gh-actions

---

Shared composite GitHub Actions for the fleet — public, not Marketplace-listed, referenced directly from any repo in any org via uses: Rethunk-Tech/gh-actions/<action>@<ref>. Built to replace copy-pasted Bun/Next.js/Go/Python/Rust toolchain-setup and dependency-caching boilerplate that was drifting independently per repo across the fleet.

Quick start

- uses: actions/checkout@v7
- uses: Rethunk-Tech/gh-actions/setup-bun@v1.14
  with:
    working-directory: frontend

Full inputs/outputs, pinning practice, and the setup-nextjs-bun variant: HUMANS.md.

Highlights

• Cross-org by design — one uses: line works from any repo in any GitHub org, no shared workflow-permission config required.
• setup-bun resolves the Bun version from the consuming repo's own package.json packageManager field by default — no version to keep in sync by hand.
• setup-nextjs-bun adds a .next/cache build cache keyed exactly per Next.js's own documented CI caching guide (lockfile hash + source-file hash, independently invalidated).
• setup-go caches modules and the build cache per job, so a lint job never overwrites the -race build a test job needs, with a same-Go-version fallback across jobs.
• setup-go also bundles opt-in go test ./... (no -race), go test -race ./..., golangci-lint, golangci-lint fmt, and govulncheck gates, each continue-on-error behind a final gate step — enabling more than one still surfaces every finding even if one fails.
• setup-python wraps astral-sh/setup-uv with the cache forced on (upstream's auto default silently disables it on exactly the release and tag-push events where a cold install costs most), plus the same opt-in gate shape for ruff, uv audit, and uv run pytest.
• audit-bun runs bun audit --json and fails only on advisories with a shipped fix; the rest warn with their bun why chain. setup-bun's opt-in run-audit runs that same auditor, and its opt-in run-test runs bun test.
• install-playwright (setup-bun/setup-nextjs-bun) caches browsers by the resolved @playwright/test version, matching Playwright's own documented CI caching guide.
• extra-cache-paths (setup-bun) caches a build directory the repo owns alongside the install store, on a caller-supplied key — for a Turborepo .turbo or similar.
• Every wrapped dependency is SHA-pinned with a version comment; the repo-ops actions-refresh-sha sweep keeps pins current fleet-wide.
• Actually tested, not just schema-checked: each action runs end-to-end via act before a commit, and CI self-tests a real cold-cache-miss → warm-cache-hit round trip on every push.

Documentation

Doc	For
HUMANS.md	Using an action from another repo — inputs, outputs, pinning
AGENTS.md	Internals — conventions, testing, why setup-nextjs-bun doesn't compose setup-bun
CONTRIBUTING.md	Commit style, testing before a PR, adding a new action
SECURITY.md	Vulnerability reporting and trust boundary

License

MIT