You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Reusable GitHub Actions workflows and actions for repositories in the
openpi-dev organization.
This repository is an isolated definition store. It does not run workflows for
its own pushes or pull requests; consumers explicitly invoke its reusable
workflows.
Callers should pin reusable workflows to a full commit SHA. Repository event
triggers, secrets, environments, and least-privilege GITHUB_TOKEN permissions
remain in each caller repository.
Reusable workflows
openpi-release.yml — validates an existing OpenPI version tag, builds the
package artifact, and publishes it through npm trusted publishing.
openpi-feishu-pr-notification.yml — sends a bounded, sanitized interactive
PR card with structured metadata and a validated GitHub link for trusted
pull_request_target events.
Validation
npm test
The suite exercises Feishu metadata sanitization, injection resistance, Unicode
bounds, secret-pair handling, HMAC payloads, and response failures. It also
executes release event/tag/package-version validation and locks the reusable
workflow boundaries for draft suppression, OIDC, ancestry, and single-artifact
publication.
About
Reusable GitHub Actions workflows for openpi-dev repositories