Simplified Single GitHub Actions CI/CD File (Updated)

1# Agent rules for generation:
2# https://arran4.github.io/blog/post/2026/028-simplified-github-ci-updated/ (or whatever URL was provided. In this case it will be the end url for this file)
3# Built using this post as a reference/guide.
4name: CI/CD

 1name: CI/CD
 2
 3on:
 4  push:
 5    # We know the repo so the trunk branch should be filtered down / pre selected
 6    branches: [main, master]
 7    # semantic version tags + rc/beta snapshots
 8    tags:
 9      - 'v*'
10      - 'v*.*.*'
11      - 'v*.*.*-rc*'
12      - 'v*.*.*-beta*'
13      - 'v*.*.*-test*'
14  pull_request:
15    types: [opened, synchronize, reopened, ready_for_review]
16    branches: [main, master]
17  release:
18    types: [published]
19  workflow_dispatch:
20    inputs:
21      mode:
22        description: "Pipeline mode"
23        required: true
24        default: "lint-fix"
25        type: choice
26        options:
27          - lint-fix
28          - build
29          - release-major
30          - release-minor
31          - release-patch
32          - release-test
33          - release-rc
34          - release-alpha
35          - monthly-maintenance
36      release_version_override:
37        description: "Optional explicit release version (for example 2.4.0 or 2.4.0-rc.2)"
38        required: false
39        default: ""
40        type: string
41      allow_prs:
42        description: "Allow automation to open pull requests. Tools that fix like go fmt, go fix, etc, will use this. Also in some projects we do auto bumping of 'next version' this is for those situations too. On public projects that don't have existing failures or frequent failures, often I turn this on and off"
43        required: false
44        default: true
45        type: boolean
46  schedule:
47    # preferred heavy monthly run (quota reset strategy)
48    # Always target the 2nd of each month at 5am AEST ignore dst
49    - cron: '0 19 1 * *'
50    # optional nightly lightweight checks
51    - cron: '41 2 * * *'

 1  prepare-release-tag:
 2    name: Prepare release tag
 3    needs: [route]
 4    if: ${{ github.event_name == 'workflow_dispatch' && startsWith(inputs.mode, 'release-') }}
 5    runs-on: ubuntu-latest
 6    outputs:
 7      release_tag: ${{ steps.tag.outputs.release_tag }}
 8      next_version: ${{ steps.tag.outputs.next_version }}
 9    steps:
10      - uses: actions/checkout@v4
11        with:
12          fetch-depth: 0
13      - name: Setup git-tag-inc
14        uses: arran4/git-tag-inc-action@v1
15        with:
16          mode: install
17      # Do not also run `go install github.com/arran4/git-tag-inc/...` in this job.
18      # Using both is redundant and has caused avoidable CI drift.
19      - id: tag
20        shell: bash
21        run: |
22          set -euo pipefail
23          git config --global user.name "github-actions[bot]"
24          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" # Note: you can get this ID using the GitHub API: curl -s https://api.github.com/users/github-actions%5Bbot%5D | jq .id
25          MODE="${{ inputs.mode }}"
26          OVERRIDE="${{ inputs.release_version_override }}"
27
28          if [[ -n "$OVERRIDE" ]]; then
29            # Accept "1.2.3" or "v1.2.3" override input.
30            OVERRIDE="${OVERRIDE#v}"
31            next_tag="v$OVERRIDE"
32          else
33            case "$MODE" in
34              release-major) level="major"; suffix="" ;;
35              release-minor) level="minor"; suffix="" ;;
36              release-patch) level="patch"; suffix="" ;;
37              release-test)  level="patch"; suffix="test" ;;
38              release-rc)    level="patch"; suffix="rc" ;;
39              release-alpha) level="patch"; suffix="alpha" ;;
40              *) echo "Unsupported release mode: $MODE"; exit 1 ;;
41            esac
42            if command -v git-tag-inc >/dev/null 2>&1; then
43              # git-tag-inc uses positional commands (patch/major/minor/test/rc...)
44              # and NOT flag forms like -patch.
45              level="${level#-}"
46              args=(-print-version-only "$level")
47              [[ -n "$suffix" ]] && args+=("$suffix")
48              next_tag=$(git-tag-inc "${args[@]}")
49            else
50              # Fallback implementation when git-tag-inc is not available.
51              git fetch --tags --force
52              latest=$(git tag -l 'v*' | sed 's/^v//' | sort -V | tail -n 1)
53              [[ -z "$latest" ]] && latest='0.0.0'
54
55              # Prefer npx semver if available (same pattern used in g2 fixes).
56              if command -v npx >/dev/null 2>&1; then
57                case "$level" in
58                  major) bumped=$(npx --yes semver "$latest" -i major) ;;
59                  minor) bumped=$(npx --yes semver "$latest" -i minor) ;;
60                  *) bumped=$(npx --yes semver "$latest" -i patch) ;;
61                esac
62                next_tag="v${bumped}"
63              else
64                base="${latest%%-*}"
65                IFS='.' read -r maj min pat <<< "$base"
66                case "$level" in
67                  major) maj=$((maj+1)); min=0; pat=0 ;;
68                  minor) min=$((min+1)); pat=0 ;;
69                  *) pat=$((pat+1)) ;;
70                esac
71                next_tag="v${maj}.${min}.${pat}"
72              fi
73
74              if [[ -n "$suffix" ]]; then
75                next_tag="${next_tag}-${suffix}.1"
76              fi
77            fi
78          fi
79
80          # Tagging safety guards to avoid duplicate/invalid release states.
81          [[ "$next_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.]+)?$ ]] || {
82            echo "Invalid tag format: $next_tag" >&2
83            exit 1
84          }
85          git fetch --tags --force
86          if git rev-parse "$next_tag" >/dev/null 2>&1; then
87            echo "Tag already exists: $next_tag" >&2
88            echo "Choose a new mode or set release_version_override." >&2
89            exit 1
90          fi
91
92          echo "release_tag=$next_tag" >> "$GITHUB_OUTPUT"
93          clean_tag="${next_tag#v}"; clean_tag="${clean_tag%%-*}"
94          IFS='.' read -r maj min pat <<< "$clean_tag"
95          echo "next_version=${maj:-0}.${min:-0}.$(( ${pat:-0} + 1 ))-SNAPSHOT" >> "$GITHUB_OUTPUT"          

1npm version patch --no-git-tag-version

1PUBSPEC_VERSION=$(awk '/^version:/ {print $2}' pubspec.yaml)
2# increment logic ...
3sed -i "s/^version: .*/version: $NEW_VERSION/" pubspec.yaml

1sed -i -E "s/(project\([^ ]+ VERSION )[^ )]+/\1$NEW_VERSION/" CMakeLists.txt

 1concurrency:
 2  # Keep this as a safety net, not the primary dedupe mechanism.
 3  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
 4  cancel-in-progress: true
 5
 6permissions:
 7  # Remember to only provide permissions where necessary
 8  contents: write
 9  discussions: write
10  pull-requests: write
11  checks: write
12  packages: write
13  security-events: write
14
15jobs:
16  route:
17    name: Route event
18    runs-on: ubuntu-latest
19    outputs:
20      run_code_checks: ${{ steps.route.outputs.run_code_checks }}
21      run_pr_meta_checks: ${{ steps.route.outputs.run_pr_meta_checks }}
22      run_cleanup: ${{ steps.route.outputs.run_cleanup }}
23      run_release: ${{ steps.route.outputs.run_release }}
24      is_monthly: ${{ steps.route.outputs.is_monthly }}
25      is_nightly: ${{ steps.route.outputs.is_nightly }}
26    steps:
27      - id: route
28        shell: bash
29        run: |
30          set -euo pipefail
31
32          run_code_checks=false
33          run_pr_meta_checks=false
34          run_cleanup=false
35          run_release=false
36          is_monthly=false
37          is_nightly=false
38
39          case "${{ github.event_name }}" in
40            push)
41              run_code_checks=true
42              ;;
43            pull_request)
44              if [[ "${{ github.event.action }}" == "closed" ]]; then
45                # We need to reduce the number of reruns we are getting on "closed"
46                # I am not sure following closed is even necessary
47                # Skip execution if the PR was closed by being merged
48                if [[ "${{ github.event.pull_request.merged }}" == "true" ]]; then
49                  exit 0
50                fi
51                run_cleanup=true
52              else
53                run_pr_meta_checks=true
54                # In practice, also run code checks on PRs so lint/fmt/vet/test
55                # show up directly in the PR UI. Use concurrency to collapse churn.
56                run_code_checks=true
57              fi
58              ;;
59            release)
60              run_release=true
61              ;;
62            workflow_dispatch)
63              run_code_checks=true
64              if [[ "${{ inputs.mode }}" == release-* ]]; then
65                run_release=true
66              fi
67              if [[ "${{ inputs.mode }}" == "monthly-maintenance" ]]; then
68                is_monthly=true
69              fi
70              if [[ "${{ inputs.mode }}" == "lint-fix" ]]; then
71                # Manual lint-fix acts as an on-demand nightly-style maintenance pass.
72                is_nightly=true
73              fi
74              ;;
75            schedule)
76              run_code_checks=true
77              if [[ "${{ github.event.schedule }}" == "17 3 1 * *" ]]; then
78                is_monthly=true
79              fi
80              if [[ "${{ github.event.schedule }}" == "41 2 * * *" ]]; then
81                is_nightly=true
82              fi
83              ;;
84          esac
85
86          echo "run_code_checks=$run_code_checks" >> "$GITHUB_OUTPUT"
87          echo "run_pr_meta_checks=$run_pr_meta_checks" >> "$GITHUB_OUTPUT"
88          echo "run_cleanup=$run_cleanup" >> "$GITHUB_OUTPUT"
89          echo "run_release=$run_release" >> "$GITHUB_OUTPUT"
90          echo "is_monthly=$is_monthly" >> "$GITHUB_OUTPUT"
91          echo "is_nightly=$is_nightly" >> "$GITHUB_OUTPUT"          

 1  route:
 2    name: Event Router
 3    runs-on: ubuntu-latest
 4    outputs:
 5      run_code_checks: ${{ steps.decide.outputs.run_code_checks }}
 6      run_build: ${{ steps.decide.outputs.run_build }}
 7      run_release: ${{ steps.decide.outputs.run_release }}
 8    steps:
 9      - id: decide
10        shell: bash
11        run: |
12          set -euo pipefail
13          if [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.action }}" == "closed" ]]; then
14            # We need to reduce the number of reruns we are getting on "closed"
15            # I am not sure following closed is even necessary
16            if [[ "${{ github.event.pull_request.merged }}" == "true" ]]; then
17              exit 0
18            fi
19            echo "run_code_checks=false" >> "$GITHUB_OUTPUT"
20            echo "run_build=false" >> "$GITHUB_OUTPUT"
21            echo "run_release=false" >> "$GITHUB_OUTPUT"
22            exit 0
23          fi
24
25          echo "run_code_checks=true" >> "$GITHUB_OUTPUT"
26
27          if [[ "${{ github.ref }}" == refs/tags/* || ("${{ github.event_name }}" == "workflow_dispatch" && "${{ inputs.mode }}" != "lint-fix") ]]; then
28            echo "run_build=true" >> "$GITHUB_OUTPUT"
29          else
30            echo "run_build=false" >> "$GITHUB_OUTPUT"
31          fi
32
33          if [[ "${{ github.ref }}" == refs/tags/v* || ("${{ github.event_name }}" == "workflow_dispatch" && startsWith("${{ inputs.mode }}", "release-")) ]]; then
34            echo "run_release=true" >> "$GITHUB_OUTPUT"
35          else
36            echo "run_release=false" >> "$GITHUB_OUTPUT"
37          fi          

1concurrency:
2  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
3  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/master' && !startsWith(github.ref, 'refs/tags/') }}

1  language:
2    strict-casts: true
3
4linter:
5  rules:
6    - avoid_print
7    - prefer_single_quotes

 1run:
 2  timeout: 5m
 3
 4linters:
 5  enable:
 6    - govet
 7    - staticcheck
 8    - errcheck
 9    - ineffassign
10    - revive

1{
2  "semi": false,
3  "singleQuote": true,
4  "printWidth": 100
5}

1BasedOnStyle: LLVM
2IndentWidth: 2
3ColumnLimit: 100

 1Name:           app
 2Version:        %{?version}%{!?version:0.0.0}
 3Release:        1%{?dist}
 4Summary:        App summary
 5License:        MIT
 6Source0:        %{name}-%{version}.tar.gz
 7
 8%description
 9App description.
10
11%prep
12%autosetup
13
14%build
15# build steps here
16
17%install
18mkdir -p %{buildroot}/usr/bin
19
20%files
21/usr/bin/*
22
23%changelog
24* Thu Mar 04 2026 CI Bot <ci@example.com> - %{version}-1
25- Automated source build

 1  gitleaks:
 2    name: Secret scan
 3    needs: [route]
 4    if: ${{ needs.route.outputs.run_cleanup != 'true' && (needs.route.outputs.is_nightly == 'true' || needs.route.outputs.is_monthly == 'true') }}
 5    runs-on: ubuntu-latest
 6    steps:
 7      - uses: actions/checkout@v4
 8        with:
 9          fetch-depth: 0
10      - uses: gitleaks/gitleaks-action@v2
11        env:
12          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
13
14  dependency-review:
15    name: Dependency review (public/full)
16    needs: [route]
17    if: ${{ github.event_name == 'pull_request' && github.event.action != 'closed' }}
18    runs-on: ubuntu-latest
19    steps:
20      - uses: actions/dependency-review-action@v4

 1  java-build-test:
 2    name: Java build/test
 3    needs: [route]
 4    if: ${{ needs.route.outputs.run_code_checks == 'true' && hashFiles('pom.xml') != '' }}
 5    runs-on: ubuntu-latest
 6    steps:
 7      - uses: actions/checkout@v4
 8      - uses: actions/setup-java@v4
 9        with:
10          java-version: '11'
11          distribution: temurin
12          cache: maven
13      - run: mvn spotless:check
14      - run: mvn test -DskipITs=false

 1permissions:
 2  # Remember to only provide permissions where necessary
 3  contents: write
 4  pull-requests: write
 5  checks: write
 6  packages: write
 7  security-events: write
 8  pages: write
 9  id-token: write
10
11jobs:
12  route:
13    outputs:
14      run_pages: ${{ steps.route.outputs.run_pages }}
15    steps:
16      - id: route
17        run: |
18          run_pages=false
19          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
20            run_pages=true
21          elif [[ "${{ github.ref }}" == refs/tags/* || "${{ github.ref }}" == "refs/heads/main" || "${{ github.ref }}" == "refs/heads/master" ]]; then
22            run_pages=true
23          fi
24          echo "run_pages=$run_pages" >> "$GITHUB_OUTPUT"          
25
26  hugo-build:
27    name: Build Hugo site
28    needs: [route]
29    if: ${{ needs.route.outputs.run_pages == 'true' }}
30    runs-on: ubuntu-latest
31    env:
32      HUGO_VERSION: ${{ inputs.hugo_version || '0.123.7' }}
33    steps:
34      - name: Install Hugo CLI
35        run: |
36          wget -O ${{ runner.temp }}/hugo.deb https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.deb
37          sudo dpkg -i ${{ runner.temp }}/hugo.deb          
38      - name: Install Dart Sass
39        run: sudo snap install dart-sass
40      - uses: actions/checkout@v4
41        with:
42          submodules: recursive
43      - id: pages
44        uses: actions/configure-pages@v5
45      - name: Install Node dependencies
46        working-directory: ./site/mydocs
47        run: "[[ -f package-lock.json || -f npm-shrinkwrap.json ]] && npm ci || true"
48      - name: Build with Hugo
49        working-directory: ./site/mydocs
50        env:
51          HUGO_ENVIRONMENT: production
52          HUGO_ENV: production
53        run: |
54          hugo --minify --baseURL "${{ steps.pages.outputs.base_url }}/"          
55      - uses: actions/upload-pages-artifact@v3
56        with:
57          path: ./site/mydocs/public
58
59  hugo-deploy:
60    name: Deploy to GitHub Pages
61    needs: [route, hugo-build]
62    if: ${{ needs.route.outputs.run_pages == 'true' }}
63    runs-on: ubuntu-latest
64    concurrency:
65      group: pages
66      cancel-in-progress: false
67    environment:
68      name: github-pages
69      url: ${{ steps.deployment.outputs.page_url }}
70    steps:
71      - name: Deploy to GitHub Pages
72        id: deployment
73        uses: actions/deploy-pages@v4

 1  # Requested baseline snippet (modern versions)
 2  golangci:
 3    name: lint
 4    needs: [route]
 5    if: ${{ needs.route.outputs.run_code_checks == 'true' }}
 6    runs-on: ubuntu-latest
 7    steps:
 8      - uses: actions/checkout@v5
 9      - uses: actions/setup-go@v6
10        with:
11          go-version-file: go.main
12      - name: golangci-lint
13        uses: golangci/golangci-lint-action@v9
14        with:
15          version: latest
16
17  go-test:
18    name: Go lint/test (${{ matrix.os }})
19    needs: [route, golangci]
20    if: ${{ needs.route.outputs.run_code_checks == 'true' }}
21    runs-on: ${{ matrix.os }}
22    strategy:
23      fail-fast: false
24      matrix:
25        # Cost-aware default: Ubuntu only.
26        # Add windows-latest/macos-latest only for true platform-specific behavior.
27        os: [ubuntu-latest]
28    steps:
29      - uses: actions/checkout@v4
30      - uses: actions/setup-go@v6
31        with:
32          go-version-file: go.main
33          cache: true
34      - name: Test
35        run: go test ./... -v
36
37  go-vet:
38    name: Go vet
39    needs: [route]
40    if: ${{ needs.route.outputs.run_code_checks == 'true' }}
41    runs-on: ubuntu-latest
42    steps:
43      - uses: actions/checkout@v4
44      - uses: actions/setup-go@v6
45        with:
46          go-version-file: go.main
47          cache: true
48      - run: go vet ./...
49
50  go-fmt-pr:
51    name: go fmt -> PR (manual dispatch)
52    needs: [route]
53    if: ${{ github.event_name == 'workflow_dispatch' && inputs.mode == 'lint-fix' && inputs.allow_prs == true }}
54    runs-on: ubuntu-latest
55    steps:
56      - uses: actions/checkout@v4
57      - uses: actions/setup-go@v6
58        with:
59          go-version-file: go.main
60      - name: Run go fmt
61        run: go fmt ./...
62      - name: Create PR if go fmt changed files
63        env:
64          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
65        run: |
66          set -euo pipefail
67          git diff --quiet && { echo "No fmt changes"; exit 0; }
68          git config user.name "github-actions[bot]"
69          git config user.email "41898282+github-actions[bot]@users.noreply.github.com" # Note: you can get this ID using the GitHub API: curl -s https://api.github.com/users/github-actions%5Bbot%5D | jq .id
70          BRANCH="ci/gofmt/${{ github.run_id }}"
71          git checkout -b "$BRANCH"
72          git add -A
73          git commit -m "ci: go fmt"
74          git push origin "$BRANCH"
75          gh pr create --title "ci: go fmt" --body "Automated go fmt from manual dispatch." --base main --head "$BRANCH" --label "ci-autofix"          

 1  go-cross-os-smoke:
 2    name: Go cross-OS smoke (${{ matrix.os }})
 3    needs: [route, golangci]
 4    if: ${{ needs.route.outputs.run_code_checks == 'true' && (github.event_name == 'workflow_dispatch' && inputs.mode == 'build') }}
 5    runs-on: ${{ matrix.os }}
 6    strategy:
 7      fail-fast: false
 8      matrix:
 9        os: [ubuntu-latest, windows-latest, macos-latest]
10    steps:
11      - uses: actions/checkout@v4
12      - uses: actions/setup-go@v6
13        with:
14          go-version-file: go.main
15      - run: go build ./...

 1  node-lint-test:
 2    name: Node lint/test
 3    needs: [route]
 4    if: ${{ needs.route.outputs.run_code_checks == 'true' }}
 5    runs-on: ubuntu-latest
 6    steps:
 7      - uses: actions/checkout@v4
 8      - uses: actions/setup-node@v4
 9        with:
10          node-version: '22'
11          cache: 'npm'
12      - run: npm ci
13      - run: npm run lint --if-present
14      - run: npm test --if-present
15      - name: Build source npm package
16        run: npm pack --json > npm-pack-result.json
17
18      - uses: actions/upload-artifact@v4
19        with:
20          name: npm-source-package
21          retention-days: 1
22          path: |
23            *.tgz
24            npm-pack-result.json            

 1on:
 2  workflow_dispatch:
 3    inputs:
 4      level:
 5        description: Version Bump Level
 6        required: true
 7        default: patch
 8        type: choice
 9        options: [patch, minor, major, prerelease]
10      create_prerelease:
11        description: Create as prerelease (e.g. -next.0)
12        required: false
13        default: false
14        type: boolean
15
16jobs:
17  version-and-release:
18    runs-on: ubuntu-latest
19    steps:
20      - uses: actions/checkout@v4
21        with:
22          fetch-depth: 0
23      - uses: actions/setup-node@v4
24        with:
25          node-version: '18'
26
27      - name: Manual Version Bump
28        if: github.event_name == 'workflow_dispatch'
29        run: |
30          LEVEL="${{ inputs.level }}"
31          CREATE_PRE="${{ inputs.create_prerelease }}"
32          if [ "$LEVEL" = "prerelease" ]; then
33            npm version prerelease --preid=next --no-git-tag-version
34          elif [ "$CREATE_PRE" = "true" ]; then
35            npm version pre$LEVEL --preid=next --no-git-tag-version
36          else
37            npm version $LEVEL --no-git-tag-version
38          fi          
39
40      - name: Determine npm tag and prerelease state
41        id: versions
42        run: |
43          CURRENT_VERSION=$(node -p "require('./package.json').version")
44          if [[ "$CURRENT_VERSION" == *-* ]]; then
45            echo "npm_tag=next" >> "$GITHUB_OUTPUT"
46            echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
47          else
48            echo "npm_tag=latest" >> "$GITHUB_OUTPUT"
49            echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
50          fi          

 1  dart-analyze-test:
 2    name: Dart analyze/test
 3    needs: [route]
 4    if: ${{ needs.route.outputs.run_code_checks == 'true' }}
 5    runs-on: ubuntu-latest
 6    steps:
 7      - uses: actions/checkout@v4
 8      - uses: dart-lang/setup-dart@v1
 9      - run: dart --version
10      - run: dart pub get
11      - run: dart format --set-exit-if-changed .
12      - run: dart analyze
13      - run: dart test
14
15  flutter-analyze-test:
16    name: Flutter analyze/test (fast path)
17    needs: [route]
18    if: ${{ needs.route.outputs.run_code_checks == 'true' }}
19    runs-on: ubuntu-latest
20    steps:
21      - uses: actions/checkout@v4
22      - uses: subosito/flutter-action@v2
23        with:
24          channel: stable
25      - run: flutter --version
26      - run: flutter pub get
27      - run: dart format --set-exit-if-changed .
28      - run: flutter analyze
29      - run: flutter test
30
31  flutter-format-pr:
32    name: Flutter format -> PR (manual lint-fix)
33    needs: [route]
34    if: ${{ github.event_name == 'workflow_dispatch' && inputs.mode == 'lint-fix' }}
35    runs-on: ubuntu-latest
36    steps:
37      - uses: actions/checkout@v4
38      - uses: subosito/flutter-action@v2
39        with:
40          channel: stable
41      - run: flutter pub get
42      - id: format
43        run: |
44          dart format .
45          if [[ -n $(git status --porcelain -- '*.dart') ]]; then
46            echo "changes=true" >> "$GITHUB_OUTPUT"
47            git status --porcelain -- '*.dart'
48          else
49            echo "changes=false" >> "$GITHUB_OUTPUT"
50          fi          
51      - name: Open PR with formatting fixes
52        if: steps.format.outputs.changes == 'true' && inputs.allow_prs == true
53        uses: peter-evans/create-pull-request@v7
54        with:
55          token: ${{ secrets.GITHUB_TOKEN }}
56          commit-message: "style: apply dart format"
57          title: "style: apply dart format"
58          body: "Automated PR for Flutter/Dart formatting fixes."
59          branch: "automated/dart-format-${{ github.ref_name }}"
60          base: ${{ github.ref_name }}
61          delete-branch: true
62      - name: Fail if formatting drift exists
63        if: steps.format.outputs.changes == 'true'
64        run: |
65          echo "Formatting drift detected. Fix directly or merge the generated PR."
66          exit 1          
67
68  flutter-build-artifacts:
69    name: Flutter build artifacts (release/monthly only)
70    needs: [route, flutter-analyze-test]
71    if: ${{ (needs.route.outputs.run_release == 'true' || needs.route.outputs.is_monthly == 'true' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'build')) }}
72    runs-on: ubuntu-latest
73    steps:
74      - uses: actions/checkout@v4
75      - uses: subosito/flutter-action@v2
76        with:
77          channel: stable
78      - run: flutter pub get
79      - run: flutter build linux --release
80      - run: flutter build apk --release || true
81
82      - uses: actions/upload-artifact@v4
83        with:
84          name: flutter-release-bundles
85          retention-days: 1
86          path: |
87            build/linux/**
88            build/app/outputs/flutter-apk/*.apk            

 1  dart-release-prep:
 2    name: Dart release prep
 3    if: ${{ github.event_name == 'workflow_dispatch' }}
 4    runs-on: ubuntu-latest
 5    steps:
 6      - uses: actions/checkout@v4
 7        with:
 8          fetch-depth: 0
 9      - uses: dart-lang/setup-dart@v1
10      - name: Compute version and tag
11        env:
12          INCREMENT: ${{ inputs.increment }}
13          MANUAL_VERSION_INPUT: ${{ inputs.manual_version }}
14        run: |
15          set -euo pipefail
16          PUBSPEC_VERSION=$(awk '/^version:/ {print $2}' pubspec.yaml)
17          git fetch --tags
18          HIGHEST_TAG=$(git tag -l "v*" | sed 's/^v//' | sort -V | tail -n 1)
19          [ -z "$HIGHEST_TAG" ] && HIGHEST_TAG="0.0.0"
20
21          CURRENT_VERSION=$(echo -e "$PUBSPEC_VERSION          
22$HIGHEST_TAG" | sort -V | tail -n 1)
23
24          if [ "$INCREMENT" = "manual" ]; then
25            [ -z "$MANUAL_VERSION_INPUT" ] && { echo "manual_version required"; exit 1; }
26            NEW_VERSION="$MANUAL_VERSION_INPUT"
27          else
28            IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT_VERSION"
29            case "$INCREMENT" in
30              major) NEW_VERSION="$((MAJOR+1)).0.0" ;;
31              minor) NEW_VERSION="$MAJOR.$((MINOR+1)).0" ;;
32              *) NEW_VERSION="$MAJOR.$MINOR.$((PATCH+1))" ;;
33            esac
34          fi
35
36          sed -i "s/^version: .*/version: $NEW_VERSION/" pubspec.yaml
37          git config user.name "github-actions[bot]"
38          git config user.email "41898282+github-actions[bot]@users.noreply.github.com" # Note: you can get this ID using the GitHub API: curl -s https://api.github.com/users/github-actions%5Bbot%5D | jq .id
39          git checkout -b "release/v$NEW_VERSION"
40          git add pubspec.yaml
41          git commit -m "Bump version to $NEW_VERSION"
42          git tag -f "v$NEW_VERSION"
43          git push -f origin "v$NEW_VERSION"
44          git push origin "release/v$NEW_VERSION"

 1  cpp-qt-build-test:
 2    name: Qt/C++ build
 3    needs: [route]
 4    if: ${{ needs.route.outputs.run_code_checks == 'true' }}
 5    runs-on: ubuntu-latest
 6    steps:
 7      - uses: actions/checkout@v4
 8      - run: sudo apt-get update
 9      - run: sudo apt-get install -y cmake ninja-build build-essential qt6-base-dev qt6-tools-dev clang-format cppcheck
10      - name: Lint style and static checks
11        run: |
12          find . \( -name '*.cpp' -o -name '*.cc' -o -name '*.h' -o -name '*.hpp' \) -print0 | xargs -0 -r clang-format --dry-run --Werror
13          cppcheck --enable=warning,style,performance,portability --error-exitcode=1 .          
14      - run: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release
15      - run: cmake --build build --parallel
16      - run: ctest --test-dir build --output-on-failure
17
18  c-make-build-test:
19    name: Classic C Makefile build
20    needs: [route]
21    if: ${{ needs.route.outputs.run_code_checks == 'true' }}
22    runs-on: ubuntu-latest
23    steps:
24      - uses: actions/checkout@v4
25      - run: make -j"$(nproc)" all
26      - run: make test || true

 1  autofix:
 2    name: Auto-format and open PR
 3    needs: [route]
 4    if: ${{ github.event_name == 'workflow_dispatch' && inputs.mode == 'lint-fix' && inputs.allow_prs == true }}
 5    runs-on: ubuntu-latest
 6    steps:
 7      - uses: actions/checkout@v4
 8
 9      - name: Setup Go (if needed)
10                uses: actions/setup-go@v6
11        with:
12          go-version-file: go.main
13
14      - name: Setup Node (if needed)
15                uses: actions/setup-node@v4
16        with:
17          node-version: '22'
18          cache: npm
19
20      - name: Setup Dart/Flutter (if needed)
21
22        uses: subosito/flutter-action@v2
23        with:
24          channel: stable
25
26      - name: Run autofix formatters
27        shell: bash
28        run: |
29          set -euo pipefail
30          if true; then
31            go fix ./... || true
32            go fmt ./... || true
33          fi
34          if true; then
35            npm ci || true
36            npx prettier . --write || true
37          fi
38          if true; then
39            dart format . || true
40          fi          
41
42      - name: Create PR if changes exist
43        env:
44          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
45        shell: bash
46        run: |
47          set -euo pipefail
48          if git diff --quiet; then
49            echo "No changes; exiting."
50            exit 0
51          fi
52
53          git config user.name "github-actions[bot]"
54          git config user.email "41898282+github-actions[bot]@users.noreply.github.com" # Note: you can get this ID using the GitHub API: curl -s https://api.github.com/users/github-actions%5Bbot%5D | jq .id
55
56          PARENT_PR="${{ github.event.pull_request.number || 'none' }}"
57          BRANCH="ci/autofix/${{ github.run_id }}-parent-${PARENT_PR}"
58
59          git checkout -b "$BRANCH"
60          git add -A
61          git commit -m "ci: automated formatting fixes"
62          git push origin "$BRANCH"
63
64          gh pr create \
65            --title "ci: automated formatting fixes" \
66            --body "Automated formatting pass. Parent-PR: ${PARENT_PR}" \
67            --base main \
68            --head "$BRANCH" \
69            --label "ci-autofix"          

 1  cleanup-autofix-prs:
 2    name: Cleanup autofix PRs on parent close
 3    needs: [route]
 4    if: ${{ needs.route.outputs.run_cleanup == 'true' }}
 5    runs-on: ubuntu-latest
 6    steps:
 7      - uses: actions/checkout@v4
 8      - env:
 9          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
10          PARENT_PR: ${{ github.event.pull_request.number }}
11        run: |
12          set -euo pipefail
13          gh pr list --state open --search "label:ci-autofix in:title" --json number,headRefName,body | \
14            jq -r '.[] | select(.body | contains("Parent-PR: '"$PARENT_PR"'")) | [.number, .headRefName] | @tsv' | \
15            while IFS=$'\t' read -r pr branch; do
16              gh pr close "$pr" --comment "Closing auto-fix PR because parent PR #$PARENT_PR was closed."
17              git push origin --delete "$branch" || true
18            done          

1steps:
2  - uses: actions/checkout@v4
3  - run: git push origin --delete "$BRANCH"

 1  docker-build:
 2    name: Docker build
 3    needs: [route]
 4    if: ${{ needs.route.outputs.run_release == 'true' }}
 5    runs-on: ubuntu-latest
 6    steps:
 7      - uses: actions/checkout@v4
 8      - uses: docker/setup-qemu-action@v3
 9      - uses: docker/setup-buildx-action@v3
10      - uses: docker/build-push-action@v6
11        with:
12          context: .
13          file: ${{ hashFiles('Dockerfile.goreleaser') != '' && 'Dockerfile.goreleaser' || 'Dockerfile' }}
14          push: false
15          tags: ghcr.io/${{ github.repository }}:ci-${{ github.run_id }}
16
17  docker-release:
18    name: Docker release
19    needs: [route, docker-build]
20    if: ${{ needs.route.outputs.run_release == 'true' }}
21    runs-on: ubuntu-latest
22    permissions:
23      contents: read
24      packages: write
25    steps:
26      - uses: actions/checkout@v4
27      - uses: docker/setup-qemu-action@v3
28      - uses: docker/setup-buildx-action@v3
29      - uses: docker/login-action@v3
30        with:
31          registry: ghcr.io
32          username: ${{ github.actor }}
33          password: ${{ secrets.GITHUB_TOKEN }}
34      - uses: docker/build-push-action@v6
35        with:
36          context: .
37          push: true
38          tags: |
39            ghcr.io/${{ github.repository }}:${{ github.ref_name }}
40            ghcr.io/${{ github.repository }}:latest            
41          platforms: linux/amd64,linux/arm64

 1  shell-check-and-chezmoi-apply:
 2    name: ShellCheck + chezmoi apply
 3    needs: [route]
 4    if: ${{ needs.route.outputs.run_code_checks == 'true' }}
 5    runs-on: ubuntu-latest
 6    steps:
 7      - uses: actions/checkout@v4
 8      - name: Install shellcheck and zsh
 9        run: sudo apt-get update && sudo apt-get install -y shellcheck zsh
10      - name: ShellCheck scripts
11        run: |
12          shopt -s globstar
13          shellcheck **/*.sh          
14      - name: Apply chezmoi source into CI home
15        run: |
16          yes "" | sh -c "$(curl -fsLS get.chezmoi.io)" -- init --no-tty --debug --source=$PWD --apply          
17      - name: Verify rendered shell files parse
18        run: |
19          for f in ~/.bashrc ~/.bash_profile ~/.bash_login ~/.bash_logout ~/.profile; do
20            [[ -f "$f" ]] && bash -n "$f"
21          done
22          for f in ~/.zshrc ~/.zprofile ~/.zlogin ~/.zlogout ~/.zshenv; do
23            [[ -f "$f" ]] && zsh -n "$f"
24          done          
25
26  docker-release:
27    name: Docker release
28    needs: [route]
29    if: ${{ needs.route.outputs.run_release == 'true' }}
30    runs-on: ubuntu-latest
31    steps:
32      - uses: actions/checkout@v4
33      - uses: docker/setup-qemu-action@v3
34      - uses: docker/setup-buildx-action@v3
35      - uses: docker/login-action@v3
36        with:
37          registry: ghcr.io
38          username: ${{ github.actor }}
39          password: ${{ secrets.GITHUB_TOKEN }}
40      - name: Docker metadata
41        id: meta
42        uses: docker/metadata-action@v5
43        with:
44          images: ghcr.io/${{ github.repository_owner }}/dev-dotfiles-debian
45          tags: |
46            type=ref,event=tag
47            type=semver,pattern={{version}}
48            type=semver,pattern={{major}}.{{minor}}
49            type=raw,value=${{ inputs.release_version_override }},enable=${{ inputs.release_version_override != '' }}
50            type=raw,value=latest,enable={{is_default_branch}}            
51      - uses: docker/build-push-action@v6
52        with:
53          context: .
54          build-contexts: dotfiles=.
55          file: containers/dev-dotfiles-debian/Dockerfile
56          push: true
57          tags: ${{ steps.meta.outputs.tags }}
58
59  package-dotfiles:
60    name: Package dotfiles archive
61    needs: [route]
62    if: ${{ needs.route.outputs.run_release == 'true' }}
63    runs-on: ubuntu-latest
64    steps:
65      - uses: actions/checkout@v4
66      - name: Build dotfiles archive
67        run: |
68          yes "" | sh -c "$(curl -fsLS get.chezmoi.io)" -- init --no-tty --debug --source=$PWD --apply
69          ./bin/chezmoi archive --source=$PWD --format zip --output dotfiles.zip          
70      - uses: actions/upload-artifact@v4
71        with:
72          name: dotfiles-archive
73          retention-days: 1
74          path: dotfiles.zip

 1  goreleaser:
 2    name: GoReleaser
 3    # In practice, include all quality gates here (for example: go-test, go-vet, go-lint, format).
 4    needs: [route, go-test, prepare-release-tag]
 5    if: ${{ (((github.event_name == 'push') && startsWith(github.ref, 'refs/tags/v')) || (github.event_name == 'workflow_dispatch' && startsWith(inputs.mode, 'release-'))) }}
 6    runs-on: ubuntu-latest
 7    steps:
 8      - uses: actions/checkout@v4
 9        with:
10          fetch-depth: 0
11          fetch-tags: true
12      - uses: actions/setup-go@v6
13        with:
14          go-version-file: go.main
15      - name: Calculate and Create Tag
16        if: ${{ github.event_name == 'workflow_dispatch' && startsWith(inputs.mode, 'release-') && inputs.mode != 'release-test' && inputs.mode != 'release-rc' && inputs.mode != 'release-alpha' }}
17        run: |
18          git tag ${{ needs.prepare-release-tag.outputs.release_tag }}
19          git push origin ${{ needs.prepare-release-tag.outputs.release_tag }}          
20      - name: Run GoReleaser
21        uses: goreleaser/goreleaser-action@v6
22        with:
23          distribution: goreleaser
24          version: '~> v2'
25          args: >-
26            release --clean
27            ${{ (github.event_name == 'workflow_dispatch' && (inputs.mode == 'release-test' || inputs.mode == 'release-rc' || inputs.mode == 'release-alpha')) && '--snapshot' || '' }}            
28        env:
29          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
30          TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }} # inject secrets.TAP_GITHUB_TOKEN
31          GORELEASER_CURRENT_TAG: ${{ needs.prepare-release-tag.outputs.release_tag }}

1# ❌ Don't (fails on v2):
2# args: release --clean --tag v0.0.1
3
4# ✅ Do:
5# args: release --clean
6# env:
7#   GORELEASER_CURRENT_TAG: v0.0.1

1if: ${{ !failure() && !cancelled() && needs.route.outputs.run_release == 'true' }}

  1project_name: your-project
  2
  3before:
  4  hooks:
  5    - go mod tidy
  6
  7builds:
  8  - id: app
  9    binary: app
 10    main: ./cmd/app
 11    env:
 12      - CGO_ENABLED=0
 13
 14archives:
 15  - formats: [tar.gz]
 16    format_overrides:
 17      - goos: windows
 18        formats: [zip]
 19
 20checksum:
 21  name_template: checksums.txt
 22
 23dockers:
 24  - image_templates:
 25      - ghcr.io/OWNER/REPO:{{ .Tag }}
 26      - ghcr.io/OWNER/REPO:latest
 27    dockerfile: Dockerfile.goreleaser
 28    use: buildx
 29    goos: linux
 30    goarch: [amd64, arm64]
 31
 32nfpms:
 33  -
 34    vendor: Ubels Software Development
 35    homepage: https://github.com/arran4/
 36    maintainer: Arran Ubels <arran@ubels.com.au>
 37    description: NA
 38    license: Private
 39    formats:
 40        - apk
 41        - deb
 42        - rpm
 43        - termux.deb
 44        - archlinux
 45    release: "1"
 46    section: default
 47    priority: extra
 48    contents:
 49      - src: doc/g2.1
 50        dst: /usr/share/man/man1/g2.1
 51        file_info:
 52          mode: 0644
 53
 54brews:
 55  -
 56    repository:
 57      owner: arran4
 58      name: homebrew-tap
 59      branch: "{{.ProjectName}}-{{.Version}}"
 60      token: "{{ .Env.TAP_GITHUB_TOKEN }}"
 61      pull_request:
 62        enabled: true
 63        draft: false
 64        base:
 65          owner: arran4
 66          name: homebrew-tap
 67          branch: main
 68    commit_author:
 69      name: goreleaserbot
 70      email: bot@goreleaser.com
 71
 72homebrew_casks:
 73  -
 74    repository:
 75      owner: arran4
 76      name: homebrew-tap
 77      branch: "{{.ProjectName}}-{{.Version}}"
 78      token: "{{ .Env.TAP_GITHUB_TOKEN }}"
 79      pull_request:
 80        enabled: true
 81        draft: false
 82        base:
 83          owner: arran4
 84          name: homebrew-tap
 85          branch: main
 86    commit_author:
 87      name: goreleaserbot
 88      email: bot@goreleaser.com
 89
 90scoops:
 91  - name: app
 92    bucket:
 93      owner: OWNER
 94      name: scoop-bucket
 95
 96changelog:
 97  sort: asc
 98  filters:
 99    exclude:
100      - '^docs:'
101      - '^test:'