The repository contains all general workflows which can be used for every workflow in another repository. If you want to have more information you can take a look at the GitHub documentation.
If you want to use a template workflow you can copy the following template and adapt it to your specific use case.
You can find all possible template workflows in the directory .github/workflows with the name template_*.yml.
name: <your name>permissions: {}on: ...jobs:
<action name>:
uses: Staffbase/gha-workflows/.github/workflows/template_*.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions: ... # see individual examples belowwith: ...In this section you can find examples of how to use template workflows. For more information, please take a look at the templates.
The action can be used to auto-merge dependabot PRs.
This workflow triggers on PRs created by dependabot. It uses the provided GitHub App (e.g. the staffbase-actions app) to approve the PR and enables auto-merge (gh pr merge --auto). The PR merges automatically once all required status checks pass.
The GitHub App must be configured as an exempt bypass actor in the applicable ruleset. With exempt, the bot's approval satisfies the code-owner review requirement and the repo-level "Allow auto-merge" setting is not required.
At Staffbase, staffbase-actions is configured as exempt bypass actor org-wide.
forceinput (default:false): Settingforce: trueswitches from--autoto--admin, which bypasses all branch protection rules. This is a legacy escape hatch. Most repos should not set it.
name: Enable Dependabot Auto-Mergepermissions: {}on:
pull_request:
jobs:
dependabot:
uses: Staffbase/gha-workflows/.github/workflows/template_automerge_dependabot.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions: {}with:
# optional: merge strategy (accepted values: rebase, merge, squash. default: squash)strategy: squash# optional: comma-separated list of updates to accept (available types: major, minor, patch. default: minor,patch)update-types: major,minor,patch# optional: allow versions with semver 0.X.X (default: false)include-pre-release: truesecrets:
# client id of the GitHub App for authenticationclient_id: ${{ <your-client-id> }}# private key of the GitHub Appprivate_key: ${{ <your-private-key> }}The action can be used to merge labeled pull requests into a branch.
name: Autodevpermissions: {}on:
push:
branches-ignore:
- devpull_request:
types: [labeled, unlabeled, closed]jobs:
autodev:
uses: Staffbase/gha-workflows/.github/workflows/template_autodev.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
contents: readwith:
# optional: base branch from which the history originates, default: mainbase: master# optional: name of the dev branch, default: devbranch: your dev branch# optional: update status comment, default: false# if you want to change the message, please adapt 'success_comment' and/or 'failure_comment'comments: true# optional: update status label, default: false# if you want to change the labels, please adapt 'success_label' and/or 'failure_label'labels: true# optional: label which should trigger the action, default: devlabel: deploy# optional: name of the user which does the commit, default: AutoDev Actionuser: your name# optional: mail of the user which does the commit, default: staffbot@staffbase.comemail: your mail# optional: path relative to the repo root dir in which the GitOps action should be executed, default: .working-directory: ./my-service-foldersecrets:
# optional: access token to fetch the pull requeststoken: ${{ <your-token> }}# optional: client id of the GitHub App for authenticationclient_id: ${{ <your-client-id> }}# optional: private key of the GitHub Appprivate_key: ${{ <your-private-key> }}The action can be used to check a PR for the existance of changeset files. It will then add/update a comment on the PR.
name: Changeset Checkpermissions: {}on:
pull_request:
types: [opened, reopened, synchronize]jobs:
changeset-check:
uses: Staffbase/gha-workflows/.github/workflows/template_changeset_check.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
contents: readpull-requests: writeThe action can be used to create release PR and publish releases for repos using PNPM and changesets.
@changesets/cli installed as a dev-dependency in your project!
name: Release Changesetspermissions: {}on:
push:
branches:
- mainjobs:
changeset-release:
uses: Staffbase/gha-workflows/.github/workflows/template_changeset_release.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
contents: readwith:
# optional: The file containing the Node.js version to use, defaults to .nvmrcnode-version-file: '.node-version'# optional: The script to run on publish. Defaults to `pnpm release`publish-script: 'pnpm publish'# optional: The script to run for bumping the package versions. Defaults to `pnpm changeset version`version-script: 'pnpm version'# optional: The registry to use for Node.js packages.node-registry: 'https://npm.pkg.github.com/'# optional: The scope to use for Node.js packages.node-registry-scope: '@staffbase'secrets:
# client id of the GitHub App for authenticationclient_id: ${{ <your-client-id> }}# private key of the GitHub Appprivate_key: ${{ <your-private-key> }}# needs write:packages rightsnpm-token: ${{ <your-npm-token> }}The action can be used to find flaky tests.
name: Find flaky testspermissions: {}on:
# At 05:00 on Monday.schedule:
- cron: '0 5 * * 1'jobs:
flaky-tests:
uses: Staffbase/gha-workflows/.github/workflows/template_flaky_tests.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
checks: readcontents: readwith:
# identifier for the slack channelslack-channel-id: 45678787976# name of the slack channelslack-channel-name: '#flaky-tests'# optional: name of the repository where it should check, default: current repositoryrepository: 'Staffbase/test-flaky'# optional: name of the branch where it should check, default: mainbranch: 'master'# optional: file path suffixes (comma seperated) to filter the test filespath-suffixes: '.spec.ts,.spec.tsx,.test.ts,.test.tsx'# prefix of the test run which should be filtered outprefix: 'test-'secrets:
# URL of the Slack incoming webhooksslack-incoming-webhooks-url: ${{ secrets.SLACK_INCOMING_WEBHOOKS_URL }}# GitHub tokentoken: ${{ secrets.GITHUB_TOKEN }}The action can be used to build and publish a docker image.
name: GitOpspermissions: {}on: [push]jobs:
gitops:
uses: Staffbase/gha-workflows/.github/workflows/template_gitops.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
contents: readwith:
# optional: host of the docker registry, default: "registry.staffbase.com"docker-registry: '<your-registry>'# optional: list of build-time variablesdocker-build-args: | "any important args"# optional: set the target stage to builddocker-build-target: 'any target'# optional: custom output destinations for docker build (e.g., type=registry,push=true,compression=gzip,force-compression=true). Required for DHI images.docker-build-outputs: '<your-output-settings>'# optional: set the target platforms for build (e.g., linux/arm64), default: "linux/amd64"docker-build-platform: "linux/arm64"# optional: set the provenance level of the docker build, default: "false"docker-build-provenance: '<your-provenance-level>'# optional: should the last stage image be retagged for the release image, default: falsedocker-disable-retagging: true# optional: path to the Dockerfile, default: ./Dockerfiledocker-file: <path-to-Dockerfile># optional: name of the docker image, default: private/<repository_name>docker-image: <your-image># optional: custom tag for the productive docker image which is preferred over the tag generated by the workflowdocker-custom-tag: <your-tag># optional: insert a UTC timestamp into dev/main/master tags (e.g. dev-20260602143055-<short-sha>) for sortable Flux image automation, default: falsedocker-tag-timestamp: true# optional: organization of the gitops repository, default: github.repository_ownergitops-organization: <your-organization># optional: repository where to update the files, default: mopsgitops-repository: '<your-repository>'# optional: user which does the commit, default: "staffbase-actions"gitops-user: '<your-user>'# optional: email of the user which does the commit, default: "staffbase-actions[bot]@users.noreply.github.com"gitops-email: '<your-email>'# optional: files which should be updated for devgitops-dev: |- your files# optional: files which should be updated for stagegitops-stage: |- your files# optional: files which should be updated for prodgitops-prod: |- your files# optional: defines the github runner for the gitops step if (e.g. ubuntu-24.04-arm for arm builds), default: ubuntu-24.04runs-on: ubuntu-24.04-arm# optional: Upwind.io client IDupwind-client-id: ${{ vars.UPWIND_CLIENT_ID }}# optional: Upwind.io organization IDupwind-organization-id: ${{ vars.UPWIND_ORGANIZATION_ID }}secrets:
# optional: username for the docker registrydocker-username: ${{ <your-docker-username> }}# optional: password for the docker registrydocker-password: ${{ <your-docker-password> }}# optional: list of secrets to expose to the build (e.g., key=string, GIT_AUTH_TOKEN=mytoken)docker-build-secrets: | "${{ <your-secrets> }}"# optional: list of secret files to expose to the build (e.g., key=filename, MY_SECRET=./secret.txt)docker-build-secret-files: | "${{ <your-secret-files> }}"# optional: token to access the repositorygitops-token: ${{ <your-gitops-token> }}# optional: gonosumdb environment variablegonosumdb: ${{ <your-gonosumdb> }}# optional: client id of the GitHub App for authenticationclient-id: ${{ <your-client-id> }}# optional: private key of the GitHub Appprivate-key: ${{ <your-private-key> }}# optional: Upwind client secretupwind-client-secret: ${{ secrets.UPWIND_CLIENT_SECRET }}The action can be used to collect all jira issues between the last two tags created. Then the jira issues will be updated with a release date and the labels will be tagged with the current tag name.
name: Annotate Jira Issuespermissions: {}on:
push:
tags: ['**']jobs:
jira_annotate:
uses: Staffbase/gha-workflows/.github/workflows/template_jira_tagging.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
contents: readwith:
# optional: name of the service to add as label, default: name of the repositoryname: 'component name'# optional: regex to match the tagstag-matcher: your regexsecrets:
# basic url for jira apijira-url: ${{ <your-url> }}# api token for jira usagejira-token: ${{ <your-token> }}# email of the api token ownerjira-email: ${{ <your-email> }}The action can be used to collect and push code references for LaunchDarkly feature flags.
name: Find LaunchDarkly flag code referencespermissions: {}on:
push:
branches:
- mainjobs:
ld_code_references:
uses: Staffbase/gha-workflows/.github/workflows/template_launchdarkly_code_references.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
contents: readwith:
# optional: key of the LD project, default: defaultproject-key: 'my-project'secrets:
# LD access token with correct access rightsaccess-token: ${{ <your-access-token> }}The action can be used to block the merge if a do not merge label is set.
name: Merge Blockpermissions: {}on:
pull_request:
types: [opened, labeled, unlabeled]jobs:
block:
uses: Staffbase/gha-workflows/.github/workflows/template_merge_block.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
pull-requests: writewith:
# optional: name of the label if the PR should not be merged, default: do not mergelabel: merge block# optional: comment when the PR is blocked, default: truecomment: falseThe action can be used to draft automatically a new release.
If you want to use the template action please note that you must have the configuration file .github/release-drafter.yml.
More information on how to configure this file can be found here.
name: Release Drafterpermissions: {}on:
push:
branches:
- mainjobs:
update_release_draft:
uses: Staffbase/gha-workflows/.github/workflows/template_release_drafter.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
contents: writepull-requests: readwith:
# optional: name of the release drafter configuration file, default: release-drafter.ymlconfig-name: release-drafter-test.yml# optional: name of the releasename: Version X.Y.Z# optional: should the release be published, default: falsepublish: true# optional: tag name of the releasetag: vX.Y.Z# optional: version to be associated with the releaseversion: X.Y.Z# optional: prerelease status of the release, default: falseprerelease: true# optional: prerelease identifier of the releaseprerelease-identifier: alphasecrets:
# optional: access token for the release draftertoken: ${{ <your-token> }}# optional: client id of the GitHub App for authenticationclient_id: ${{ <your-client-id> }}# optional: private key of the GitHub Appprivate_key: ${{ <your-private-key> }}The action can be used to get the next version for a service.
The new version is in the format YEAR.WEEK.COUNTER. You will get the version as output with the key new_version and the new tag with the key new_tag.
You can remove all other version resolver from your configuration.
name: Release Version Detectorpermissions: {}on:
push:
branches:
- mainjobs:
new_version:
uses: Staffbase/gha-workflows/.github/workflows/template_release_version.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
contents: readwith:
# optional: prefix of the tag in order to find the last release; this is useful for multi artifact/service repositories, default: 'v'tag-prefix: 'app-v'# optional: suffix of the tag in order to find the last release; this is useful for multi artifact/service repositories, default: '' (empty string)tag-suffix: '-native'# optional: format of the version, default: weeklyformat: 'quarterly'You could use the action in combination with the reusable release drafter. Make sure to add the following lines to update the week number correctly for a draft release.
on:
schedule:
# run every Monday at midnight and every new year to ensure the draft release have the correct week number
- cron: '0 0 * * 1'
- cron: '0 0 1 1 *'This workflow should be called by a PR and will scan it's commits for leaked credentials. The workflow will fail if any results are found.
name: Secret Scanpermissions: {}on: [pull_request]jobs:
trufflehog:
permissions:
contents: readuses: Staffbase/gha-workflows/.github/workflows/template_secret_scan.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1The action can be used to close old pull requests or issues automatically after a few days.
name: Stale PRspermissions: {}on:
schedule:
- cron: '0 0 * * 1-5'jobs:
stale:
uses: Staffbase/gha-workflows/.github/workflows/template_stale.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
contents: writepull-requests: writeissues: writewith:
# optional: comment on the stale pull request while closed, default: This stale PR was closed because there was no activity.close-pr-message: your message# optional: idle number of days before marking pull requests stale, default: 60days-before-pr-stale: 30# optional: delete branch after closing the pull request, default: truedelete-branch: false# optional: labels on pull requests exempted from staleexempt-pr-labels: your labels# optional: label to apply on staled pull requests, default: stalestale-pr-label: staling# optional: comment on the staled pull request, default: This PR has been automatically marked as stale because there has been no recent activity in the last 60 days. It will be closed in 7 days if no further activity occurs such as removing the label.stale-pr-message: your messageThis GitHub Action can be used for generating and publishing Backstage TechDocs for a monorepo. It is limited to an Azure Storage account.
name: TechDocspermissions: {}on:
push:
branches:
- 'main'paths:
- 'docs/**'
- 'mkdocs.yml'
- '.github/workflows/techdocs.yaml'jobs:
techdocs:
uses: Staffbase/gha-workflows/.github/workflows/template_techdocs_monorepo.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
contents: readsecrets:
# required: specifies an Azure Storage account nameazure-account-name: ${{ vars.TECHDOCS_AZURE_ACCOUNT_NAME }}# required: specifies the access key associated with the storage accountazure-account-key: ${{ secrets.TECHDOCS_AZURE_ACCESS_KEY }}This GitHub Action can be used for generating and publishing Backstage TechDocs.
name: TechDocspermissions: {}on:
push:
branches:
- 'main'paths:
- 'docs/**'
- 'mkdocs.yml'
- '.github/workflows/techdocs.yaml'jobs:
techdocs:
uses: Staffbase/gha-workflows/.github/workflows/template_techdocs.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
contents: readwith:
# optional: kind of the Backstage entity, default: Component# ref: https://backstage.io/docs/features/software-catalog/descriptor-format#contentsentity-kind: Component# optional: name of the Backstage entity, default: repository nameentity-name: custom-entity-name# optional: list of space separated additional python plugins to installadditional-plugins: 'mkdocs-minify-plugin\>=0.3'secrets:
# optional: specifies an Azure Storage account nameazure-account-name: ${{ vars.TECHDOCS_AZURE_ACCOUNT_NAME }}# optional: specifies the access key associated with the storage accountazure-account-key: ${{ secrets.TECHDOCS_AZURE_ACCESS_KEY }}This GitHub Action checks the formatting of Terraform files and commit fixes if necessary.
name: Terraformpermissions: {}on: [pull_request]jobs:
terraform:
uses: Staffbase/gha-workflows/.github/workflows/template_terraform_format.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
contents: readpull-requests: writewith:
# optional: Terraform version, default: latestterraform-version: latest# optional: Committer name, default: staffbase-actions[bot]committer-name: staffbase-actions[bot]# optional: Committer email, default: staffbase-actions[bot]@users.noreply.github.comcommitter-email: staffbase-actions[bot]@users.noreply.github.comsecrets:
# GitHub App is required because GITHUB_TOKEN will not trigger new actionsclient-id: ${{ <your-client-id> }}private-key: ${{ <your-private-key> }}The action can be used to check yaml files for formatting.
name: YAMLlintpermissions: {}on:
push:
branches:
- '**'tags-ignore:
- '**'jobs:
yamllint:
uses: Staffbase/gha-workflows/.github/workflows/template_yaml.yml@a38088448bfd106dbabe9f3b88f8cc8c88aaec83 # v15.1.1permissions:
contents: readchecks: writewith:
# optional: name of the running action, default: yamllint / yamllintaction-name: your name# optional: path which files should be checked recursively, default: .target-path: your pathWith the current implementation of the reusable workflows from GitHub, we have some usage limitations.
It isn't possible to access environment variables and secrets, so it's necessary to pass them to the workflow. But we don't want to do it for all secrets.
Reusable workflows can only restrict
GITHUB_TOKENpermissions, not escalate them. The calling workflow must grant at least the permissions required by the reusable workflow. All examples above include the minimum requiredpermissionsfor each workflow. For more details, see the GitHub documentation.
There are also some further limitations if you want to use the GITHUB_TOKEN.
To create a new release just use this page and publish the draft release.
Please read CONTRIBUTING.md for details on our code of conduct, and the process for submitting pull requests to us.
This project is licensed under the Apache-2.0 License - see the LICENSE.md file for details.
 | Staffbase GmbH Staffbase is an internal communications platform built to revolutionize the way you work and unite your company. Staffbase is hiring: staffbase.com/jobs GitHub | Website | Jobs |