tomgrv/actions

Reusable GitHub Actions for CI: PR checks, PHP and Laravel quality tools, monorepo packaging, releases and repository housekeeping. Each action is a composite action you call straight from a workflow.

Quick start

name: PR checks

on:
    pull_request:
        types: [opened, reopened, ready_for_review, synchronize]

jobs:
    checks:
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v7
            - uses: tomgrv/actions/check-pr-format@v5
              with:
                  fix: true
            - uses: tomgrv/actions/check-pr-source-branch@v5
            - uses: tomgrv/actions/check-secret@v5

Use @v5 for the latest 5.x, or pin an exact tag or commit. Every action's README lists its inputs, outputs and a ready-to-copy example.

Run an action on your machine

With zz-use, no clone needed:

zz-use -x tomgrv/actions/list-packages@v5

From a clone of this repository:

GITHUB_TOKEN=ghp_xxx zz-use -x ./check-lock
zz-use -x ./detect-changes

Set the GITHUB_* variables or inputs the action reads before running it.

Actions

🚀 Release

• release-promote (beta): Run git-release-beta then git-release-prod (git-flow beta→prod promotion).

🔧 Utils

• config-bot: Configure git bot identity and authentication for CI/CD.
• setup-scripts (beta): Idempotently bootstrap zz-use from tomgrv/scripts, optionally installing specific scripts.
• setup-gitversion (beta): Idempotently install the gitversion devcontainer feature's toolchain (GitVersion CLI plus gv/bump-tag/bump-changelog/bump-version).
• setup-gitflow (beta): Install the git-flow extension if missing, then initialize it against the checked-out repo.
• setup-php: Setup PHP, Composer, and extensions as per composer for CI jobs.
• setup-node: Setup Node.js and npm for CI jobs.
• setup-reviewdog: Setup reviewdog for CI jobs.
• resolve-environment (experimental): Resolve the deploy branch, tag, and environment from the triggering GitHub event.
• run-deployer (experimental): Install PHP Deployer and run a dep command, reporting warnings/errors via reviewdog.

📦 Monorepo

• list-packages: List all composer/npm packages in a monorepo.
• degit-package: Import the latest source branch content into a package repository and prune unwanted folders.
• split-package: Split a monorepo package to a separate repository based on path.
• publish-npm: Publish a package to npm registry using GitHub's OIDC trusted publishers.
• run-workspace-tests: Run a workspace's .scripts.test entry (from each root *.json file) as its test suite.

🐘 PHP Check

• check-laravel (beta): Run the standard Laravel PHP check suite (PHPStan, Pint, PHP Insights, PHPMD, tests) and report via reviewdog.
• check-filament (beta): Run Filament-specific checks (FilaCheck) and report via reviewdog.
• run-phpinsights: Run PHP Insights via reviewdog for inline code review feedback.
• run-filacheck: Run FilaCheck via reviewdog for inline Filament code review feedback.
• run-phpstan: Run PHPStan via reviewdog for inline code review feedback.
• run-phpmd: Run PHP Mess Detector and report via reviewdog.
• run-pint: Run Laravel Pint code style checks and report via reviewdog.
• run-phptests: Run the PHP test suite.
• check-security-composer: Audit Composer dependencies for known vulnerabilities.
• list-dirty (beta): List files with uncommitted git changes, used by the PHP checks' dirty input.
• list-wip (beta): List files changed on the current pull request, used by the PHP checks' wip input.
• list-php-parts (beta): List the PHP test parts (core, modules, packages) affected by a change, as a matrix for per-part test jobs.

🔀 Pull Request

• create-pr: Open or update a pull request for a branch, with customizable title/body/labels.
• rebase-pr: Rebase the head branch of a pull request onto its base branch.
• check-pr-format: Validate PR title and body format.
• check-pr-source-branch (beta): Reject PRs from the main branch unless marked as a hotfix.
• check-secret: Scan pull request changes for leaked secrets.
• check-security-npm: Audit npm dependencies for known vulnerabilities.
• check-lock (beta): Validate composer.json/composer.lock and package.json/package-lock.json — schema, publish-readiness, and lock coherence — via reviewdog.
• check-dockerfile: Validate Dockerfile against 6 production best practices
• confirm-pr-comment: Add a reaction emoji to the current GitHub event comment.
• create-pr-comment: Post a new comment on a pull request or issue.
• reply-pr-comment: Post a comment on a pull request or issue, referencing the comment that triggered the workflow.

🏷️ Repository Management

• update-labels: Create or update repository labels from a JSON file or comma-separated list.
• detect-changes: Detect uncommitted or untracked changes in a given path.
• clean-branches: Delete branches whose linked pull request is closed (merged or not).
• clean-history: Remove old workflow run history, keeping at least a minimum number of days and runs per workflow.
• create-update-ref: Create a git ref (tag/branch). If it already exists, updates it to point at the given SHA.
• prefix-orphan-branches: Rename remote branches that do not follow the gitflow config and have no pull request to orphan/.

run-* actions analyse the files they are given and report through reviewdog on those files. check-* actions validate repository or pull-request state.

Release a repository

Run Actions → release-prod → Run workflow in the repository: it calls release-promote, which cuts the beta and promotes it to production.

Contributing

Each action is a folder with action.yml, run.sh, README.md and a run.bats test. Run all tests with ./.repo/tests/run-tests.sh, or one with ./.repo/tests/run-tests.sh -f <action>. Pull requests target develop. Breaking changes and major bumps: UPGRADING.md.

License

MIT.