GitHub Action Workflows

This repo contains GitHub Action workflows that can be re-used by other apps.

Pull request reviews

Use the shared pull-request workflow to run Claude PR review, SDLC risk labeling, and review-required PR template enforcement.

name: Pull Requeston:
pull_request:
types: [opened, reopened, synchronize]jobs:
pull-request:
uses: simpleanalytics/github-actions/.github/workflows/pull-request.yml@mainsecrets: inheritwith:
internal_app: false

Claude reviews full PR diffs on opened and reopened, and only the newly pushed commit range on synchronize unless a critical issue is still present. The workflow creates and applies exactly one SDLC label:

• change: needs review for changes affecting security, data protection, system stability, customer/user data, or critical functionality.
• change: routine for internal tools or low-risk changes such as design updates or content modifications.

For change: needs review, the workflow ensures the Simple Analytics PR template is used and keeps the Summary updated from the current PR description and commit messages. Claude separately drafts a problem-focused tracking issue with Problem and Suggested changes sections, so completed PR details are not copied into the issue. The PR links to the issue with a Closes reference; the issue does not link back to the PR. Later review runs reuse that issue instead of creating duplicates.

The workflow first tries to create the issue in simpleanalytics/dashboard; if that is not accessible, it falls back to the current repository. If issue creation still fails, the workflow continues and posts the suggested issue content in a collapsed PR comment.

Set internal_app: true for internal apps where low-risk changes that do not touch customer/user data, security, privacy, or critical functionality should stay change: routine and skip approval-oriented enforcement.

The workflow defaults to claude-opus-4-8. It can clone read-only cross-repo context when the caller has a SA_PAT_ADRIAAN_READ_REPOS secret. If the secret is missing, the workflow continues with a warning; the token is stored in 1Password under that name. Context repositories clone in parallel with context_clone_concurrency, which defaults to 8.

Manual Claude requests

Use the shared Claude workflow to keep @claude requests consistent across repositories.

name: Claude Codeon:
issue_comment:
types: [created]pull_request_review_comment:
types: [created]issues:
types: [opened, assigned]pull_request_review:
types: [submitted]jobs:
claude:
uses: simpleanalytics/github-actions/.github/workflows/claude.yml@mainsecrets: inherit

The workflow defaults to claude-opus-4-8 and exposes test_ref so caller repositories can run their own local CI workflow after Claude handles a PR comment or review thread.

Make sure to set a secret in your repo called DEPLOY_TOKEN. The value can be found in infra repo secrets.

Example usage:

deploy:
name: Deployneeds: [build, test]if: github.event_name != 'pull_request'uses: simpleanalytics/github-actions/.github/workflows/deploy.yml@mainsecrets: inherittimeout-minutes: 10with:
app: esapihosts: "esapp1 esapp02 esapp03"strategy: blue_greenimage_repo: ghcr.io/${{ github.repository }}image_tag: ${{ github.sha }}