CI/CD Workflows
All workflows live in .github/workflows/.
Core
| Workflow | File | Trigger | Description |
|---|---|---|---|
| Deploy | deploy.yml | Push to main, manual | Pull code, generate .env files via Ansible, deploy changed apps. |
| Provision VPS | provision.yml | Manual | Bootstrap VPS, run full Ansible playbook, sync secrets back to vault. |
| Setup Self-Hosted Runners | setup-runners.yml | Manual | Register GitHub Actions self-hosted runners on the VPS. |
| Server Info | server-info.yml | Manual | Print system info, Docker status, and disk usage from the VPS. |
Maintenance
| Workflow | File | Trigger | Description |
|---|---|---|---|
| Backup | backup.yml | Daily | Snapshot application data and upload to secure storage. |
| Daily Cleanup | cleanup.yml | Daily | Prune Docker images/volumes and rotate system logs. |
| Update Submodules | update-submodules.yml | Push to main | Keep git submodule references up to date. |
| Update LICENSE | update-license.yml | Push to main | Keep LICENSE year up to date. |
Quality & Security
| Workflow | File | Trigger | Description |
|---|---|---|---|
| Pre-commit CI | pre-commit-ci.yaml | Pull request | Run pre-commit hooks (linting, formatting) on changed files. |
| Lint PR | lint-pr.yaml | Pull request | Enforce Conventional Commits titles for Pull Requests. |
| CodeQL Analysis | codeql.yaml | Push, PR | Static security analysis for potential vulnerabilities. |
| Gitleaks | gitleaks.yaml | Pull request | Scan for accidental secret commits in changed files. |
Release & Housekeeping
| Workflow | File | Trigger | Description |
|---|---|---|---|
| Release | release.yaml | Push to main | Semantic release — bumps version and updates CHANGELOG. |
| Auto-merge PR | automerge.yml | Pull request | Auto-merge Dependabot or authorized PRs that pass CI. |
| Template Repo Sync | template-repo-sync.yaml | Weekly | Sync files from the upstream template repository. |
| Cleanup Caches | cleanup-caches.yaml | PR closed | Remove GitHub Actions cache for merged/closed branches. |