Reusable GitHub Actions for EdgeFirst and Maivin repositories. Product repos
call these workflows by commit SHA (tag recorded in a comment). This
repository is public so other public repos can uses: it.
Design: CICD Pipelines Ticket: EDGEAI-1553
The organisation profile README lives in profile/.
| Path | Purpose |
|---|---|
.github/workflows/rust-quick.yml |
fmt, clippy, nextest, dependency license |
.github/workflows/rust-full.yml |
host matrix, boards, coverage, scancode |
.github/workflows/python-quick.yml |
ruff + pytest |
.github/workflows/cmake-quick.yml |
ccache + ctest |
.github/workflows/nightly-gate.yml |
skip nightly when main is unchanged |
.github/workflows/advisories.yml |
cargo audit, run ungated so a new advisory is still reported |
.github/workflows/sbom.yml |
dependency or full scancode |
.github/workflows/tag-release.yml |
release/X.Y.Z merge → annotated vX.Y.Z |
.github/workflows/release-rust.yml |
crates OIDC, wheels as artifacts, GitHub Release |
.github/actions/ |
setup-rust, setup-python-uv, sbom-tools, board-run |
.github/scripts/ |
license policy (single copy) |
.github/rulesets/ |
protect-main (reviews; org-admin PR bypass), protect-main-ci (ci-gate, no bypass), protect-release-tags |
.github/runners/ |
ephemeral fleet provision scripts |
templates/ |
per-repo ci.yml, nightly.yml, tag-release.yml, release.yml |
uses: EdgeFirstAI/.github/.github/workflows/rust-quick.yml@eec0cb31b6576a47735099b91e39a9bdb5fbde3aThe uses: pin is the only place the shared commit appears, and Dependabot
bumps it. CI rejects tag refs such as @v1.0.0.
Internally each shared workflow checks itself out to reach its composite
actions, using job.workflow_repository and job.workflow_sha — the repository
and commit of the workflow file that defines the running job. Note that
github.workflow_sha is the caller's commit and is not a git object in this
repository; job.workflow_sha is the one that resolves here.
- Quick — every non-draft PR push.
- Full — label
ci:full(orci:hardwarefor boards only). - Nightly — schedule, only if
mainmoved.
ci-gate is the only required check. See
.github/copilot-instructions.md.
Per-lane input runner-class-linux (and arm/mac/windows): hosted (default),
fleet, or larger. Billed GitHub larger runners are an exception recorded in
the caller and restricted by the larger-runners group.
- PR
release/X.Y.Z→mainwithci:full. - Merge. Shared tag workflow creates an annotated
vX.Y.ZusingRELEASE_TAG_TOKEN. - Tag runs
release-rust.yml. crates.io trusted publishing uses the callerworkflow_refand environmentcrates-io. - PyPI trusted publishing cannot use this reusable workflow. The caller
keeps
publish-pypi(seetemplates/release.yml).
Do not tag by hand. Org rulesets in .github/rulesets/ enforce ci-gate on
migrated repos and restrict v* tag creation. Org admins may merge their own
PRs without a human approval; other authors still need a review. ci-gate
is required for everyone.
gh auth refresh -h github.com -s admin:org
bash .github/rulesets/apply.shCreate runner groups from .github/rulesets/runner-groups.md. Register
machines with .github/runners/provision-*.sh (EDGEAI-1577).
Set organisation Copilot custom instructions to
.github/copilot-instructions.md.