gh-actions

Reusable GitHub Actions for the Tempo organization.

Every tool these actions and workflows download is verified with the strongest proof its publisher offers, in addition to a checksum; a checksum from the same release cannot detect a release that was compromised end to end. The only accepted reason to skip a check is a large wall-clock cost.

Copies of outside actions, vendored under vendor/ so they count as tempoxyz-owned under the org's Actions policy. Each copy is an exact upstream commit recorded in vendor-manifest.yml; the version column links to the upstream README at that commit. Reference them as tempoxyz/gh-actions/vendor/<owner>/<repo>[/<path>]@<commit-sha> (see Versioning), with the same inputs and outputs as upstream. To add or update one, edit the manifest with node vendor/add.mjs owner/repo@<tag> or bump ref/sha, run node vendor/sync.mjs, and commit the result; CI fails if vendor/ or this table drift from the manifest. Details of what is excluded from each copy and why are in the manifest notes.

Reference actions using tempoxyz/gh-actions/actions/<name>@main (pin to a commit SHA in production — see Versioning):

steps:
  - uses: tempoxyz/gh-actions/actions/setup-rust-build@main
    with:
      toolchain: stable
      components: clippy,rustfmt

  - uses: tempoxyz/gh-actions/actions/docker-login@main
    with:
      ghcr-token: ${{ secrets.GITHUB_TOKEN }}

  - uses: tempoxyz/gh-actions/actions/publish-event@main
    with:
      url: ${{ secrets.EVENTS_ARGS }}
      event-type: registry_package
      tag: sha-${{ steps.shortsha.outputs.shortsha }}

Use secure-runner as the first step in a job. It uses the production STS endpoints by default; set dev: true to use the development endpoints.

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Secure runner
        uses: tempoxyz/gh-actions/actions/secure-runner@<commit-sha>

      - uses: actions/checkout@<commit-sha>

      - run: make test

The default fallback egress policy is audit. Set egress-policy: block and, if needed, allowed-endpoints for workflows that should fail closed when no stored policy applies. The nested Harden Runner wrapper performs its STS exchange in its pre-job entrypoint before starting Harden Runner, because Harden Runner fetches its policy in its own pre-job entrypoint. The short-lived API key is passed only to the vendored Harden Runner process and is revoked during post-job cleanup.

Examples in this repo use @main for brevity. For production, pin to a full commit SHA — branch refs like @main are mutable, and the bundled scan-github-actions workflow flags unpinned uses. Add a trailing reference comment; the optional pinact policy check requires one for bare SHA pins, and it also improves readability:

uses: tempoxyz/gh-actions/actions/setup-rust-build@<commit-sha> # main

This repo does not yet publish version tags; SHA pinning is the recommended stable reference.

Reference reusable workflows using tempoxyz/gh-actions/.github/workflows/<name>.yml@main (pin to a commit SHA in production — see Versioning).

Publishes a pr_audit event when a pull request receives a configured label. This reusable workflow is read-only against repository contents. Comment-driven audit commands are handled separately by the pr-audit-comment composite action in a caller-owned job (see below).

name: PR Audit

on:
  pull_request:
    types: [labeled]

jobs:
  pr-audit:
    uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@main
    permissions:
      contents: read
    with:
      environment: pr-audit
      required-labels: |
        cyclops
        agentic-audit
    secrets:
      EVENTS_KEY: ${{ secrets.EVENTS_KEY }}
      EVENTS_CERT: ${{ secrets.EVENTS_CERT }}
      EVENTS_ARGS: ${{ secrets.EVENTS_ARGS }}

Optional inputs:

• required-label — label that triggers audit publishing (default: cyclops); kept for compatibility
• required-labels — comma or newline-separated labels that trigger audit publishing; when set, this overrides required-label
• environment — GitHub Environment name, such as pr-audit, used to gate audit publishing
• branch / pr-number — target for ad-hoc workflow_dispatch callers
• require-completed-audit — publish a Cyclops audit run merge-gate status (default: false)

When require-completed-audit: true, internal and non-Dependabot pull requests remain pending until tempoxyz-bot posts a completed Cyclops review; fork and Dependabot pull requests are exempt. Completed reviews remain valid after later commits. The caller must add pull_request_target, pull_request_review, and merge_group triggers, grant pull-requests: read and statuses: write, and require the resulting Cyclops audit run status on the protected branch. Reusable workflows cannot declare caller event triggers.

on:
  pull_request:
    types: [labeled]
  pull_request_target: # zizmor: ignore[dangerous-triggers]
    types: [opened, reopened, synchronize, labeled, unlabeled]
  pull_request_review:
    types: [submitted]
  merge_group:

jobs:
  pr-audit:
    uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@main
    permissions:
      contents: read
      pull-requests: read
      statuses: write
    with:
      require-completed-audit: true
    secrets:
      EVENTS_KEY: ${{ secrets.EVENTS_KEY }}
      EVENTS_CERT: ${{ secrets.EVENTS_CERT }}
      EVENTS_ARGS: ${{ secrets.EVENTS_ARGS }}

Repos that need protected environment gates, such as Zones' environment: pr-audit gate for EVENTS_*, should pass environment: pr-audit so the publish job preserves that approval boundary.

Because comment handling needs issues: write and pull-requests: read, it lives in a caller-owned job that runs the pr-audit-comment composite action rather than in the read-only reusable workflow. Add it alongside the label job:

on:
  pull_request:
    types: [labeled]
  issue_comment:
    types: [created]

jobs:
  pr-audit:
    uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@main
    permissions:
      contents: read
    with:
      environment: pr-audit
    secrets:
      EVENTS_KEY: ${{ secrets.EVENTS_KEY }}
      EVENTS_CERT: ${{ secrets.EVENTS_CERT }}
      EVENTS_ARGS: ${{ secrets.EVENTS_ARGS }}

  pr-audit-comment:
    if: >-
      github.event_name == 'issue_comment' &&
      github.event.issue.pull_request &&
      (
        startsWith(github.event.comment.body, 'cyclops audit') ||
        startsWith(github.event.comment.body, 'cyclops private audit') ||
        startsWith(github.event.comment.body, '@decofe cyclops audit') ||
        startsWith(github.event.comment.body, '@decofe cyclops private audit') ||
        startsWith(github.event.comment.body, 'derek audit')
      )
    runs-on: ubuntu-latest
    environment: pr-audit
    permissions:
      contents: read
      issues: write
      pull-requests: read
    steps:
      - uses: tempoxyz/gh-actions/actions/pr-audit-comment@main
        with:
          command-regex: '^(?:@decofe\s+)?(?:cyclops\s+(?:private\s+)?audit|derek\s+audit)\b'
          permission-check-mode: association
          allowed-associations: OWNER,MEMBER
          organization: tempoxyz
          events-key: ${{ secrets.EVENTS_KEY }}
          events-cert: ${{ secrets.EVENTS_CERT }}
          events-args: ${{ secrets.EVENTS_ARGS }}
          github-token: ${{ github.token }}

The comment surface supports:

• comments: cyclops audit, cyclops private audit, @decofe cyclops audit, derek audit
• arguments: private, fast, perf, iterations=N, hours=N, config=PATH, models=..., run-label=LABEL, dry-run, note="..."

Set permission-check-mode: org (with organization) for org-membership API checks. Use permission-token when those checks need a token distinct from the one used for PR reads and status comments:

          permission-check-mode: org
          organization: tempoxyz
          github-token: ${{ secrets.DEREK_BENCH_TOKEN }}
          permission-token: ${{ secrets.DEREK_BENCH_ACK_TOKEN }}

If permission-token is omitted, membership checks use github-token as before. In association mode, allowed-associations controls which GitHub commenter associations may trigger an audit. It defaults to OWNER,MEMBER,COLLABORATOR. In both permission modes, authorization applies to the commenter, not the pull request author, so a trusted commenter can audit a pull request from an external fork. allow-same-author is deprecated, has no effect, and remains accepted only for compatibility with existing callers.

Labels newly opened pull requests by copying eligible labels from the issue linked in the pull request body.

name: Label PRs

on:
  pull_request:
    types: [opened]

jobs:
  label-prs:
    uses: tempoxyz/gh-actions/.github/workflows/label-prs.yml@main
    permissions:
      contents: read
      issues: write

Caller workflows must grant these permissions on the reusable-workflow job. contents: read is needed to check out tempoxyz/gh-actions; issues: write reads issue labels and adds labels to the pull request through GitHub's Issues API.

The reusable workflow checks out tempoxyz/gh-actions at github.workflow_sha, so the bundled label script matches the pinned reusable workflow revision.

The dedicated scan-github-actions-ci.yml caller runs on pull requests and pushes to main in this repository, scanning .github actions with actionlint and pinact enabled. This includes the secure-runner policy check; CI does not invoke a separate scan or policy-check job. The reusable workflow only declares workflow_call.

Security scan and lint for GitHub Actions workflows: zizmor for security and actionlint (with shellcheck/pyflakes) for workflow syntax and run: script correctness. Findings appear as GitHub workflow annotations and in the workflow log. The lint pass can be turned off with actionlint: false.

Set pinact: true to also run pinact in check-only mode. This enforces a default seven-day minimum age for pinned action commits and adds optional version-comment verification without editing files or adding a second reusable-workflow job. Caller-local Pinact configuration is merged on top of the trusted default source and can override its threshold, so repository configuration remains review-sensitive. Existing callers remain unchanged because the pinact check is opt-in.

zizmor, actionlint, and the optional pinact policy run together in a single Scan GitHub Actions check. The reusable workflow is read-only against repository and Actions data and never requests security-events: write. To upload SARIF to GitHub code scanning, use the composite action with advanced-security: true in a job you control (see its README).

name: Scan GitHub Actions

on:
  push:
    branches: [main]
  pull_request:

jobs:
  scan:
    uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@main
    permissions:
      actions: read
      contents: read
    with:
      pinact: true

By default zizmor scans the whole repo, so first-party workflows and actions anywhere (e.g. across a monorepo) are covered. Repos that vendor third-party workflows/actions can narrow zizmor's scope with the paths input (e.g. to .github/) to avoid flagging code they don't own. Pinact uses its own file discovery; monorepos with action manifests outside its defaults can set files in their Pinact configuration.

Optional inputs:

• paths (default: .) — whitespace-separated paths for zizmor to scan; narrow to e.g. .github/ to exclude vendored or third-party trees
• config — path to a zizmor config file for rule overrides. When empty and the repository has no zizmor config of its own, the scan uses a default that disables zizmor's ref-version-mismatch audit: this repository publishes no version tags, so a version comment on a pin to it can never match and every such pin would otherwise be a medium-severity finding that fails the scan. Comment correctness for third-party pins is covered by pinact's verify-pin-comments. Add a .github/zizmor.yml to a repo to take back full control.
• actionlint (default: true) — run actionlint (syntax, expression, and shellcheck/pyflakes checks) alongside the zizmor scan
• pinact (default: false) — run pinact policy checks alongside zizmor and actionlint
• pin-config (default: .pinact.yaml) — path to the caller repo's pinact configuration file; the default is optional when absent
• pin-no-api (default: false) — perform offline pin validation without API-based comment or minimum-age verification
• verify-pin-comments (default: false) — verify that semver version comments resolve to the pinned SHA
• verify-pin-min-age (default: true) — verify current pins against configured minimum-age rules
• pin-min-age (default: 7) — default minimum age in days for pinned action commits; caller-local Pinact configuration can override it

Dependency Scan scans base and proposed revisions with our osv-scanner-action, then compares results to find new vulnerabilities. Works on private repositories without GitHub Code Security or Advanced Security. Uses Tempo-owned actions and GitHub’s actions/checkout and actions/upload-artifact. Native OSV binaries are installed from GitHub releases and verified against pinned checksums and SLSA provenance. Docker and Go are not required; the action uses Node.js 20+ for installation and reporting on Linux, macOS, and Windows.

name: Dependency Scan

on:
  pull_request:
  merge_group:

permissions: {}

jobs:
  scan:
    uses: tempoxyz/gh-actions/.github/workflows/dependency-scan.yml@main
    permissions:
      contents: read
      id-token: write

Pin production callers to a full commit SHA. The dedicated dependency-scan-ci.yml caller runs this workflow on this repository's pull requests and merge groups on Linux, macOS, and Windows. It starts with secure-runner; the OIDC permission is for runner protection, and no GitHub/OIDC credentials are forwarded to the native child processes.

By default, scans compare the event's base SHA with its merge SHA, including the proposed merge result. Other events require both base-ref and head-ref; pull_request_target and workflow_run are rejected. Both checkouts disable credential persistence. Results live in an isolated runner temporary directory that survives switching revisions. Native scans use the runner’s filesystem permissions; there is no container or read-only mount.

New vulnerabilities fail the job by default. Existing findings are baselined using OSV's occurrence-count and source/package/advisory comparison semantics. fail-on-vuln: false makes findings informational; scanner failures and missing or malformed results still fail. A revision with no supported dependency files is allowed and produces an empty inventory, so a PR can introduce its first lockfile or remove its last one. OSV-supported lockfiles, SBOMs, and manifests are scanned; unresolved or unsupported dependencies are not an assurance of safety. Call analysis is disabled.

Results appear as annotations and in the job summary. Base/head JSON, diff JSON, Markdown, and SARIF are retained together as an Actions artifact for five days, including when the vulnerability gate fails. Nothing is uploaded to Code Scanning, and no security-events: write or pull-requests: write permission is required.

The vulnerabilities-found workflow output is true or false after a completed comparison. Configure OSV exclusions with osv-scanner.toml or scan-args; each revision's scanner configuration applies to its scan.

Migration from dependency-review.yml: change the workflow path and required status check names, remove old inputs/secrets, and remove pull-requests: write. The old workflow defaulted to warning only; use fail-on-vuln: false to retain that behavior. License policy, package deny lists, Scorecard, PR comments, and the old action's JSON outputs are not carried over. Previously SHA-pinned callers continue using the old implementation until their pins are updated.

Builds a repository's byte-deterministic binary using scripts/reproducible-build.sh, writes a sha256 file, and uploads it as a short-lived artifact.

name: Reproducible Build

permissions: {}

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      ref:
        description: "Git ref (branch, tag, or full SHA) to build reproducibly"
        type: string
        required: false
        default: "main"

concurrency:
  group: reproducible-build-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: ${{ github.event_name == 'push' }}

jobs:
  build:
    uses: tempoxyz/gh-actions/.github/workflows/reproducible-build.yml@main
    permissions:
      contents: read
    with:
      ref: ${{ inputs.ref }}
      binary-name: tempo

Caller workflows must grant contents: read so the reusable workflow can check out the repository being built.

Required input:

• binary-name — name of the binary produced in out/

Optional inputs:

• ref — Git ref to check out
• target (default: x86_64-unknown-linux-gnu)
• build-script (default: ./scripts/reproducible-build.sh)
• runs-on (default: depot-ubuntu-latest-16)
• retention-days (default: 7)

Runs a common Rust lint set: cargo clippy, cargo fmt, typos, and cargo deny. All checks run by default and can be enabled or disabled independently.

name: Lint

on:
  push:
    branches: [main]
  pull_request:
  merge_group:

permissions: {}

jobs:
  lint:
    uses: tempoxyz/gh-actions/.github/workflows/rust-lint.yml@main
    permissions:
      contents: read
      id-token: write

Optional inputs:

• run-clippy, run-fmt, run-typos, run-deny (default: true) — enable each check independently
• rust-toolchain (default: nightly) — used for clippy and fmt
• deny-rust-toolchain (default: stable) — installed on the deny runner and used inside the cargo-deny container
• clippy-flags (default: --all-targets --all-features --locked)
• fmt-flags (default: --all --check)
• deny-flags (default: --all-features)
• checkout-submodules (default: false) — passed to clippy checkout only
• clippy-runner, fmt-runner, typos-runner, deny-runner, timeout-minutes

For individual checks, use rust-deny, rust-fmt, or rust-clippy.

The deny action runs in Docker and manages its own Rust toolchain; deny-rust-toolchain is forwarded to its rust-version input. Callers grant contents: read for checkout and id-token: write for Harden Runner OIDC/STS authentication. Pin production callers to a commit SHA (see Versioning).

The lint success gate accepts explicitly disabled checks and fails on failures, cancellations, or unexpected skips. If all four checks are disabled, only the gate runs and succeeds.

Runs cargo deny check all through rust-lint.yml at the same commit, with clippy, fmt, and typos disabled internally. It shares the existing Harden Runner setup, checkout, Rust installation, cargo-deny container, and lint success gate.

jobs:
  deny:
    uses: tempoxyz/gh-actions/.github/workflows/rust-deny.yml@main
    permissions:
      contents: read
      id-token: write
    with:
      rust-toolchain: nightly

Optional inputs:

• rust-toolchain (default: stable) — installed on the runner and used inside the cargo-deny container
• flags (default: --all-features) — additional flags passed to cargo deny check all
• runner (default: ubuntu-latest)
• timeout-minutes (default: 30) — timeout for each job, including the success gate

The example explicitly selects nightly; omitting with uses stable. Callers must grant both permissions shown above; no persistent StepSecurity API key is required. Pin production callers to a commit SHA (see Versioning). The additional workflow nesting can change displayed check names, so verify required status checks when switching an existing caller from rust-lint.

Run only formatting or Clippy through rust-lint.yml at the same commit, sharing its STS-backed Harden Runner and success gate. Other checks are disabled internally. Clippy also retains the shared mold/sccache setup and warnings-as-errors policy.

jobs:
  fmt:
    uses: tempoxyz/gh-actions/.github/workflows/rust-fmt.yml@main
    permissions:
      contents: read
      id-token: write
  clippy:
    uses: tempoxyz/gh-actions/.github/workflows/rust-clippy.yml@main
    permissions:
      contents: read
      id-token: write

Both accept rust-toolchain (default nightly), runner (default ubuntu-latest), timeout-minutes (default 30), and flags. Formatting defaults to --all --check; Clippy defaults to --all-targets --all-features --locked. Clippy additionally accepts checkout-submodules (default "false"). Use Linux runners supported by the shared Harden Runner setup; Clippy's mold installer requires Linux.

Pin production callers to a commit SHA. Preserve existing cooldown prerequisites with needs, explicitly carry over custom flags, and update required check names if nesting changes them. Both permissions shown above are required for checkout and STS authentication; no persistent StepSecurity API key is needed.

Builds one or more Rust binaries with cargo build --locked --bin <binary> --profile <profile> and uploads each binary as an artifact. Callers must commit an up-to-date Cargo.lock; the build fails if it is missing or dependency resolution would change it.

name: Build binaries

on:
  workflow_dispatch:

permissions: {}

jobs:
  build:
    uses: tempoxyz/gh-actions/.github/workflows/rust-build-binaries.yml@main
    permissions:
      contents: read
    with:
      profile: release
      binaries: |
        api-server
        worker
        cli

Required input:

• binaries — newline-separated binary names to build and upload
• profile — Cargo build profile

Optional inputs:

• rust-toolchain (default: stable)
• runs-on (default: depot-ubuntu-latest-16)
• checkout-submodules (default: false)
• artifact-path-template (default: target/{profile}/{binary})
• retention-days (default: 7)
• timeout-minutes (default: 60)

Runs cargo update and opens or updates a pull request for Cargo.lock. The branch push and PR use a short-lived GitHub App token minted via github-sts — the built-in GITHUB_TOKEN is not allowed to create pull requests.

jobs:
  cargo-update-pr:
    uses: tempoxyz/gh-actions/.github/workflows/cargo-update-pr.yml@main
    permissions:
      contents: read
      id-token: write

The calling repository must carry a trust policy at .github/sts/cargo-update-pr.sts.yaml that grants its own workflow contents: write and pull_requests: write, for example:

subject: repo:tempoxyz@<org-id>/<repo>@<repo-id>:ref:refs/heads/main
permissions:
  contents: write
  pull_requests: write

Optional inputs:

• rust-toolchain (default: nightly)
• title (default: chore(deps): weekly cargo update)

Assigns newly opened or reopened pull requests to their author when the author is an internal collaborator.

name: Auto Assign PR to Author

on:
  pull_request:
    types: [opened, reopened]

permissions:
  issues: write
  pull-requests: write

jobs:
  auto-assign:
    uses: tempoxyz/gh-actions/.github/workflows/auto-assign-pr.yml@main

Caller workflows must grant issues: write and pull-requests: write.