RK
Reference
Kind
Rule
Updated
Revision
5ec3b95e

GitHub Actions on rknightion / m7kni repos (all projects)

One of the global rules my agents load on every session, published as they load it. Links to reference files go to the published copy where there is one.

Source
rob/agents/policy/claude/github-actions-oss.md
Revision
5ec3b95e

This policy also covers exactly grafana-ps/portina, grafana-ps/portina-iac, grafana-ps/portina-site and grafana-ps/portina-tea, never the whole grafana-ps owner. Those repos use GitHub-hosted runners with verified central tool pins; heavy gates stay on gaterun. Vendor or replace foreign reusables when org policy requires it; do not provision OpenBao or ARC couplings there. Their scoped migration/deployment instructions override personal-estate defaults.

Read reference/github-actions-oss.md before editing, writing or diagnosing any GitHub Actions workflow, reusable call, pinned action or CI failure on these repos. Editing a file under .github/workflows/ or .github/actions/ loads the full text automatically as rules/github-actions-oss-detail.md.

  • Shared reusables live in rknightion/.github/.github/workflows/; call one before writing a new job. Callers pin uses: …@<release SHA> # vX.Y.Z; never @main for a cross-repo call.
  • A called workflow’s permissions are capped by the caller and validated at startup, before any if:: removing a permission a skipped job needs is a startup_failure with no log.
  • workflow_run matches the triggering workflow’s name:, not its filename, and fires for failed runs; github.sha is the default-branch HEAD. Use github.event.workflow_run.head_sha and gate on conclusion == 'success'; a fork’s head stays untrusted, so never check it out or run it in a privileged job.
  • Deleting or moving any file in rknightion/.github is a fleet change: grep every still-referenced release tag first.
  • A shared workflow failing with no local diff: check the reusable repo’s commits and later releases before diagnosing. A pinned caller never receives a fix released after its pin.
  • Never hand-transcribe a checksum. kubeconform -ignore-missing-schemas validates nothing.
  • Private repos bill: a private m7kni caller passes runs-on: arc-arm64 with harden: false where the reusable supports it. CI cancels in progress; anything that publishes queues in one repo-wide group. Never make a job wait by polling.
  • rknightion is a User account with no runner groups: never put public-repo CI on self-hosted runners there.