[sleidig]

Part of Aam-Digital/internal#392. This is the single consolidated PR for Aam-Digital/.github. It now also contains the Renovate presets from #2, which is closed in favour of this PR.

What

Reusable workflows (.github/workflows/, details in .github/workflows/README.md)

Workflow	Purpose	Check name(s) in the caller	Caller permissions
docker-image.yml	Builds and pushes images for PRs, edge builds and releases, each platform on a native runner	<job> / build (linux/amd64), <job> / build (linux/arm64), <job> / merge	contents: read, packages: write
edge-version.yml	Version of an edge build (1.4.1-edge.5), and whether the commit is still the head	<job> / version	contents: read
release.yml	semantic-release: full release	<job> / release	contents: read (writes use the token PAT)
image-cleanup.yml	Deletes the pr-<n> image when the PR closes, or the edge images (tags: "*-edge.*") after a full release; then untagged images older than 2 days	<job> / cleanup	actions: write, packages: write
pr-title-lint.yml	Conventional Commits PR titles	<job> / Validate PR title	pull-requests: read
actionlint.yml	actionlint + shellcheck	<job> / actionlint	contents: read

• docker-image.yml builds every platform on a native runner (ubuntu-latest / ubuntu-24.04-arm, no QEMU): one job build (<platform>) per platform pushes by digest, then a merge job creates the multi-arch image with all tags (skipped with push: false). It logs in to ghcr.io whenever it pushes, and to Docker Hub when DOCKERHUB_USERNAME is set. docker/metadata-action sets the org.opencontainers.image.version label from the first tag (the version, or e.g. pr-123).

  It deletes nothing itself. An image whose last tag moves to a newer push (an earlier pr-<n> push, the previous image of a branch tag like main) stays in the package untagged until the next run of image-cleanup.yml (below). Moving edge/latest/stable leaves the previous image tagged with its version.

  Steps shared between the jobs use YAML anchors.

• edge-version.yml computes the version of an edge build from git: the last full release with the patch number bumped, plus the commits since (1.4.1-edge.5). Its output is-head says whether the commit is still the head of the default branch; only then does the caller add the edge tag. Inputs: tag-prefix (e.g. aam-backend-service/), identifier (default edge). The version is always plain, also after a v-prefixed release tag (all repos release without v now).

• release.yml creates full releases only. It takes extra-plugins, node-version-file, the secrets token (required PAT) and slack-webhook, and has the outputs version and published. It overrides only branches (the caller's default branch); the plugin config stays in the repo.

• image-cleanup.yml deletes the given tags (default pr-<n> of the closed PR; wildcards such as *-edge.* allowed, a bare * is rejected) with dataaxiom/ghcr-cleanup-action, after cancelling and awaiting unfinished PR builds (build-workflows). Images carrying one of exclude-tags (default edge,main,master,stable,latest) are neither deleted nor untagged. Then it deletes all untagged images of the package older than untagged-older-than (default 2 days, empty to skip) as a best-effort step, after PR closes and releases alike. ghcr-cleanup-action never deletes children of tagged images (reference-counted), and the age limit protects builds in progress. This replaces an earlier cleanup-replaced step in docker-image.yml (about 230 lines of bash) and the former separate image-prune.yml / pr-image-cleanup.yml.

Renovate presets (renovate/default, renovate/node, renovate/docker, from #2, unchanged; see renovate/README.md.)

Updates and versioning of this repo:

• renovate.json extends renovate/default for the github-actions manager, so the actions inside the shared workflows (SHA pins and majors) get updated too.
• ci.yml moves the v1 tag to every new commit on main once actionlint / actionlint passes (job move-major-tag; it creates v1 on the first run). There are no v1.x.y releases: a merged PR, Renovate's included, reaches every repository on its next run. A breaking change sets MAJOR_TAG: v2 in ci.yml in the same PR, so v1 stays where it is.

Org-wide community health defaults:

• .github/ISSUE_TEMPLATE/: bug report, feature request, technical task. They are generalized from aam-services and set the org issue types (Bug, New Feature, Task) instead of repo-specific labels.
• SECURITY.md and CONTRIBUTING.md, generalized from ndb-core. The wording is neutral, so it also fits private repos. There is no org PR template.

Docs:

• The workflows README (short, for callers) covers the workflows with their triggers, permissions and check names, how to call them, the release model and how v1 moves. Inputs are documented in each workflow file.
• The root README gives an overview; the Renovate presets are documented in renovate/README.md.
• The pr-title-lint caller example now has a # zizmor: ignore[dangerous-triggers] comment with its reason (qlty's cloud defaults block on it otherwise).

Edge builds instead of prereleases

The issue planned semantic-release prereleases (branches: [{name: <default>, prerelease: edge}]). semantic-release rejects a lone prerelease branch (ERELEASEBRANCHES), and the workaround (a dry run plus tags and GitHub prereleases created by the workflow) was complex. Prereleases also filled the GitHub releases list: 22 of the first 30 entries of ndb-core's list are prereleases, and both the app's "latest changes" and ndb-setup's create-instance.sh only read that first page.

Instead, every push to the default branch is an edge build with no tag and no GitHub release:

• The version comes from edge-version.yml (see above), e.g. 3.93.1-edge.39. It sorts above the last release and below the next one.
• The image gets <version>, plus edge while the commit is the head. The caller's image job uses a concurrency group with cancel-in-progress: true, so an older run can't move edge back.
• After each full release, image-cleanup.yml (tags: "*-edge.*") deletes the edge images of the finished cycle.
• All four semantic-release repos (ndb-core, replication-backend, platform-admin-services, aam-services) build edge, also in auto release mode. ndb-core also publishes edge translations for that version.

Testing

• actionlint 1.7.12 with shellcheck 0.11.0: clean on all workflows.
• docker-image.yml, for real, in two runs of a temporary workflow building into the throwaway package ghcr.io/aam-digital/ci-test (package, caches and test branch deleted afterwards): the former QEMU mode, native runners (amd64 + arm64) → merge, and moving edge while the old image keeps its version tag. (These runs also tested the former cleanup-replaced step, which is removed now.)
• The native-only docker-image.yml and the merged image-cleanup.yml in the consumer PRs' CI (ndb-core #4507, replication-backend #381, aam-services #261, platform-admin-services #54): every PR build (single platform) passed with build (linux/amd64) → merge. ndb-core's run logged in to Docker Hub and ghcr.io and created pr-4507 in both registries; on ghcr.io its org.opencontainers.image.version label is pr-4507 (from metadata-action), while replication-backend's own label override 0.0.0-pr.381 is kept. Consumer workflows linted with actionlint against the shared workflows resolved locally.
• The release prune of image-cleanup.yml, for real (then still image-prune.yml), with *-test.* and exclude edge: the old prerelease image and its children were deleted. The image tagged edge + 0.0.2-test… kept both tags. The dry run deleted nothing.
• edge-version.yml, its version step run read-only against the clones of ndb-core (3.93.1-edge.39, with the old -master.* tags ignored), replication-backend (1.15.6-edge.0), platform-admin-services (then v1.7.5-edge.0; the v is dropped now) and aam-services (2.3.2-edge.0 with tag-prefix: aam-backend-service/).
• actionlint on each consumer with the shared workflows resolved locally (inputs, secrets and permissions of every call checked).
• Not exercised:
  • the native-only docker-image.yml with two platforms (an arm64 leg plus merge of two digests, and for ndb-core two digests × two registries) since the rework: first exercised by each consumer's first edge build on its default branch, and by keycloak-aam's next release (private repo, arm64 runner);
  • release.yml (a real release) and edge-version.yml's is-head check (both only run on the default branch);
  • the untagged sweep in image-cleanup.yml (it only runs when a PR closes or after a release). Its child handling was checked in the action's source (image-deleter.ts: a shared child is only deleted with its last parent). Check the first PR-close run after merging.

After merging

See the rollout checklist in Aam-Digital/internal#392:

1. Apply this repo's merge settings before merging (squash only, delete branch on merge), so feat/reusable-workflows is deleted on merge and no consumer keeps running it unnoticed.
2. After the merge, check that CI's move-major-tag created v1, then set up the ruleset with actionlint / actionlint.
3. Switch the consumer PRs from @feat/reusable-workflows to @v1 before merging them.

🤖 Generated with Claude Code

[sleidig]

Seems good but let's check one more time if any actions can reuse code or be simplified in any way