Common actions

These were originally built for use with the Exivity CI/CD workflows, but can be applied outside of the context of the Exivity repositories.

• [build-push-image] ⚠️ DEPRECATED This action is deprecated and will be removed in a future version. Please migrate to docker-build-push
• docker-build-push
• commit-status
• dispatch-workflow
• enable-automerge
• init-ssh
• postgres
• process-binary
• purge-ghcr
• push-to-central-repo
• rabbitmq
• rcedit
• retag-image
• review
• semantic-pull-request
• sign-file
• slack
• sync-defaults
• virustotal

Exivity specific actions

These probably don't make much sense outside the context of the Exivity CI/CD workflows.

• accept
• db
• get-artefacts
• release
• put-artefacts

docker-build-push

Builds a container image and pushes it to a Docker registry. It uses the branch name as the image tag and attaches some simple opencontainers image labels. The actions also writes a metadata.json file containing some basic information about the image: component name, version (semver tag or git sha) and timestamp. This file needs to be manually copied into the image in the Dockerfile if needed.

Example

- uses: exivity/actions/docker-build-push@main

Inputs

commit-status

Writes a commit status.

Example

- uses: exivity/actions/commit-status@main
  with:
    context: auto-success

Inputs

dispatch-workflow

Triggers another workflow run. The target workflow must define the on: workflow_dispatch trigger.

The workflow should either be defined by ID or workflow filename. Look up the ID of a workflow by calling the GitHub API at:

GET https://api.github.com/repos/{owner}/{repo}/actions/workflows

Example

- uses: exivity/actions/dispatch-workflow@main
  with:
    workflow:
    gh-token: ${{ secrets.GITHUB_PAT }}

Inputs

enable-automerge

Enable GitHub automerge for the current PR.

Based on original work from alexwilson/enable-github-automerge-action

Example

- uses: exivity/actions/enable-automerge@main
  if: ${{ github.actor == 'dependabot[bot]' }}

Inputs

init-ssh

Use a private key and prime the known_hosts file with pre-loaded keys for github.com, gitlab.com and bitbucket.org.

Example

- uses: exivity/actions/init-ssh@main
  with:
    private-key: ${{ secrets.PRIVATE_KEY }}

Where the PRIVATE_KEY secret contains your private key:

-----BEGIN RSA PRIVATE KEY-----
key contents
-----END RSA PRIVATE KEY-----

Inputs

postgres

Starts a PostgreSQL server

Example

- uses: exivity/actions/postgres@main
  with:
    mode: docker

Inputs

process-binary

A composite action running rcedit, sign-file and virustotal (in that order).

Example

- uses: exivity/actions/process-binary@main
  with:
    path: build/foo.exe
    certificate-base64: ${{ secrets.CODESIGN_CERTIFICATE_BASE64 }}
    certificate-password: ${{ secrets.CODESIGN_CERTIFICATE_PASSWORD }}
    virustotal-api-key: ${{ secrets.VIRUSTOTAL_API_KEY }}

Inputs

See individual actions for inputs.

purge-ghcr

Delete a package version from GitHub Container Registry if a branch or tag is deleted. This is useful to clean dangling versions from ghcr.io for images built with [docker-build-push]. See .github repository for example usage.

Example

Full example workflow:

name: purge-ghcr

on: delete

jobs:
  purge-ghcr:
    runs-on: ubuntu-24.04
    steps:
      - uses: exivity/actions/purge-ghcr@main
        with:
          gh-token: ${{ secrets.GITHUB_PAT }}

Inputs

push-to-central-repo

Pushes selected files and folders to a central repository with an organized structure. This action is designed to collect files like README.md, templates, schema files, and other assets from multiple repositories and organize them in a centralized location.

Example

- uses: exivity/actions/push-to-central-repo@main
  with:
    central-repo-owner: 'your-org'
    central-repo-name: 'central-assets'
    files: 'README.md,package.json'
    folders: 'templates,docs'
    gh-token: ${{ secrets.GITHUB_TOKEN }}

Directory Structure

The action creates the following structure in the central repository:

/
├── schemas/
│   ├── repo-a/
│   │   ├── foo.schema.json
│   │   └── bar.schema.json
│   └── repo-b/
│       └── baz.schema.json
├── templates/
│   ├── repo-a/
│   │   ├── template1.html
│   │   └── partials/
│   └── repo-b/
│       └── widget/
│           └── index.hbs
└── README_sources/
    ├── repo-a/
    │   └── README.md
    └── repo-b/
        └── README.md
└── files/
    ├── repo-a/
    │   └── config.json
    └── repo-b/
        └── settings.yaml

Inputs

rabbitmq

Starts a RabbitMQ server in a Docker container.

Example

- uses: exivity/actions/rabbitmq@main

Inputs

rcedit

Edit resources of a Windows executable

⚠️ Currently only works on 64-bit Windows hosts

Example

- uses: exivity/actions/rcedit@main
  with:
    path: build/foo.exe

Inputs

retag-image

Pulls, tags, then pushes an image with multi-arch support. Uses docker buildx imagetools for proper multi-architecture image copying, preserving all architectures in the manifest list.

Example

- uses: exivity/actions/retag-image@main
  with:
    source-tag: main
    target-tag: release
    target-user: ${{ secrets.DOCKER_HUB_USER }}
    target-password: ${{ secrets.DOCKER_HUB_TOKEN }}

Params

review

Reviews a PR

Example

- uses: exivity/actions/review@main
  with:
    gh-token: ${{ secrets.GITHUB_PAT }}
    body: Exivity bot approves everything!

Inputs

semantic-pull-request

Ensures your pull requests title follow the Conventional Commits spec.

See .github repository for example usage.

Based on original work from amannn/action-semantic-pull-request

Example

- uses: exivity/actions/semantic-pull-request@main

Inputs

sign-file

Digitally sign a file

⚠️ Currently only works on Windows hosts

Example

- uses: exivity/actions/sign-file@main
  with:
    path: build/foo.exe
    certificate-base64: ${{ secrets.CODESIGN_CERTIFICATE_BASE64 }}
    certificate-password: ${{ secrets.CODESIGN_CERTIFICATE_PASSWORD }}

Inputs

slack

Send a Slack message to the author of the commit triggering the workflow (if available).

Example

- uses: exivity/actions/slack@main
  if: failure()
  with:
    status: ${{ job.status }}
    slack-api-token: ${{ secrets.SLACK_BOT_TOKEN }}

Inputs

sync-defaults

Syncs the repo settings with org defaults. Override org settings in a local .github/settings.yml file. See probot/settings for all available options.

See .github repository for example usage.

Based on original work from probot/settings

Example

- uses: exivity/actions/sync-defaults@main
  with:
    gh-token: ${{ secrets.GITHUB_PAT }}

Inputs

virustotal

Analyse artefacts with VirusTotal

Forked from: crazy-max/ghaction-virustotal

Example

Build workflow:

- uses: exivity/actions/virustotal@main
  with:
    path: build/foo.exe
    virustotal-api-key: ${{ secrets.VIRUSTOTAL_API_KEY }}

Separate check workflow:

name: virustotal-check

on:
  workflow_dispatch:
  schedule:
    - cron: '0 3 * * *'

jobs:
  check:
    runs-on: ubuntu-24.04
    steps:
      - uses: exivity/actions/virustotal@main
        with:
          mode: check
          virustotal-api-key: ${{ secrets.VIRUSTOTAL_API_KEY }}

Inputs

accept

Triggers a scaffold repository build using the workflow_dispatch event. Does not trigger for the master or main branch.

If the current branch includes a Jira key (e.g. EXVT-1000), the scaffold build will try to resolve matching epic branches for other components.

See .github repository for example usage.

Example

- uses: exivity/actions/accept@main
  with:
    gh-token: ${{ secrets.GH_BOT_TOKEN }}

Inputs

db

Runs a PostgreSQL docker container, create a new database, pulls in the db repository migrations and runs them.

Example

- uses: exivity/actions/db@main
  with:
    branch: some-feature-branch
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    gh-token: ${{ secrets.GH_BOT_TOKEN }}

Inputs

get-artefacts

Download artefacts for the provided component. It will use the S3 exivity bucket in the eu-central-1 region. Artefacts are downloaded with the build/{component}/{sha}[/{platform}][/{prefix}] prefix.

Example

- uses: exivity/actions/get-artefacts@main
  with:
    component: db
    branch: master
    path: db-artefacts
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    gh-token: ${{ secrets.GH_BOT_TOKEN }}

Inputs

release

Action to help releasing Exivity.

This action controls a release repository which is used to release Exivity. Whenever a change occurs in one of the components which is ready to be release, a pull request is updated in the release repository which contains the upcoming version increase inferred from all pending changes and updates to the CHANGELOG.md. Merging this pull request will release a new version of Exivity.

The ping mode is supposed to be used by components, whenever they push to their production branch. It will trigger a prepare workflow containing the release action in prepare mode in the release repository.

The prepare mode is to be used in the release repository. It will pull in pending changes in all components, update the upcoming version and CHANGELOG.md and open a pull request with these changes.

The release mode is to be used in the release repository. It will write a new release tag in the release repository, plus new tags in all released components.

⚠️ Important Make sure to checkout the entire git history in prepare and release mode by using the checkout actions like this:

- uses: actions/checkout@v3
  with:
    fetch-depth: 0

Examples

- uses: exivity/actions/release@main
  with:
    mode: ping
    gh-token: ${{ secrets.GH_BOT_TOKEN }}

- uses: exivity/actions/release@main
  with:
    mode: prepare
    gh-token: ${{ secrets.GH_BOT_TOKEN }}

- uses: exivity/actions/release@main
  with:
    mode: release
    gh-token: ${{ secrets.GH_BOT_TOKEN }}

Inputs

The NEW_RELEASE_PR_TEMPLATE.md file will be used when opening a new pull request in the prepare step.

put-artefacts

Uploads artefacts in the provided directory. It will use the S3 exivity bucket in the eu-central-1 region. Artefacts are uploaded to the build/{component}/{sha}[/{platform}][/{prefix}] prefix.

Example

- uses: exivity/actions/put-artefacts@main
  with:
    path: artefacts
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

Inputs

Development guide

When committing code to this repository, make sure to have Node & Yarn installed since code needs to be compiled in a pre-commit hook.

To make this easier, use the devcontainer configuration included with this repo.