String		Optional owner whose installation should be used when creating the app token.
github-app-repositories	String		Optional comma or newline-separated repository list for the app token scope.

Optional secret:

Name	Description
github-app-private-key	GitHub App private key paired with github-app-client-id.

When GitHub App credentials are provided, the workflow creates an installation token with actions/create-github-app-token and passes it to zizmor for online audits. Otherwise it falls back to the default ${{ github.token }}.

This is useful when zizmor needs to resolve private actions or reusable workflows during online audits. The app installation needs contents: read access to the repositories zizmor will inspect.

Example with GitHub App authentication:

jobs:
zizmor:
uses: crazy-max/.github/.github/workflows/zizmor.yml@v1permissions:
actions: readcontents: readsecurity-events: writewith:
github-app-client-id: ${{ vars.ZIZMOR_GITHUB_APP_CLIENT_ID }}github-app-owner: ${{ github.repository_owner }}github-app-repositories: | private-actions reusable-workflowssecrets:
github-app-private-key: ${{ secrets.ZIZMOR_GITHUB_APP_PRIVATE_KEY }}

You can find the list of available inputs directly in the reusable workflow.