Reusable Workflows from the Enthusiasts 🎉

name: Enable Dependabot Auto-Merge
permissions: {}
on:
 pull_request:
jobs:
 dependabot:
 uses: Staffbase/gha-workflows/.github/workflows/template_automerge_dependabot.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions: {}
 with:
 # optional: merge strategy (accepted values: rebase, merge, squash. default: squash)
 strategy: squash
 # optional: comma-separated list of updates to accept (available types: major, minor, patch. default: minor,patch)
 update-types: major,minor,patch
 # optional: allow versions with semver 0.X.X (default: false)
 include-pre-release: true
 secrets:
 # client id of the GitHub App for authentication
 client_id: ${{ <your-client-id> }}
 # private key of the GitHub App
 private_key: ${{ <your-private-key> }}

name: Autodev
permissions: {}
on:
 push:
 branches-ignore:
 - dev
 pull_request:
 types: [labeled, unlabeled, closed]
jobs:
 autodev:
 uses: Staffbase/gha-workflows/.github/workflows/template_autodev.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 contents: read
 with:
 # optional: base branch from which the history originates, default: main
 base: master
 # optional: name of the dev branch, default: dev
 branch: your dev branch
 # optional: update status comment, default: false
 # if you want to change the message, please adapt 'success_comment' and/or 'failure_comment'
 comments: true
 # optional: update status label, default: false
 # if you want to change the labels, please adapt 'success_label' and/or 'failure_label'
 labels: true
 # optional: label which should trigger the action, default: dev
 label: deploy
 # optional: name of the user which does the commit, default: AutoDev Action
 user: your name
 # optional: mail of the user which does the commit, default: staffbot@staffbase.com
 email: your mail
 # optional: path relative to the repo root dir in which the GitOps action should be executed, default: .
 working-directory: ./my-service-folder
 secrets:
 # optional: access token to fetch the pull requests
 token: ${{ <your-token> }}
 # optional: client id of the GitHub App for authentication
 client_id: ${{ <your-client-id> }}
 # optional: private key of the GitHub App
 private_key: ${{ <your-private-key> }}

name: Changeset Check
permissions: {}
on:
 pull_request:
 types: [opened, reopened, synchronize]
jobs:
 changeset-check:
 uses: Staffbase/gha-workflows/.github/workflows/template_changeset_check.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 contents: read
 pull-requests: write

name: Release Changesets
permissions: {}
on:
 push:
 branches:
 - main
jobs:
 changeset-release:
 uses: Staffbase/gha-workflows/.github/workflows/template_changeset_release.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 contents: read
 with:
 # optional: The file containing the Node.js version to use, defaults to .nvmrc
 node-version-file: '.node-version'
 # optional: The script to run on publish. Defaults to `pnpm release`
 publish-script: 'pnpm publish'
 # optional: The script to run for bumping the package versions. Defaults to `pnpm changeset version`
 version-script: 'pnpm version'
 # optional: The registry to use for Node.js packages.
 node-registry: 'https://npm.pkg.github.com/'
 # optional: The scope to use for Node.js packages.
 node-registry-scope: '@staffbase'
 secrets:
 # client id of the GitHub App for authentication
 client_id: ${{ <your-client-id> }}
 # private key of the GitHub App
 private_key: ${{ <your-private-key> }}
 # needs write:packages rights
 npm-token: ${{ <your-npm-token> }}

name: Find flaky tests
permissions: {}
on:
 # At 05:00 on Monday.
 schedule:
 - cron: '0 5 * * 1'
jobs:
 flaky-tests:
 uses: Staffbase/gha-workflows/.github/workflows/template_flaky_tests.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 checks: read
 contents: read
 with:
 # identifier for the slack channel
 slack-channel-id: 45678787976
 # name of the slack channel
 slack-channel-name: '#flaky-tests'
 # optional: name of the repository where it should check, default: current repository
 repository: 'Staffbase/test-flaky'
 # optional: name of the branch where it should check, default: main
 branch: 'master'
 # optional: file path suffixes (comma seperated) to filter the test files
 path-suffixes: '.spec.ts,.spec.tsx,.test.ts,.test.tsx'
 # prefix of the test run which should be filtered out
 prefix: 'test-'
 secrets:
 # URL of the Slack incoming webhooks
 slack-incoming-webhooks-url: ${{ secrets.SLACK_INCOMING_WEBHOOKS_URL }}
 # GitHub token
 token: ${{ secrets.GITHUB_TOKEN }}

name: GitOps
permissions: {}
on: [push]
jobs:
 gitops:
 uses: Staffbase/gha-workflows/.github/workflows/template_gitops.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 contents: read
 with:
 # optional: host of the docker registry, default: "registry.staffbase.com"
 docker-registry: '<your-registry>'
 # optional: list of build-time variables
 docker-build-args: |
 "any important args"
 # optional: set the target stage to build
 docker-build-target: 'any target'
 # optional: custom output destinations for docker build (e.g., type=registry,push=true,compression=gzip,force-compression=true). Required for DHI images.
 docker-build-outputs: '<your-output-settings>'
 # optional: set the target platforms for build (e.g., linux/arm64), default: "linux/amd64"
 docker-build-platform: "linux/arm64"
 # optional: set the provenance level of the docker build, default: "false"
 docker-build-provenance: '<your-provenance-level>'
 # optional: should the last stage image be retagged for the release image, default: false
 docker-disable-retagging: true
 # optional: path to the Dockerfile, default: ./Dockerfile
 docker-file: <path-to-Dockerfile>
 # optional: name of the docker image, default: private/<repository_name>
 docker-image: <your-image>
 # optional: custom tag for the productive docker image which is preferred over the tag generated by the workflow
 docker-custom-tag: <your-tag>
 # optional: insert a UTC timestamp into dev/main/master tags (e.g. dev-20260602143055-<short-sha>) for sortable Flux image automation, default: false
 docker-tag-timestamp: true
 # optional: organization of the gitops repository, default: github.repository_owner
 gitops-organization: <your-organization>
 # optional: repository where to update the files, default: mops
 gitops-repository: '<your-repository>'
 # optional: user which does the commit, default: "staffbase-actions"
 gitops-user: '<your-user>'
 # optional: email of the user which does the commit, default: "staffbase-actions[bot]@users.noreply.github.com"
 gitops-email: '<your-email>'
 # optional: files which should be updated for dev
 gitops-dev: |-
 your files
 # optional: files which should be updated for stage
 gitops-stage: |-
 your files
 # optional: files which should be updated for prod
 gitops-prod: |-
 your files
 # optional: defines the github runner for the gitops step if (e.g. ubuntu-24.04-arm for arm builds), default: ubuntu-24.04
 runs-on: ubuntu-24.04-arm
 # optional: build linux/amd64 and linux/arm64 natively via a job matrix and merge them into one multi-arch image, default: false
 multi-arch: true
 # optional: base name of the artifact carrying the per-arch digests, only change it when building more than one multi-arch image in a workflow, default: docker-digests
 multiarch-artifact-name: docker-digests-my-service
 # optional: Upwind.io client ID
 upwind-client-id: ${{ vars.UPWIND_CLIENT_ID }}
 # optional: Upwind.io organization ID
 upwind-organization-id: ${{ vars.UPWIND_ORGANIZATION_ID }}
 secrets:
 # optional: username for the docker registry
 docker-username: ${{ <your-docker-username> }}
 # optional: password for the docker registry
 docker-password: ${{ <your-docker-password> }}
 # optional: list of secrets to expose to the build (e.g., key=string, GIT_AUTH_TOKEN=mytoken)
 docker-build-secrets: |
 "${{ <your-secrets> }}"
 # optional: list of secret files to expose to the build (e.g., key=filename, MY_SECRET=./secret.txt)
 docker-build-secret-files: |
 "${{ <your-secret-files> }}"
 # optional: token to access the repository
 gitops-token: ${{ <your-gitops-token> }}
 # optional: gonosumdb environment variable
 gonosumdb: ${{ <your-gonosumdb> }}
 # optional: client id of the GitHub App for authentication
 client-id: ${{ <your-client-id> }}
 # optional: private key of the GitHub App
 private-key: ${{ <your-private-key> }}
 # optional: Upwind client secret
 upwind-client-secret: ${{ secrets.UPWIND_CLIENT_SECRET }}

name: Annotate Jira Issues
permissions: {}
on:
 push:
 tags: ['**']
jobs:
 jira_annotate:
 uses: Staffbase/gha-workflows/.github/workflows/template_jira_tagging.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 contents: read
 with:
 # optional: name of the service to add as label, default: name of the repository
 name: 'component name'
 # optional: regex to match the tags
 tag-matcher: your regex
 secrets:
 # basic url for jira api
 jira-url: ${{ <your-url> }}
 # api token for jira usage
 jira-token: ${{ <your-token> }}
 # email of the api token owner
 jira-email: ${{ <your-email> }}

name: Find LaunchDarkly flag code references
permissions: {}
on:
 push:
 branches:
 - main
jobs:
 ld_code_references:
 uses: Staffbase/gha-workflows/.github/workflows/template_launchdarkly_code_references.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 contents: read
 with:
 # optional: key of the LD project, default: default
 project-key: 'my-project'
 secrets:
 # LD access token with correct access rights
 access-token: ${{ <your-access-token> }}

name: Merge Block
permissions: {}
on:
 pull_request:
 types: [opened, labeled, unlabeled]
jobs:
 block:
 uses: Staffbase/gha-workflows/.github/workflows/template_merge_block.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 pull-requests: write
 with:
 # optional: name of the label if the PR should not be merged, default: do not merge
 label: merge block
 # optional: comment when the PR is blocked, default: true
 comment: false

name: Release Drafter
permissions: {}
on:
 push:
 branches:
 - main
jobs:
 update_release_draft:
 uses: Staffbase/gha-workflows/.github/workflows/template_release_drafter.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 contents: write
 pull-requests: read
 with:
 # optional: name of the release drafter configuration file, default: release-drafter.yml
 config-name: release-drafter-test.yml
 # optional: name of the release
 name: Version X.Y.Z
 # optional: should the release be published, default: false
 publish: true
 # optional: tag name of the release
 tag: vX.Y.Z
 # optional: version to be associated with the release
 version: X.Y.Z
 # optional: prerelease status of the release, default: false
 prerelease: true
 # optional: prerelease identifier of the release
 prerelease-identifier: alpha
 secrets:
 # optional: access token for the release drafter
 token: ${{ <your-token> }}
 # optional: client id of the GitHub App for authentication
 client_id: ${{ <your-client-id> }}
 # optional: private key of the GitHub App
 private_key: ${{ <your-private-key> }}

name: Release Version Detector
permissions: {}
on:
 push:
 branches:
 - main
jobs:
 new_version:
 uses: Staffbase/gha-workflows/.github/workflows/template_release_version.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 contents: read
 with:
 # optional: prefix of the tag in order to find the last release; this is useful for multi artifact/service repositories, default: 'v'
 tag-prefix: 'app-v'
 # optional: suffix of the tag in order to find the last release; this is useful for multi artifact/service repositories, default: '' (empty string)
 tag-suffix: '-native'
 # optional: format of the version, default: weekly
 format: 'quarterly'

on:
 schedule:
 # run every Monday at midnight and every new year to ensure the draft release have the correct week number
 - cron: '0 0 * * 1'
 - cron: '0 0 1 1 *'

name: Secret Scan
permissions: {}
on: [pull_request]
jobs:
 trufflehog:
 permissions:
 contents: read
 uses: Staffbase/gha-workflows/.github/workflows/template_secret_scan.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0

name: Stale PRs
permissions: {}
on:
 schedule:
 - cron: '0 0 * * 1-5'
jobs:
 stale:
 uses: Staffbase/gha-workflows/.github/workflows/template_stale.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 contents: write
 pull-requests: write
 issues: write
 with:
 # optional: comment on the stale pull request while closed, default: This stale PR was closed because there was no activity.
 close-pr-message: your message
 # optional: idle number of days before marking pull requests stale, default: 60
 days-before-pr-stale: 30
 # optional: delete branch after closing the pull request, default: true
 delete-branch: false
 # optional: labels on pull requests exempted from stale
 exempt-pr-labels: your labels
 # optional: label to apply on staled pull requests, default: stale
 stale-pr-label: staling
 # optional: comment on the staled pull request, default: This PR has been automatically marked as stale because there has been no recent activity in the last 60 days. It will be closed in 7 days if no further activity occurs such as removing the label.
 stale-pr-message: your message

name: TechDocs
permissions: {}
on:
 push:
 branches:
 - 'main'
 paths:
 - 'docs/**'
 - 'mkdocs.yml'
 - '.github/workflows/techdocs.yaml'
jobs:
 techdocs:
 uses: Staffbase/gha-workflows/.github/workflows/template_techdocs_monorepo.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 contents: read
 secrets:
 # required: specifies an Azure Storage account name
 azure-account-name: ${{ vars.TECHDOCS_AZURE_ACCOUNT_NAME }}
 # required: specifies the access key associated with the storage account
 azure-account-key: ${{ secrets.TECHDOCS_AZURE_ACCESS_KEY }}

name: TechDocs
permissions: {}
on:
 push:
 branches:
 - 'main'
 paths:
 - 'docs/**'
 - 'mkdocs.yml'
 - '.github/workflows/techdocs.yaml'
jobs:
 techdocs:
 uses: Staffbase/gha-workflows/.github/workflows/template_techdocs.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 contents: read
 with:
 # optional: kind of the Backstage entity, default: Component
 # ref: https://backstage.io/docs/features/software-catalog/descriptor-format#contents
 entity-kind: Component
 # optional: name of the Backstage entity, default: repository name
 entity-name: custom-entity-name
 # optional: list of space separated additional python plugins to install
 additional-plugins: 'mkdocs-minify-plugin\>=0.3'
 secrets:
 # optional: specifies an Azure Storage account name
 azure-account-name: ${{ vars.TECHDOCS_AZURE_ACCOUNT_NAME }}
 # optional: specifies the access key associated with the storage account
 azure-account-key: ${{ secrets.TECHDOCS_AZURE_ACCESS_KEY }}

name: Terraform
permissions: {}
on: [pull_request]
jobs:
 terraform:
 uses: Staffbase/gha-workflows/.github/workflows/template_terraform_format.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 contents: read
 pull-requests: write
 with:
 # optional: Terraform version, default: latest
 terraform-version: latest
 # optional: Committer name, default: staffbase-actions[bot]
 committer-name: staffbase-actions[bot]
 # optional: Committer email, default: staffbase-actions[bot]@users.noreply.github.com
 committer-email: staffbase-actions[bot]@users.noreply.github.com
 secrets:
 # GitHub App is required because GITHUB_TOKEN will not trigger new actions
 client-id: ${{ <your-client-id> }}
 private-key: ${{ <your-private-key> }}

name: YAMLlint
permissions: {}
on:
 push:
 branches:
 - '**'
 tags-ignore:
 - '**'
jobs:
 yamllint:
 uses: Staffbase/gha-workflows/.github/workflows/template_yaml.yml@253a50e36f50a75bbc86f8bbcb8c4d99e363b09d # v16.0.0
 permissions:
 contents: read
 checks: write
 with:
 # optional: name of the running action, default: yamllint / yamllint
 action-name: your name
 # optional: path which files should be checked recursively, default: .
 target-path: your path