ci-workflows

CI Workflow Standards

When to Use This Skill

Use this skill when...	Use a sibling skill instead when...
You need the canonical GitHub Actions workflow shapes (container build, test, release)	You want to audit or install workflows end-to-end as an interactive workflow — use configure-workflows
You are checking whether existing .github/workflows/*.yml follows the documented conventions	You want pre-built reusable callers wired up — use configure-reusable-workflows
Another skill needs to cite the standard workflow structure	The user asked you to actually create or repair CI workflows

Version: 2025.1

Standard GitHub Actions workflows for CI/CD automation.

Display name convention

Every workflow's name: follows <Domain>: <Action> [<target>] so the GitHub Actions sidebar groups related workflows alphabetically. Quote the value because YAML treats : inside an unquoted scalar as a key separator. See .claude/rules/workflow-naming.md for the canonical rule, the active domain list, and the cross-workflow rename procedure. Mirror the pattern in any workflow you scaffold here.

Required Workflows

Full YAML, key features, and prerequisites for each file live in references/workflow-templates.md — read it when citing, diffing against, or scaffolding a specific workflow.

#	Workflow	File	Status
1	Container Build	.github/workflows/container-build.yml	Required if Dockerfile
2	Release Please	.github/workflows/release-please.yml	Required
3	ArgoCD Auto-merge	.github/workflows/argocd-automerge.yml	Optional
4	Test	.github/workflows/test.yml	Recommended
5	Claude Auto-Fix	.github/workflows/claude-auto-fix.yml	Optional

2. Release Please Workflow

File: .github/workflows/release-please.yml

See configure-release-please (its REFERENCE.md carries the standard workflow, token, and config templates) for details.

Workflow Standards

Action Versions

Action	Version	Purpose
actions/checkout	v6	Repository checkout
docker/setup-buildx-action	v4	Multi-platform builds
docker/login-action	v4	Registry authentication
docker/metadata-action	v6	Image tagging
docker/build-push-action	v7	Container build/push
actions/setup-node	v6	Node.js setup
googleapis/release-please-action	v5	Release automation

Permissions

Minimal permissions required:

permissions:
  contents: read      # Default for most jobs
  packages: write     # For container push to GHCR
  pull-requests: write  # For release-please PR creation

Triggers

Standard trigger patterns:

# Build on push and PR to main
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Also build on release
on:
  release:
    types: [published]

Build Caching

Use GitHub Actions cache for Docker layers:

cache-from: type=gha
cache-to: type=gha,mode=max

Multi-Platform Builds

Build for both amd64 and arm64:

platforms: linux/amd64,linux/arm64

Compliance Requirements

Required Workflows

Workflow	Purpose	Required
container-build	Container builds	Yes (if Dockerfile)
release-please	Automated releases	Yes
test	Testing and linting	Recommended
argocd-automerge	Auto-merge image updates	Optional (if using ArgoCD Image Updater)
claude-auto-fix	Automated CI failure remediation	Optional

Required Elements

Element	Requirement
checkout action	v6
build-push action	v7
Multi-platform	amd64 + arm64
Caching	GHA cache enabled
Permissions	Explicit and minimal

Status Levels

Status	Condition
PASS	All required workflows present with compliant config
WARN	Workflows present but using older action versions
FAIL	Missing required workflows
SKIP	Not applicable (no Dockerfile = no container-build)

Secrets Required

Secret	Purpose	Required
GITHUB_TOKEN	Container registry auth	Auto-provided
SENTRY_AUTH_TOKEN	Source map upload	If using Sentry
MY_RELEASE_PLEASE_TOKEN	Release PR creation	For release-please
CLAUDE_CODE_OAUTH_TOKEN	Claude Code Action auth	For claude-auto-fix

Troubleshooting

Build failures, multi-platform issues, and cache misses: see references/troubleshooting.md when a compliant workflow still fails at runtime.