Organisation-wide CI for megaeth-labs: composite actions consumed at @main
by every repository, and the workflow templates that show up under
"New workflow → By megaeth-labs".
.github/actions/README.md— the catalogue of shared actions, how to consume one, how to change one..github/actions/RELEASE.md— the release pipeline: candidate, settle, publish, publish targets.docs/RELEASING.md— operator runbook for the release pipeline: the four flows, environments, dry run, troubleshooting..github/actions/CLAUDE-CI.md— the Claude checks: PR review, label check, issue triage, interactive..github/actions/<action>/README.md— one reference per action; the input, output, step and error tables are generated fromaction.ymlby.github/scripts/action_docs.py.- Standalone building blocks:
git-credentials,export-env,notify-lark,merge-queue-skipper,pr-lint. workflow-templates/— the reference callers..github/scripts/copy_templates.pyrenders the release templates with one repository's values filled in.profile/— the organisation profile page.
actions-test.yml is the only gate between a change here and every
consumer's CI: unit tests of the helpers, an end-to-end drive of the actions
that can run without a repository, and the documentation check.
Two GitHub Apps mint tokens through actions/create-github-app-token.
Maxwell is the CI app (vars.MEGA_MAXWELL_CLIENT_ID, secrets.MEGA_MAXWELL_PK):
it may write only pull requests and issues and never touches a release.
Gutenberg is the release app (vars.RELEASE_APP_CLIENT_ID,
secrets.RELEASE_APP_PRIVATE_KEY), minted only in a job of the release
environment, where every write of a release is made. The
app-token-lint action enforces
this on every workflow change (rules L1-L6, listed with their messages in the
runbook); run it locally with
python3 .github/scripts/app_token_lint.py --repo <repo> <workflows dir>.