gh-actions

Reusable GitHub Actions for the Tempo organization.

Actions

Action	Description
actionlint	Lint GitHub Actions workflows with the digest-pinned actionlint image
docker-login	Log in to GHCR and optionally Docker Hub
docker-build-push	Build and push Docker images
docker-metadata-tags	Standard Tempo Docker tagging strategy
cosign-sign	Sign container images with cosign
publish-event	POST webhook events to downstream systems
github-sts	Exchange GitHub OIDC tokens for short-lived GitHub App tokens
socket-firewall	Install Socket Firewall with a short-lived, repository-scoped token
create-pull-request	Commit working-tree changes and open a PR
pr-audit-comment	Handle PR audit issue-comment commands
setup-rust-build	Install Rust toolchain, mold linker, and sccache
setup-foundry	Install Foundry toolchain from an attested release
setup-argo-cli	Install Argo Workflows CLI from a signature-verified release
setup-pinact	Install pinact from an attested release
setup-terraform	Install Terraform verified against HashiCorp's signed checksums
setup-helm	Install Helm verified against the maintainers' GPG signatures

Installer verification

Every tool these actions and workflows download is verified with the strongest proof its publisher offers, in addition to a checksum; a checksum from the same release cannot detect a release that was compromised end to end. The only accepted reason to skip a check is a large wall-clock cost.

3rd Party Actions

Copies of outside actions, vendored under vendor/ so they count as tempoxyz-owned under the org's Actions policy. Each copy is an exact upstream commit recorded in vendor-manifest.yml; the version column links to the upstream README at that commit. Reference them as tempoxyz/gh-actions/vendor/<owner>/<repo>[/<path>]@<commit-sha> (see Versioning), with the same inputs and outputs as upstream. To add or update one, edit the manifest with node vendor/add.mjs owner/repo@<tag> or bump ref/sha, run node vendor/sync.mjs, and commit the result; CI fails if vendor/ or this table drift from the manifest. Details of what is excluded from each copy and why are in the manifest notes.

Action	Version	Description
1password/install-cli-action	v4.1.0 (1a3160d)	Install 1Password CLI in your pipeline
1password/load-secrets-action	v5.0.1 (70062d7)	Make secrets from 1Password Connect available as environment variables in the next steps.
CodSpeedHQ/action	v4.19.1 (f22792b)	Continuous benchmarking and performance checks
DeterminateSystems/nix-installer-action	v22 (ef8a148)	Install Nix with the Determinate Nix Installer. See: https://github.com/DeterminateSystems/nix-installer
EmbarkStudios/cargo-deny-action	v2.1.1 (3c63498)	Help manage Cargo crate dependencies and validate licenses
SocketDev/action	main (be1f253)	GitHub Action to run Socket in CLI or Firewall mode
Swatinem/rust-cache	v2.9.2 (6323deb)	A GitHub Action that implements smart caching for rust/cargo projects with sensible defaults.
amannn/action-semantic-pull-request	v6.1.1 (48f2562)	Ensure your PR title matches the Conventional Commits spec (https://www.conventionalcommits.org/).
anchore/sbom-action	v0.24.0 (e22c389)	Creates an SBOM (Software Bill Of Materials) from your code and container images
aquasecurity/setup-trivy	v0.3.1 (81e5143)	Install Trivy binary from release page
aquasecurity/trivy-action	v0.36.0 (ed142fd)	Scans container images for vulnerabilities with Trivy
astral-sh/setup-uv	v10.0.1 (20cfd1b)	Set up your GitHub Actions workflow with a specific version of uv.
aws-actions/configure-aws-credentials	v6.2.3 (e6de054)	Configures AWS credentials for use in subsequent steps in a GitHub Action workflow
biomejs/setup-biome	main (9edb642)	Setup the Biome CLI in GitHub Actions
bullfrogsec/bullfrog	v0.11.1 (7dee337)	Block unauthorized outbound traffic (egress) in your Github workflows
changesets/action	v2.1.1 (8488615)	A GitHub action to automate releases with Changesets
cloudflare/wrangler-action	v4.0.0 (ebbaa15)	Deploy your Cloudflare projects from GitHub using Wrangler
dblock/create-a-github-issue	v3.4.0 (a25e69c)	Creates a new GitHub issue using a template.
dependabot/fetch-metadata	v3.1.0 (25dd0e3)	Extract information from about the dependency being updated by a Dependabot-generated PR
depot/bake-action	v1.13.0 (1d58c26)	GitHub Action to build Docker images via Bake with Depot
depot/build-push-action	v1.18.0 (98e78ad)	Build and push Docker images with Depot
depot/pull-action	v1.3.1 (a913e06)	Pull images from the Depot ephemeral registry.
depot/setup-action	v1.7.2 (91bc849)	Installs the Depot CLI into the GitHub Actions environment
docker/build-push-action	v7.3.0 (53b7df9)	Build and push Docker images with Buildx
docker/login-action	v4.6.0 (dbcb813)	GitHub Action to login against a Docker registry
docker/metadata-action	v6.2.0 (dc80280)	GitHub Action to extract metadata (tags, labels) for Docker
docker/setup-buildx-action	v4.3.0 (37fe631)	Set up Docker Buildx
docker/setup-docker-action	v5.1.0 (b2189fb)	Set up Docker for use in GitHub Actions by downloading and installing a version of Docker CE
docker/setup-qemu-action	v4.2.0 (96fe6ef)	Install QEMU static binaries
dtolnay/rust-toolchain	stable (4360b52)	Install the Rust toolchain
expo/expo-github-action	9.0.0 (eab7a23)	Publish, build or manage your Expo app with GitHub Actions
google-github-actions/auth	v3.0.0 (7c6bc77)	Authenticate to Google Cloud from GitHub Actions via Workload Identity Federation or service account keys.
google-github-actions/setup-gcloud	v3.0.1 (aa5489c)	Downloads, installs, and configures a Google Cloud SDK environment. Adds the gcloud CLI command to the $PATH.
goreleaser/goreleaser-action	v7.2.3 (f06c13b)	GitHub Action for GoReleaser, a release automation tool for Go projects
gradle/actions	v6.3.0 (9c97196)	A collection of actions for building Gradle projects, as well as generating a dependency graph via Dependency Submission.
helm/chart-releaser-action	v1.7.0 (cae68fe)	Host a Helm charts repo on GitHub Pages
helm/chart-testing-action	v2.8.0 (6ec842c)	Install the Helm chart-testing tool
imjasonh/setup-crane	v0.7 (feee3b6)	Install and authorize crane
jakebailey/pyright-action	v3.0.2 (8ec14b5)	Run pyright
jaxxstorm/action-install-gh-release	v3.0.0 (25e24d2)	Install binaries from GitHub releases
jayanta525/github-pages-directory-listing	v4.0.0 (624ac8c)	Github Action to generate directory listing index for Github Pages
lycheeverse/lychee-action	v2.9.0 (e747777)	Quickly check links in Markdown, HTML, and text files
mobile-dev-inc/action-maestro-cloud	v2.0.2 (3490606)	Upload your app to Maestro Cloud to run your Flows in CI
mozilla-actions/sccache-action	v0.0.11 (fc920bf)	Setup sccache action
openai/codex-action	v1.12 (8636508)	Run codex exec with a prompt.
oven-sh/setup-bun	v2.2.0 (0c5077e)	Download, install, and setup Bun to your path.
peaceiris/actions-gh-pages	v4.1.0 (84c30a8)	GitHub Actions for GitHub Pages 🚀 Deploy static files and publish your site easily. Static-Site-Generators-friendly.
planetscale/setup-pscale-action	v1 (b6a50ee)	Installs the PlanetScale CLI
pnpm/action-setup	v6.0.10 (0977fd9)	Install pnpm package manager
ruby/setup-ruby	v1.321.0 (95ef2b0)	Download a prebuilt Ruby and add it to the PATH in 5 seconds
rust-lang/crates-io-auth-action	v1.0.5 (c6f97d4)	Retrieve a temporary crates.io access token using trusted publishing.
shallwefootball/upload-s3-action	v1.3.3 (4350529)	Upload directory to S3
sigstore/cosign-installer	v4.1.2 (6f9f177)	Installs cosign and includes it in your path
taiki-e/install-action	v2.85.2 (41049aa)	GitHub Action for installing development tools
tailscale/github-action	v3.3.0 (6cae46e)	Connect your GitHub Action workflow to Tailscale
tailscale/gitops-acl-action	v1.5.1 (4105afd)	Push changes to Tailscale and run ACL tests in CI
wevm/frog	v1 (702c4ea)
zizmorcore/zizmor-action	v0.6.2 (3dc1ecc)	Run zizmor from GitHub Actions 🌈

Usage

Reference actions using tempoxyz/gh-actions/actions/<name>@main (pin to a commit SHA in production — see Versioning):

steps:
  - uses: tempoxyz/gh-actions/actions/setup-rust-build@main
    with:
      toolchain: stable
      components: clippy,rustfmt

  - uses: tempoxyz/gh-actions/actions/docker-login@main
    with:
      ghcr-token: ${{ secrets.GITHUB_TOKEN }}

  - uses: tempoxyz/gh-actions/actions/publish-event@main
    with:
      url: ${{ secrets.EVENTS_ARGS }}
      event-type: registry_package
      tag: sha-${{ steps.shortsha.outputs.shortsha }}

Versioning

Examples in this repo use @main for brevity. For production, pin to a full commit SHA — branch refs like @main are mutable, and the bundled scan-github-actions workflow flags unpinned uses. Add a trailing reference comment; the optional pinact policy check requires one for bare SHA pins, and it also improves readability:

uses: tempoxyz/gh-actions/actions/setup-rust-build@<commit-sha> # main

This repo does not yet publish version tags; SHA pinning is the recommended stable reference.

Reusable Workflows

Workflow	Description	Source
pr-audit	Publish a pr_audit event when a PR is labeled (read-only)	tempo, zones
label-prs	Label new PRs from their linked issue	tempo, zones
scan-github-actions	Security scan, lint, and optional action pin policy checks	any
reproducible-build	Reproducible build verification	tempo
rust-lint	Shared Rust clippy, fmt, typos, and deny checks	rust repos
rust-build-binaries	Build Rust binaries and upload artifacts	rust repos
cargo-update-pr	Open a scheduled cargo update PR	tempo
auto-assign-pr	Auto-assign the author to their PR	tempo

Reference reusable workflows using tempoxyz/gh-actions/.github/workflows/<name>.yml@main (pin to a commit SHA in production — see Versioning).

pr-audit

Publishes a pr_audit event when a pull request receives a configured label. This reusable workflow is read-only (contents: read); comment-driven audit commands are handled separately by the pr-audit-comment composite action in a caller-owned job (see below).

Label audits (read-only)

name: PR Audit

on:
  pull_request:
    types: [labeled]

jobs:
  pr-audit:
    uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@main
    permissions:
      contents: read
    with:
      environment: pr-audit
      required-labels: |
        cyclops
        agentic-audit
    secrets:
      EVENTS_KEY: ${{ secrets.EVENTS_KEY }}
      EVENTS_CERT: ${{ secrets.EVENTS_CERT }}
      EVENTS_ARGS: ${{ secrets.EVENTS_ARGS }}

Optional inputs:

• required-label — label that triggers audit publishing (default: cyclops); kept for compatibility
• required-labels — comma or newline-separated labels that trigger audit publishing; when set, this overrides required-label
• environment — GitHub Environment name, such as pr-audit, used to gate audit publishing
• branch / pr-number — target for ad-hoc workflow_dispatch callers
• require-completed-audit — publish a Cyclops audit run merge-gate status (default: false)

When require-completed-audit: true, internal and non-Dependabot pull requests remain pending until tempoxyz-bot posts a completed Cyclops review; fork and Dependabot pull requests are exempt. Completed reviews remain valid after later commits. The caller must add pull_request_target, pull_request_review, and merge_group triggers, grant pull-requests: read and statuses: write, and require the resulting Cyclops audit run status on the protected branch. Reusable workflows cannot declare caller event triggers.

on:
  pull_request:
    types: [labeled]
  pull_request_target: # zizmor: ignore[dangerous-triggers]
    types: [opened, reopened, synchronize, labeled, unlabeled]
  pull_request_review:
    types: [submitted]
  merge_group:

jobs:
  pr-audit:
    uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@main
    permissions:
      contents: read
      pull-requests: read
      statuses: write
    with:
      require-completed-audit: true
    secrets:
      EVENTS_KEY: ${{ secrets.EVENTS_KEY }}
      EVENTS_CERT: ${{ secrets.EVENTS_CERT }}
      EVENTS_ARGS: ${{ secrets.EVENTS_ARGS }}

Repos that need protected environment gates, such as Zones' environment: pr-audit gate for EVENTS_*, should pass environment: pr-audit so the publish job preserves that approval boundary.

Comment-command audits (opt-in, privileged)

Because comment handling needs issues: write and pull-requests: read, it lives in a caller-owned job that runs the pr-audit-comment composite action rather than in the read-only reusable workflow. Add it alongside the label job:

on:
  pull_request:
    types: [labeled]
  issue_comment:
    types: [created]

jobs:
  pr-audit:
    uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@main
    permissions:
      contents: read
    with:
      environment: pr-audit
    secrets:
      EVENTS_KEY: ${{ secrets.EVENTS_KEY }}
      EVENTS_CERT: ${{ secrets.EVENTS_CERT }}
      EVENTS_ARGS: ${{ secrets.EVENTS_ARGS }}

  pr-audit-comment:
    if: >-
      github.event_name == 'issue_comment' &&
      github.event.issue.pull_request &&
      (
        startsWith(github.event.comment.body, 'cyclops audit') ||
        startsWith(github.event.comment.body, 'cyclops private audit') ||
        startsWith(github.event.comment.body, '@decofe cyclops audit') ||
        startsWith(github.event.comment.body, '@decofe cyclops private audit') ||
        startsWith(github.event.comment.body, 'derek audit')
      )
    runs-on: ubuntu-latest
    environment: pr-audit
    permissions:
      contents: read
      issues: write
      pull-requests: read
    steps:
      - uses: tempoxyz/gh-actions/actions/pr-audit-comment@main
        with:
          command-regex: '^(?:@decofe\s+)?(?:cyclops\s+(?:private\s+)?audit|derek\s+audit)\b'
          permission-check-mode: association
          allowed-associations: OWNER,MEMBER
          organization: tempoxyz
          events-key: ${{ secrets.EVENTS_KEY }}
          events-cert: ${{ secrets.EVENTS_CERT }}
          events-args: ${{ secrets.EVENTS_ARGS }}
          github-token: ${{ github.token }}

The comment surface supports:

• comments: cyclops audit, cyclops private audit, @decofe cyclops audit, derek audit
• arguments: private, fast, perf, iterations=N, hours=N, config=PATH, models=..., run-label=LABEL, dry-run, note="..."

Set permission-check-mode: org (with organization) for org-membership API checks. Use permission-token when those checks need a token distinct from the one used for PR reads and status comments:

          permission-check-mode: org
          organization: tempoxyz
          github-token: ${{ secrets.DEREK_BENCH_TOKEN }}
          permission-token: ${{ secrets.DEREK_BENCH_ACK_TOKEN }}

If permission-token is omitted, membership checks use github-token as before. In association mode, allowed-associations controls which GitHub commenter associations may trigger an audit. It defaults to OWNER,MEMBER,COLLABORATOR. In both permission modes, authorization applies to the commenter, not the pull request author, so a trusted commenter can audit a pull request from an external fork. allow-same-author is deprecated, has no effect, and remains accepted only for compatibility with existing callers.

label-prs

Labels newly opened pull requests by copying eligible labels from the issue linked in the pull request body.

name: Label PRs

on:
  pull_request:
    types: [opened]

jobs:
  label-prs:
    uses: tempoxyz/gh-actions/.github/workflows/label-prs.yml@main
    permissions:
      contents: read
      issues: write

Caller workflows must grant these permissions on the reusable-workflow job. contents: read is needed to check out tempoxyz/gh-actions; issues: write reads issue labels and adds labels to the pull request through GitHub's Issues API.

The reusable workflow checks out tempoxyz/gh-actions at github.workflow_sha, so the bundled label script matches the pinned reusable workflow revision.

scan-github-actions

Security scan and lint for GitHub Actions workflows: zizmor for security and actionlint (with shellcheck/pyflakes) for workflow syntax and run: script correctness. Findings appear as GitHub workflow annotations and in the workflow log. The lint pass can be turned off with actionlint: false.

Set pinact: true to also run pinact in check-only mode. This enforces a default seven-day minimum age for pinned action commits and adds optional version-comment verification without editing files or adding a second reusable-workflow job. Caller-local Pinact configuration is merged on top of the trusted default source and can override its threshold, so repository configuration remains review-sensitive. Existing callers remain unchanged because the pinact check is opt-in.

zizmor, actionlint, and the optional pinact policy run together in a single Scan GitHub Actions check. The reusable workflow is read-only (actions: read, contents: read) and never requests security-events: write, so callers only grant read scopes. To upload SARIF to GitHub code scanning, use the composite action with advanced-security: true in a job you control (see its README).

name: Scan GitHub Actions

on:
  push:
    branches: [main]
  pull_request:

jobs:
  scan:
    uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@main
    permissions:
      actions: read
      contents: read
    with:
      pinact: true

By default zizmor scans the whole repo, so first-party workflows and actions anywhere (e.g. across a monorepo) are covered. Repos that vendor third-party workflows/actions can narrow zizmor's scope with the paths input (e.g. to .github/) to avoid flagging code they don't own. Pinact uses its own file discovery; monorepos with action manifests outside its defaults can set files in their Pinact configuration.

Optional inputs:

• paths (default: .) — whitespace-separated paths for zizmor to scan; narrow to e.g. .github/ to exclude vendored or third-party trees
• config — path to a zizmor config file for rule overrides. When empty and the repository has no zizmor config of its own, the scan uses a default that disables zizmor's ref-version-mismatch audit: this repository publishes no version tags, so a version comment on a pin to it can never match and every such pin would otherwise be a medium-severity finding that fails the scan. Comment correctness for third-party pins is covered by pinact's verify-pin-comments. Add a .github/zizmor.yml to a repo to take back full control.
• actionlint (default: true) — run actionlint (syntax, expression, and shellcheck/pyflakes checks) alongside the zizmor scan
• pinact (default: false) — run pinact policy checks alongside zizmor and actionlint
• pin-config (default: .pinact.yaml) — path to the caller repo's pinact configuration file; the default is optional when absent
• pin-no-api (default: false) — perform offline pin validation without API-based comment or minimum-age verification
• verify-pin-comments (default: false) — verify that semver version comments resolve to the pinned SHA
• verify-pin-min-age (default: true) — verify current pins against configured minimum-age rules
• pin-min-age (default: 7) — default minimum age in days for pinned action commits; caller-local Pinact configuration can override it

reproducible-build

Builds a repository's byte-deterministic binary using scripts/reproducible-build.sh, writes a sha256 file, and uploads it as a short-lived artifact.

name: Reproducible Build

permissions: {}

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      ref:
        description: "Git ref (branch, tag, or full SHA) to build reproducibly"
        type: string
        required: false
        default: "main"

concurrency:
  group: reproducible-build-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: ${{ github.event_name == 'push' }}

jobs:
  build:
    uses: tempoxyz/gh-actions/.github/workflows/reproducible-build.yml@main
    permissions:
      contents: read
    with:
      ref: ${{ inputs.ref }}
      binary-name: tempo

Caller workflows must grant contents: read on the reusable-workflow job so it can check out the repository being built.

Required input:

• binary-name — name of the binary produced in out/

Optional inputs:

• ref — Git ref to check out
• target (default: x86_64-unknown-linux-gnu)
• build-script (default: ./scripts/reproducible-build.sh)
• runs-on (default: depot-ubuntu-latest-16)
• retention-days (default: 7)

rust-lint

Runs a common Rust lint set: cargo clippy, cargo fmt, typos, and cargo deny.

name: Lint

on:
  push:
    branches: [main]
  pull_request:
  merge_group:

permissions: {}

jobs:
  lint:
    uses: tempoxyz/gh-actions/.github/workflows/rust-lint.yml@main
    permissions:
      contents: read

Optional inputs:

• rust-toolchain (default: nightly) — used for clippy and fmt
• clippy-flags (default: --all-targets --all-features --locked)
• fmt-flags (default: --all --check)
• deny-flags (default: --all-features)
• checkout-submodules (default: false) — passed to clippy checkout only
• clippy-runner, fmt-runner, typos-runner, deny-runner, timeout-minutes

rust-build-binaries

Builds one or more Rust binaries with cargo build --bin <binary> --profile <profile> and uploads each binary as an artifact.

name: Build binaries

on:
  workflow_dispatch:

permissions: {}

jobs:
  build:
    uses: tempoxyz/gh-actions/.github/workflows/rust-build-binaries.yml@main
    permissions:
      contents: read
    with:
      profile: release
      binaries: |
        api-server
        worker
        cli

Required input:

• binaries — newline-separated binary names to build and upload
• profile — Cargo build profile

Optional inputs:

• rust-toolchain (default: stable)
• runs-on (default: depot-ubuntu-latest-16)
• checkout-submodules (default: false)
• artifact-path-template (default: target/{profile}/{binary})
• retention-days (default: 7)
• timeout-minutes (default: 60)

cargo-update-pr

Runs cargo update and opens or updates a pull request for Cargo.lock. The branch push and PR use a short-lived GitHub App token minted via github-sts — the built-in GITHUB_TOKEN is not allowed to create pull requests.

jobs:
  cargo-update-pr:
    uses: tempoxyz/gh-actions/.github/workflows/cargo-update-pr.yml@main
    permissions:
      contents: read
      id-token: write

The calling repository must carry a trust policy at .github/sts/cargo-update-pr.sts.yaml that grants its own workflow contents: write and pull_requests: write, for example:

subject: repo:tempoxyz@<org-id>/<repo>@<repo-id>:ref:refs/heads/main
permissions:
  contents: write
  pull_requests: write

Optional inputs:

• rust-toolchain (default: nightly)
• title (default: chore(deps): weekly cargo update)

auto-assign-pr

Assigns newly opened or reopened pull requests to their author when the author is an internal collaborator.

name: Auto Assign PR to Author

on:
  pull_request:
    types: [opened, reopened]

permissions:
  issues: write
  pull-requests: write

jobs:
  auto-assign:
    uses: tempoxyz/gh-actions/.github/workflows/auto-assign-pr.yml@main

Caller workflows must grant issues: write and pull-requests: write.