Skip to content

Repository Maintenance & Development Overview

This section covers the maintenance practices, developer tooling, and automated quality assurance standards enforced within jambazid/gha-actions.

🏛️ Maintenance Philosophy

As a centralized repository of reusable GitHub Actions and workflows, maintaining high standards of reliability, supply-chain security, and developer productivity is critical.

Key pillars of our maintenance strategy include:

  1. Unified Tooling via mise: All local and CI development tasks operate through a single tool manager (mise).
  2. Automated Quality Controls: Enforced YAML linting (yamllint), code formatting (ruff), and pre-commit hooks (pre-commit).
  3. Proactive Security Scanning: Continuous static analysis of Actions workflows (zizmor) and filesystem vulnerability auditing (trivy).
  4. Supply-Chain Integrity: Full 40-character commit SHA pinning for all GitHub Actions, managed via mise run bump (actions-up).
  5. AI Governance: Transparent and accountable AI tool usage governed by AGENTS.md and AI_TOOL_POLICY.md.

📂 Maintenance Documentation Index

  • Mise Tooling & Tasks: Detailed guide on mise.toml tools, task runner macros, and CLI execution.
  • Dependabot & Lockfiles: Configuration for automated action dependency updates and Python lockfiles.
  • Security Overview: Deep dive into vulnerability disclosure, Trivy + Zizmor scanning, and SHA pinning.