scify/.github

WIP: Organisation-wide defaults and reusable GitHub Actions for SciFY repositories.

This repository is public. GitHub requires that for the default files, the profile README and the workflow templates to take effect. Do not commit secrets, hostnames or internal URLs here.

Each file starts with a comment block that lists every input, secret and server requirement.

Laravel repositories:

1. Open the repository's Actions tab and click New workflow.
2. Pick SciFY Laravel CI under "By SciFY".
3. Adjust the inputs in the generated file and commit it.

Or copy workflow-templates/laravel-ci.yml by hand into .github/workflows/ci.yml and replace $default-branch with main.

npm-only repositories have no template yet. Create .github/workflows/ci.yml with:

name: CI
on:
  push:
    branches: [main]
  pull_request:
permissions:
  contents: read
jobs:
  ci:
    uses: scify/.github/.github/workflows/[email protected]

1. Create a GitHub environment named production in the repository settings.

2. Add these environment secrets:

   Secret	Value
   SSH_HOST	Server hostname or IP
   SSH_PORT	SSH port. Optional, defaults to 22
   SSH_USER	Deploy user
   SSH_PRIVATE_KEY	Private key of the deploy user
   PROJECT_PATH	Absolute path of the application on the server
   ENV_FILE	Full content of the production .env. Optional for Laravel: when empty, the .env already on the server is kept

3. Create .github/workflows/deploy-production.yml. There is no template yet. For Laravel:

   name: Deploy production
   on:
     workflow_dispatch:
   permissions:
     contents: read
   jobs:
     deploy:
       uses: scify/.github/.github/workflows/[email protected]
       with:
         environment: production
       secrets:
         SSH_HOST: ${{ secrets.SSH_HOST }}
         SSH_PORT: ${{ secrets.SSH_PORT }}
         SSH_USER: ${{ secrets.SSH_USER }}
         SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
         PROJECT_PATH: ${{ secrets.PROJECT_PATH }}
         ENV_FILE: ${{ secrets.ENV_FILE }}

   For a static frontend, call node-deploy.yml instead with the same secrets.

4. Run it from the Actions tab with Run workflow.

Laravel-specific server requirements are listed at the top of .github/workflows/laravel-deploy.yml.

Create .github/workflows/security.yml:

name: Security
on:
  pull_request:
  schedule:
    - cron: '0 11 * * 1'
permissions:
  contents: read
jobs:
  security:
    uses: scify/.github/.github/workflows/[email protected]

Every check skips itself when the repository lacks the matching files, so the same call works for Laravel, npm-only and PHP-only repositories. The npm hardening check expects the .npmrc described in .github/actions/verify-npm-hardening/README.md.

Licence and OWASP scans are separate workflows. Add a job that calls license-check.yml or owasp-dependency-check.yml when a project needs them.

This repository is work in progress. Releases are tagged v0.x and callers pin to the current one, v0.1. Any v0.x release may change inputs or defaults. When the workflows have run in real repositories for a while, v1 becomes the first stable tag and moves forward only for backwards-compatible fixes.

To publish a new release:

1. Update every @v0.x reference in this repository to the new tag. The security.yml workflow calls the composite actions by tag, so a missing update breaks it.

2. Tag and push:

   git tag v0.2 && git push origin v0.2

A reusable workflow cannot reference a sibling action by relative path, so security.yml calls the actions in this repository as scify/.github/.github/actions/<name>@v0.1. When you test a workflow change on a branch, the actions still come from v1. Move the tag after both are merged.

Dependabot reads only the repository's own .github/dependabot.yml. There is no include mechanism, so the templates are copied once and then owned by that repository. Pick the matching template:

• templates/dependabot-laravel.yml for Composer + npm + GitHub Actions
• templates/dependabot-node.yml for npm + GitHub Actions
• templates/dependabot-wordpress.yml for WordPress themes and plugins. Read its header: WordPress core and wp-admin plugins are not tracked.

From the target repository's root:

mkdir -p .github
curl -sSfL https://raw.githubusercontent.com/scify/.github/v0.1/templates/dependabot-laravel.yml -o .github/dependabot.yml

Then enable "Dependabot security updates" in the repository's Security settings and commit the file.

All three templates configure security updates only. A change to a template does not reach existing copies. Re-run the command to pick it up.

• Pin every third-party action to a full commit SHA with the version in a trailing comment.
• Keep reusable workflows tolerant: run a tool only when the repository is configured for it.
• Test a change by pointing a caller at your branch: uses: scify/.github/.github/workflows/laravel-ci.yml@my-branch.
• Run actionlint before you push.