An opinionated set of composite actions bundled for re-use.
Each action includes a complete, copyable example.yaml workflow and a README describing its inputs and outputs.
See the migration guide for pinned CLI and execution-system changes.
- setup-nix: idempotent Nix prerequisite.
- setup-cache: detected language and tool dependency-download archives.
- setup-devenv: bootstrap and warm the selected project shell.
- setup-consumer: shared checkout, dependency authentication, caching and environment setup.
- run-devenv: execute commands in the selected project shell.
- setup-trivy: validate the environment's Trivy package and report its version.
- cargo-crap: measure Rust coverage, gate function thresholds and warn about regressions.
- release-rust: prepare, inspect and publish Cargo/Convco releases.
- free-disk-space: explicit hosted SDK cleanup, always skipped on self-hosted runners.
- report-status: Bash-only pipeline summaries and optional commit statuses using gh.
Each action is independently callable.
Each action owns its runtime scripts and private helper actions under its own scripts/ directory.
Its action.yaml, README.md, example.yaml and declarative test.yaml live beside that directory.
setup-cache and setup-devenv compose setup-nix as a shared prerequisite.
Nested $/ references follow the exact action revision selected by the caller, using GitHub's self-repository syntax.
GitHub Enterprise Server and Windows are outside the supported scope.
The environment composites target Linux; the standalone CodeQL workflow also supports macOS for Swift analysis.
Linux X64 and ARM64 execution is supported natively or with preconfigured runner emulation.
Pass the same system to setup-devenv, run-devenv, setup-trivy and setup-cache when selecting a foreign system.
The actions validate execution support but do not install emulation.
- Devenv CI: reusable lint and test execution with consumer environment and cache selection.
- Devenv update: validate lockfile updates and maintain a dependency PR using a GitHub App.
- Trivy: scan using the consumer's devenv Trivy package and tool cache.
- CodeQL: analyze selected languages using consumer devenv/flake toolchains or existing runner toolchains.
- Cargo CRAP: compare PRs with the baseline branch and maintain one optional baseline/badge PR.
- Rust release candidate: identify an ordinary merge or an approved release commit.
- Rust release preparation: maintain one version and changelog PR with Convco.
- Rust release publication: attach consumer-built artifacts and publish the approved version.
A consumer can call both from one secops.yaml; the combined example shows the interface.
Reusable workflows live under .github/workflows/ and compose this repository's actions with same-revision $/ references.
The workflow implementations, action implementations and upstream action pins are released together.
Consumers keep scan configuration and triggers in their own repositories.
See consumer setup and runners for LFS, SecretSpec profiles, scoped dependency credentials and self-hosted runner selection.
Dependabot's github-actions ecosystem updates SHA-pinned reusable workflow calls.
Use a published release SHA with a matching same-line version comment, and group related action updates into one PR per repository.
Central updates reach SHA-pinned consumers after their update PRs merge; they do not change existing pins automatically.
See GitHub's Dependabot guidance.
Database mirrors describes the public Trivy OCI packages, six-hour refresh schedule, retention and consumer configuration. Repository: SecOps scans this repository with Trivy and CodeQL.
Testing with Tact covers the Rust runner, per-action test.yaml scenarios and integration checks.
The repository Cargo CRAP workflow uses the shared workflow to compare PRs with trunk.
.cargo-crap.toml defines workspace scoring with threshold 30, regression warning tolerance 0.01 and the standard weight of 1 for ?.
Any function above 30 fails CI, including existing debt; regressions within the threshold produce warnings.
Tests, benchmarks and examples are excluded from scoring; coverage still runs the workspace tests.
Completed reports appear in the run summary and artifacts, with a sticky comment on same-repository PRs.
Trunk pushes refresh one crap/next PR containing .github/crap/baseline.json and .github/badges/crap-badge.json, using the existing CI App secrets described in release setup.
Merge that recording PR to publish the JSON; accepting a quality failure through merge makes the updated trunk source authoritative for future comparisons.
The permissive Cargo CRAP integration tests remain separate from this repository quality gate.
For an on-demand local report, run from the repository root:
CI=true SECRETSPEC_PROVIDER=env SECRETSPEC_REASON=local-cargo-crap \
devenv --no-tui shell --quiet -- crapCoverage output and instrumented builds stay under the ignored .tars/scratch/cargo-crap/ directory.
Devenv builds and provides the cargo-crap release selected by the root Cargo.lock before entering the shell.
The Nix package verifies its crates.io archive against the root lockfile checksum and builds with the release's bundled dependency lockfile.
Nix caches the resulting executable; no separate package version, archive hash or copied tool lockfile needs updating.
Repository analysis selects the three application crates; the consumer fixture has separate coverage lifecycle tests.
Coverage does not run in commit hooks.
Releasing the repository covers manual release preparation, publication after successful trunk CI, the shared Cargo version, Conventional Commits and dependency batching.
composite/<action>/: public actions with their metadata, documentation, declarative tests and owned runtime scripts.crates/: Tact and release automation.schemas/: handwritten schemas shared by the declarative test manifests.nix/packages/: repository tooling package definitions.tests/fixtures/: shared integration fixtures.docs/: contributor and release documentation..github/: repository workflows and Dependabot configuration.
Consumers reference tars-cloud/actions/composite/<action>@<reviewed-sha>.
Declare Cargo dependency versions in the root Cargo.toml under [workspace.dependencies].
Workspace members, including the Cargo CRAP consumer fixture, inherit those declarations and share the root Cargo.lock.
Tact materializes the root declarations and prunes a copy of the root lockfile when staging the standalone consumer fixture.
The dependency-free runtime smoke fixture retains its standalone manifest and lockfile.
Dependabot scans Cargo manifests recursively across the repository every week.
Dependabot updates the flake inputs in tests/fixtures/flakes/flake.lock weekly.
Every public action and consumer reusable workflow accepts debug, defaulting to false.
Pass debug: true under with: to enable verbose tool logs and phase diagnostics.
GitHub's Re-run with debug logging enables the same behaviour automatically through runner.debug and RUNNER_DEBUG.
An explicit false does not override GitHub debug logging.
Debug mode replaces devenv shell's --quiet with --verbose, enables verbose devenv tests, and adds
--verbose --print-build-logs to flake shell entry and Nix bootstrap builds.
Action-owned Cargo commands use CARGO_TERM_VERBOSE=true, and the Trivy workflow adds --debug to its scans.
It retains --no-tui and the selected consumer environment.
Logs include phase starts, exit codes, elapsed seconds, environment type, runner architecture, selected system and
flake selector.
A marker shows when the consumer shell starts executing commands.
Diagnostics go to stderr and preserve command exit codes, structured outputs and cache keys.
The setting is forwarded explicitly between actions and does not persist through GITHUB_ENV.
Debug mode does not enable shell tracing or print environment variables, credentials or consumer command source.
Consumer scripts control their own logging; their commands are not rewritten to add verbosity flags.
GitHub runner diagnostics and third-party action debug logs still use GitHub's own debug logging settings.