Reusable GitHub Actions

Collection of reusable workflows and custom actions designed to streamline automation.

Available Workflows

• notdodo/github-actions/.github/workflows/clean-branch-cache.yml: Use to cleanup the cache for a merge branch
• notdodo/github-actions/.github/workflows/docker-build-and-push.yml: Builds a Dockerfile, optionally signs it with cosign, uploads the image to a registry, and performs a scan using Trivy
• notdodo/github-actions/.github/workflows/gitleaks.yml: Uses Gitleaks to scan the code for secrets
• notdodo/github-actions/.github/workflows/go-ci.yml: Used for Golang CI linting and testing
• notdodo/github-actions/.github/workflows/go-security-scan.yml: Used for Golang CI security scanning with Sarif support
• notdodo/github-actions/.github/workflows/infra-security-scan.yml: Used for docker, Makefiles, Kubernetes security scanning with Sarif support
• notdodo/github-actions/.github/workflows/pulumi-preview.yml: Used to run Pulumi preview with PR comments and OIDC authentication
• notdodo/github-actions/.github/workflows/pulumi-up.yml: Used to run Pulumi up for stack deployments with OIDC authentication
• notdodo/github-actions/.github/workflows/python-ci.yml: Used for Python CI linting and checking for Poetry projects
• notdodo/github-actions/.github/workflows/rust-ci.yml: Used for Rust CI linting, building and testing
• notdodo/github-actions/.github/workflows/sast.yml: Used to run Semgrep on the repository with Sarif support
• notdodo/github-actions/.github/workflows/terraform-ci.yml: Used for Terraform CI linting and show plan output on Pull Requests

Tagging

The repository is automatically tagged (tag for each workflow) using notdodo/auto-tagger. To increase a specific semver include in any of the commit messages:

• [#major]
• [#minor]
• [#patch]
• [#skip]

If no special string is used the default is [#skip].

Usage examples

Clean up cache

name: Cleanup caches by a branchon:
pull_request:
types:
- closedjobs:
cleanup:
uses: notdodo/github-actions/.github/workflows/clean-branch-cache.yml@cleanup-v0

Gitleaks

name: Gitleakson:
push:
jobs:
gitleaks:
uses: notdodo/github-actions/.github/workflows/gitleaks.yml@2e84638563b65587b42ba8ab87ccdf1922c412dd# gitleaks-v0.0.0

Infrastructure Security Scan

name: Infrastructure Security Scanon:
push:
branches:
- mainpull_request:
branches:
- mainconcurrency:
group: your-repo-kics-${{ github.ref }}cancel-in-progress: truejobs:
infra-security-scan:
uses: notdodo/github-actions/.github/workflows/infra-security-scan.yml@2e84638563b65587b42ba8ab87ccdf1922c412dd# infra-scan-v0.0.0

Pulumi Preview

name: Pulumi Previewon:
pull_request:
branches:
- mainjobs:
pulumi-preview:
permissions:
contents: readpull-requests: writeid-token: writeuses: notdodo/github-actions/.github/workflows/pulumi-preview.yml@pulumi-preview-v0with:
stack-name: notdodo/my-project/devworking-directory: infraaws-role: arn:aws:iam::123456789012:role/github-actions-pulumi-previewaws-region: eu-west-1

Pulumi Up

name: Pulumi Upon:
push:
branches:
- mainjobs:
pulumi-up:
permissions:
contents: readid-token: writeuses: notdodo/github-actions/.github/workflows/pulumi-up.yml@pulumi-up-v0with:
stack-name: notdodo/my-project/prodworking-directory: infraaws-role: arn:aws:iam::123456789012:role/github-actions-pulumi-upaws-region: eu-west-1

Python CI

name: Python CIon:
push:
branches:
- mainpaths:
- auto-tagger/**pull_request:
paths:
- auto-tagger/**
- .github/workflows/my-python-ci.ymlconcurrency:
group: your-repo-python-ci-${{ github.ref }}cancel-in-progress: truejobs:
python-ci:
uses: notdodo/github-actions/.github/workflows/python-ci.yml@mainwith:
poetry-version: 1.8.2python-version: 3.11working-directory: my-workdir

Rust CI

Docker build and push

name: "Docker image builder and publisher"on:
push:
tags:
- "new-version-v[0-9]+.[0-9]+.[0-9]+"jobs:
build-push-docker-image:
uses: notdodo/github-actions/.github/workflows/docker-build-and-push.yml@docker-build-and-push-v1with:
image: notdodo/my-appplatforms: linux/amd64push: trueregistry: ghcr.ioworking-directory: .tags: | type=match,pattern=new-version-v(.*),group=1secrets:
registry-username: notdodoregistry-password: ${{ secrets.GITHUB_TOKEN }}

By default, this workflow signs pushed images with cosign (sign-image: true) using the reusable workflow identity (the certificate identity belongs to the reusable workflow reference).

To skip signing in the reusable workflow:

jobs:
build-push-docker-image:
uses: notdodo/github-actions/.github/workflows/docker-build-and-push.yml@docker-build-and-push-v1with:
image: notdodo/my-apppush: trueregistry: ghcr.iosign-image: falsesecrets:
registry-username: notdodoregistry-password: ${{ secrets.GITHUB_TOKEN }}

Example: sign in the caller workflow instead of the reusable workflow.

When used as a reusable workflow, these job outputs are available to the caller:

• image_name: <registry>/<image>
• image_digest: pushed digest (sha256:...), empty when push: false
• image_ref: immutable image reference (<registry>/<image>@<digest>), empty when push: false
• local_image_ref: local image reference (localimage:<sha>), only set when push: false

name: Docker Build, Then Sign in Calleron:
push:
branches: [main]jobs:
build-image:
permissions:
attestations: writecontents: readid-token: writepackages: writesecurity-events: writeuses: notdodo/github-actions/.github/workflows/docker-build-and-push.yml@docker-build-and-push-v1with:
image: notdodo/my-apppush: trueregistry: ghcr.iosign-image: falsesecrets:
registry-username: notdodoregistry-password: ${{ secrets.GITHUB_TOKEN }}sign-image:
needs: [build-image]runs-on: ubuntu-latestpermissions:
id-token: writecontents: readsteps:
- uses: sigstore/cosign-installer@v4.0.0
- name: Sign and verifyenv:
COSIGN_YES: "true"IMAGE_REF: ${{ needs.build-image.outputs.image_ref }}CERT_OIDC_ISSUER: https://token.actions.githubusercontent.comCERT_IDENTITY: ${{ format('https://github.com/{0}', github.workflow_ref) }}run: | cosign sign "${IMAGE_REF}" cosign verify \ --certificate-identity "${CERT_IDENTITY}" \ --certificate-oidc-issuer "${CERT_OIDC_ISSUER}" \ "${IMAGE_REF}"

Auto tagger

name: auto-taggeron:
push:
branches:
- mainjobs:
auto-tagger:
runs-on: ubuntu-lateststeps:
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f
- name: Run actionuses: notdodo/github-actions/auto-tagger@auto-tagger-v0with:
bind_to_major: truedefault_bump_strategy: skipdefault_branch: mainprefix: test-vgithub_token: ${{ secrets.GITHUB_TOKEN }}dry_run: false