.github

Polska wersja

Reusable GitHub Actions workflows and default community files for my repositories.

• .github/workflows/php-ci.yml: Composer audit, PHP CS Fixer or PHPCS, PHPStan, PHPUnit with a coverage gate, optional PostgreSQL, MongoDB and Redis services and front-end build
• .github/workflows/node-ci.yml: lint, typecheck, tests with a coverage gate, build
• .github/workflows/python-ci.yml: ruff, mypy, tests with a coverage gate
• .github/workflows/repo-ci.yml: gitleaks secret scan, actionlint, Docker build without push (skipped when there is no Dockerfile); shellcheck is preinstalled on ubuntu-24.04, so actionlint also checks run: scripts
• .github/workflows/quality-gate.yml: reusable security, duplication, new-code complexity, diff coverage and required-job gate
• actions/quality-gate: composite quality gate with per-check outcomes and a job summary
• actions/coverage-gate, actions/push-build-branch and actions/readme-check: composite actions used by the workflows

jobs:
  ci:
    uses: Tolemak/.github/.github/workflows/node-ci.yml@v2
    with:
      node-version: "24"
      coverage-file: coverage/cobertura-coverage.xml
      coverage-min: 80

composer-validate (php-ci) and audit-omit-dev (node-ci) are off by default. pip-audit (python-ci) and readme-check are on by default; audit-level (node-ci) defaults to low. node-ci runs npm run lint and npm run test by default, so a package without a lint or test script fails; pass lint-command: "" or test-command: "" to skip either step on purpose. All workflows default to the pinned ubuntu-24.04 runner; override runs-on to move to a newer image deliberately.

Inputs and their defaults are listed at the top of each workflow file. Pin @v2 or a full commit SHA. templates/dependabot.yml is a starting point for .github/dependabot.yml.

Versioning

Releases are annotated tags vMAJOR.MINOR.PATCH on main. The Move major tag workflow points the moving vMAJOR tag at the newest release of that major when such a tag is pushed. To repair or backfill it, run the workflow manually with the release tag, for example v1.3.1.