github-actions

Shared composite GitHub Actions for InfraBlocks CI. Each action lives in its own root-level directory so it can be referenced directly by path.

This repo carries CI-baseline setup only — steps that must run before a repo's ./go tooling exists. Anything with logic in it (secret unlock, notifications, build/test/release behaviour) belongs in the build system as a rake tasklib, not here: CI is just a "thing do-er".

Available actions

• asdf_install — installs tools with asdf and caches the asdf directory, Ruby gems and the Poetry virtualenv.

Using an action

Reference an action by its directory path and the v1 tag from a consumer workflow:

steps:
  - uses: actions/checkout@v4
  - uses: infrablocks/github-actions/asdf_install@v1

Releases

v1 is a moving tag. There is no per-release version bump for consumers: they always track v1 and pick up the latest fix on their next workflow run, with no changes needed in their own repositories.

To ship a fix:

1. Merge the change to main.

2. Re-point v1 at the new commit and force-push the tag:

   git tag -f v1
   git push -f origin v1

Supply-chain policy

Third-party actions used inside these composite actions must be pinned to a full commit SHA (with a trailing comment noting the human-readable version). This keeps the trust boundary for external code in this one auditable repo: consumers trust InfraBlocks, and InfraBlocks vets exactly which upstream commit runs. Do not use floating tags (@v4, @main) for third-party actions here.