Reusable CI Workflows

This repository contains reusable GHA workflows for Medrunner projects. The workflows are published as the v1 contract for API, bot, and standalone site repositories.

See the workflow catalog for permissions, environments, outputs, and side effects. See the consumer templates for copy-ready API, MED, and MOD caller workflows. See Node sites and Cloudflare Pages for PR validation and simple versioned build/deploy delivery. See package delivery for semantic-release followed by npm or GitHub Packages publication on caller-defined channels.

Local validation

Run the inline Pages/Node workflow contract tests:

npm ci
npm test

Production delivery logic lives in reusable workflows and platform-owned helpers under .github/scripts/. The package publisher checks out its helper at the exact reusable workflow SHA; consumers do not copy helper scripts.

Run static workflow validation:

rtk docker run --rm -v "${PWD}:/repo" -w /repo rhysd/actionlint:1.7.12

Run the Docker-backed Test and Dockerfile smoke suite:

rtk act -P ubuntu-latest=catthehacker/ubuntu:act-latest -W tests/fixtures/workflow-contract/node-local.yml workflow_dispatch -e tests/fixtures/events/workflow_dispatch.json --container-architecture linux/amd64
rtk act -P ubuntu-latest=catthehacker/ubuntu:act-latest -W tests/fixtures/workflow-contract/pnpm-local.yml workflow_dispatch -e tests/fixtures/events/workflow_dispatch.json --container-architecture linux/amd64
rtk act -P ubuntu-latest=catthehacker/ubuntu:act-latest -W tests/fixtures/workflow-contract/dotnet-local.yml workflow_dispatch -e tests/fixtures/events/workflow_dispatch.json --container-architecture linux/amd64
rtk act -P ubuntu-latest=catthehacker/ubuntu:act-latest -W tests/fixtures/workflow-contract/container-public-local.yml workflow_dispatch -e tests/fixtures/events/workflow_dispatch.json --container-architecture linux/amd64
rtk act -P ubuntu-latest=catthehacker/ubuntu:act-latest -W tests/fixtures/workflow-contract/container-private-local.yml workflow_dispatch -e tests/fixtures/events/workflow_dispatch.json --container-architecture linux/amd64 --secret NODE_AUTH_TOKEN=fixture-token

Run the deterministic stable-tag ancestry checks:

rtk bash tests/fixtures/git/release-stable-reachable.sh
rtk bash tests/fixtures/git/release-stable-needs-backprop.sh

The complete suite passed locally on 2026-09-21. act verifies Test and Dockerfile build paths only. Semantic release, protected environments, GHCR publishing, PR creation, approval, and auto-merge intentionally remain outside local execution.