forkwright/.github

Reusable CI workflows for the forkwright fleet. All repos call these instead of maintaining local copies.

.github/workflows/ holds 11 files. actionlint.yml lints THIS repo's own workflows on its own pull requests and is never called by a consumer. The other 10 declare workflow_call and are the fleet reusables; every input they accept is in Workflow inputs below, generated from those files rather than typed by hand — run python3 scripts/render_readme_tables.py to refresh this README's three generated sections (Workflow inputs, Pinned action versions, Fleet rollout) against whatever the tree and the org currently look like, and splice its output back in.

Caller pattern

Each repo keeps a thin .github/workflows/<name>.yml that delegates entirely. Four of the ten reusables illustrated below; the rest follow the identical uses: forkwright/.github/.github/workflows/<name>.yml@main shape with their own inputs from the table below.

# .github/workflows/gate-attestation.yml
name: Gate Attestation
on:
  pull_request:
    branches: [main]
jobs:
  call:
    uses: forkwright/.github/.github/workflows/gate-attestation.yml@main
    # NOTE: takes no inputs (workflow_call: {}) — runner is fixed at
    # ubuntu-latest, not configurable. A repo needing hybrid-gate's real
    # Rust build (fmt, check, clippy, nextest) calls hybrid-gate.yml
    # instead; its inputs are in the table below.

# .github/workflows/security.yml
name: Security
on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  schedule:
    - cron: "23 11 * * *"
  workflow_dispatch:
jobs:
  call:
    uses: forkwright/.github/.github/workflows/security.yml@main
    secrets: inherit
    # NOTE: add `with: { runner: self-hosted }` for repos on self-hosted runners
    # NOTE: add `with: { has_private_deps: true }` for repos with private fleet deps
    # NOTE: add `with: { cargo_audit_timeout_minutes: 30 }` for large workspaces

# .github/workflows/stale.yml
name: Stale
on:
  schedule:
    - cron: "0 12 * * 0"
  workflow_dispatch:
jobs:
  call:
    uses: forkwright/.github/.github/workflows/stale.yml@main

# .github/workflows/release-please.yml
name: Release Please
on:
  push:
    branches: [main]
  workflow_dispatch: {}
jobs:
  call:
    uses: forkwright/.github/.github/workflows/release-please.yml@main

Workflow inputs

Generated by scripts/render_readme_tables.py from each file's own workflow_call block — the block itself is canonical; this table is a read-only summary. docs-only is not called directly by any consumer today; hybrid-gate.yml calls it internally to compute its own docs-only exemption.

Workflow	Input	Default	Notes
codeql	actions_timeout_minutes	30
codeql	analyze_actions	true
codeql	analyze_rust	true
codeql	queries	+security-extended
codeql	rust_timeout_minutes	90
codeql	rust_toolchain	stable
dependabot-auto-merge	(none)
docs-only	docs_only_exemption	true	Compute the verdict at all. When false the job still runs and reports docs_only=false, so a caller can wire the dependency unconditionally and let the repo opt out by input rather than by workflow surgery.
gate-attestation	(none)
hybrid-gate	ai_attribution_check	true	Run the fleet AI-attribution check (greps PR title/body and the PR-range commit messages for co-authored-by/generated-with/robot markers naming an AI tool). Bot/release-please PRs are waived the same as the trailer check.
hybrid-gate	check_cmd	cargo check --workspace --all-targets	The exact compile-check command.
hybrid-gate	clippy_cmd	cargo clippy --workspace --all-targets -- -D warnings	The exact clippy command.
hybrid-gate	docs_only_exemption	true	Exempt a docs-only diff from full-gate-build even with no Gate-Passed trailer. Does not affect ai_attribution_check, which still runs on docs-only PRs.
hybrid-gate	doctest_cmd	``	Optional separate doctest command (nextest does not execute doctests). Empty skips this step.
hybrid-gate	fmt_cmd	cargo fmt --all -- --check	The exact fmt-check command.
hybrid-gate	full_gate_timeout_minutes	90	Timeout for the full-gate-build job.
hybrid-gate	needs_fleet_repo_token	false	Set true only when this repo's Cargo.toml resolves a git dependency needing authenticated fetch. Gates the git-credential step and the FLEET_REPO_TOKEN secret requirement.
hybrid-gate	nextest_cmd	cargo nextest run --workspace	The exact nextest invocation.
hybrid-gate	rust_cache_key	gate-attestation	Swatinem/rust-cache cache key discriminator.
hybrid-gate	rust_toolchain	``	Rust toolchain channel (e.g. "1.89", "stable"). Empty (default) auto-detects from the caller repo's own rust-toolchain.toml/rust-toolchain file — the fleet convention. Set only for a repo with no toolchain file of its own.
hybrid-gate	system_packages	``	Space-separated apt package list to install before check/clippy/nextest. Empty skips the install step.
no-ai-attribution	pattern_file	.github/no-ai-attribution-patterns.txt
release-please	config_file	release-please-config.json
release-please	manifest_file	.release-please-manifest.json
release-pr-checks	healer_ref	main	Ref of forkwright/.github to take the healer script from. Pin only to reproduce a past run.
release-pr-checks	required_context_workflows	gate-attestation.yml,security.yml	Comma-separated workflow FILENAMES that produce this repo's branch-protection required contexts.
security	cargo_audit_timeout_minutes	15
security	cargo_deny_arguments	``	Extra arguments passed to cargo-deny, e.g. "--all-features".
security	cargo_deny_timeout_minutes	15
security	has_private_deps	false	Configure FLEET_REPO_TOKEN git credentials for cross-repo private deps.
security	osv_config	osv-scanner.toml
security	osv_lockfile	Cargo.lock
security	run_osv	true	Run google/osv-scanner (uploads SARIF to code scanning).
security	runner	ubuntu-latest
stale	days_before_close	14	Days after stale label before closing.
stale	days_before_issue_stale	60	Days of inactivity before marking an issue stale.
stale	days_before_pr_stale	30	Days of inactivity before marking a PR stale.

Pinned action versions

Generated the same way, from the uses: <action>@<sha> # <version> lines across .github/workflows/*.yml. Excludes this repo's own internal reusable-to-reusable calls (e.g. hybrid-gate.yml → docs-only.yml), which are pinned for the same reason but are not a fleet-consumer-facing dependency.

Action	Version	SHA
EmbarkStudios/cargo-deny-action	v2.1.1	3c6349835b2b7b196a839186cb8b78e02f7b5f25
Swatinem/rust-cache	v2	f0d9c3887740aee45f6153b24b3a6b815192ec16
actions-rust-lang/setup-rust-toolchain	v1.17.0	166cdcfd11aee3cb47222f9ddb555ce30ddb9659
actions/checkout	v7.0.1	3d3c42e5aac5ba805825da76410c181273ba90b1
actions/stale	v11.0.0	4391f3da665fdf50b6810c1a66712fb9ba21aa93
actions/upload-artifact	v7.0.1	043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
dependabot/fetch-metadata	v3.1.0	25dd0e34f4fe68f24cc83900b1fe3fe149efef98
dtolnay/rust-toolchain	stable	631a55b12751854ce901bb631d5902ceb48146f7
github/codeql-action/analyze	v4	dd677812177e0c29f9c970a6c58d8607ae1bfefd
github/codeql-action/autobuild	v4	dd677812177e0c29f9c970a6c58d8607ae1bfefd
github/codeql-action/init	v4	dd677812177e0c29f9c970a6c58d8607ae1bfefd
googleapis/release-please-action	v5.0.0	45996ed1f6d02564a971a2fa1b5860e934307cf7
taiki-e/install-action	v2.86.5	ba47c86ac325773530516bb756137ac718732518

Fleet rollout

A GitHub code-search snapshot (scripts/render_readme_tables.py), not a maintained list — the prior hand-typed version fell out of date the moment a repo converted without an edit here, and stayed silently wrong afterward. The query finds a .github/workflows/ file containing this repo's uses: prefix; it needs network + gh auth and does not claim completeness — a repo absent below has no detected match, not a proven non-match, and a private repo the token cannot search reads identically to one that never converted.

Repo	Reusables consumed
forkwright/akroasis	dependabot-auto-merge, gate-attestation, release-please, release-pr-checks
forkwright/aletheia	gate-attestation
forkwright/dioptron	release-please
forkwright/epistole	dependabot-auto-merge, gate-attestation, release-please, release-pr-checks
forkwright/epitelesis	release-please, release-pr-checks
forkwright/gnomon	gate-attestation, release-please
forkwright/hamma	gate-attestation, release-please, release-pr-checks
forkwright/harmonia	gate-attestation, release-please, release-pr-checks
forkwright/heurema	gate-attestation, release-please, release-pr-checks
forkwright/koinon	gate-attestation, release-please, release-pr-checks
forkwright/logismos	gate-attestation, release-please, release-pr-checks
forkwright/mneme	gate-attestation, release-please
forkwright/pinax	gate-attestation, release-please
forkwright/sphragis	dependabot-auto-merge, gate-attestation, release-please, release-pr-checks
forkwright/theatron	codeql, dependabot-auto-merge, gate-attestation, release-please, release-pr-checks, stale
forkwright/thumos	gate-attestation, release-pr-checks
forkwright/typikon	gate-attestation, release-pr-checks
forkwright/zetesis	gate-attestation, release-please, release-pr-checks, security

Required checks on main

actionlint and event-shape-guards are required status checks on main. Both live in actionlint.yml and both run on every pull request.

WARNING for anyone editing actionlint.yml: do not reintroduce a paths: filter on its trigger. It carried one (.github/workflows/**, scripts/**) until it became required, and a required check that cannot run on some pull requests blocks those pull requests forever — nothing failing, nothing pending, nothing to point at. This repository has watched that happen to a sibling repo's main.

The cost is that a docs-only pull request re-lints unchanged workflows. That is seconds, and it is the correct trade for the repository whose entire content is other repositories' CI.

Visibility requirement

This repo must remain public. GitHub does not allow private repos to call reusable workflows from a private source repo on a personal account (forkwright is a personal account, not a GitHub org). Making this repo public unblocks private consumers (gnomon calls gate-attestation and release-please today — see Fleet rollout above) as well as public ones.