cjournois/reusable-pipeline

Proprietary — Copyright (c) 2026 cjournois. All rights reserved. SPDX: UNLICENSED. See LICENSE for terms.

Reusable Forgejo Actions workflows shared across cjournois repos. Caller repos copy a small trigger file per unit and get the lint → test → build → publish → release flow. The publish target is inferred from inputs — there is no mode switch.

Summary

• Developer: Usage
• Developer: Getting Started
• Maintainer: Troubleshooting

---

Developer: Usage

Copy one of three templates from references/:

Template	Copied to	Role
references/root.yml	.github/workflows/ci-<unit>.yml	Per-unit trigger (package / service / helm / check)
references/unit.yml	.github/workflows/ci-<image>.yml	Base-image trigger (scheduled / rolling)
references/release.yml	.github/workflows/release.yml	Release trigger (bump + tag + push)

These call two reusable workflows — unit.yml (child pipeline) and release.yml. Composite actions under .github/actions/ are internal implementation and must not be uses: directly. See docs/monorepo.md for the new-unit checklist and docs/architecture.md for the model.

Profiles

The publish target is inferred from which inputs you set (first match wins):

Profile	Set these	Publish
Package	language + registry_username + tag_prefix	npm / PyPI on tag
Service	image_name (+ registry, tag_prefix)	docker image on tag / [publish]
Base image	image_name + skip_linter/coverage/build: true	docker image every push/schedule
Helm	package_owner (+ registry, tag_prefix)	helm chart on tag / [publish]
Check	language only	nothing — lint + test

Quick start (a service unit)

Each caller declares its toolchain in mise.toml at the repo root or working_directory. The pipeline runs mise install early; tools land on PATH via shims.

jobs:
  pipeline:
    uses: cjournois/reusable-pipeline/.github/workflows/unit.yml@main
    with:
      language: bun
      working_directory: services/my-service
      tag_prefix: my-service
      registry: ${{ vars.REGISTRY }}
      registry_username: ${{ vars.BOT_REGISTRY_USERNAME }}
      image_name: project/my-service
    secrets:
      registry_token: ${{ secrets.BOT_REGISTRY_TOKEN }}
      release_token: ${{ secrets.BOT_RELEASE_TOKEN }}

Required mise.toml:

[tools]
bun = "1.3.13"

Full input and secret tables live in docs/components/unit.md.

Why no packages/ or services/ directory

This repo is a Forgejo Actions repo — its structure is dictated by the .github/ convention (workflows/ for reusable workflows, actions/ for composite actions). It produces neither packages nor deployable services.

---

Developer: Getting Started

Requirements

• Forgejo Actions (or compatible reusable workflow host)
• Registry + Git credentials exposed as shown in caller snippets
• just — command runner
• mise — toolchain manager (pins shellcheck, actionlint, bats)

Commands

Command	Purpose
just lint	shellcheck (scripts) + actionlint (workflows)
just test	bats test suite
just release <tag>	Pin @main refs to @<tag> for the release commit, then reset to @main

---

Maintainer: Troubleshooting

• Secrets missing. registry_token and release_token are both required on the publish path (any unit with a publish target; check units need neither).
• Wrong artifact path. Override build_artifact_path when the build emits something other than dist/.
• Private registry 401. Set private_scopes and ensure the token has read:package. For k8s runners with internal URLs, the pipeline writes auth for both internal and external hosts automatically.
• Containerfile needs sibling packages. Set build_context: . so BuildKit can see files outside working_directory.
• Tag not triggering publish. Confirm the tag matches <tag_prefix>-<semver>; runs with mismatched prefixes skip on purpose.