Shared GitHub configuration for the SylphxAI organization: the organization profile, default community health files (code of conduct, contributing guide, security policy, issue and pull request templates), and reusable GitHub Actions.
Use one from another repository with
uses: SylphxAI/.github/.github/actions/<name>@<commit> (or @main).
| Action | What it does |
|---|---|
| metadata-sync | Offline required-region/field patching with whole-plan validation and deterministic check/write; caller owns rendering (anymd/repomap adoption) |
| brand | Builds brand assets or checks provenance hashes and surface copies, with caller-owned masters and data |
| ci-ok | Requires named job dependencies to succeed, with contribution metadata and added-commit secret checks; caller migration |
| native-bridge-check | Checks Lua and Unity Android dispatch names against the exact pinned SDK release artifact |
| contribution-policy | Checks commit identities and public pull request metadata; included in both shared verdict actions |
| migration-guard | Refuses destructive PostgreSQL/MySQL migrations, edits to merged SQL migrations, and unsafe changes to schema snapshots |
| setup-ci-test | Installs ci-test, which requires fresh evidence of executed libtest, JUnit or Vitest tests and preserves runner failures |
| main-red-gate | Stop the line: while the trunk's newest conclusive Verify run is red and its way back is in motion, a merge group is admitted only for a revert, a live-outage fix or a pull request labelled main-red-fix; a red trunk with nothing in motion admits with a warning |
| needs-pass | The aggregate verdict of a workflow, including added-commit secret scanning on PRs and merge groups. A skipped job never counts as passing a required check outside merge_group: list PR-time jobs in required-unless-merge-group so a workflow_dispatch run cannot post a green check over a red one |
| merge-lane | Required R8 verdict over immutable workflow source; included in ci-ok and needs-pass, with served same-size merge pools and local reusable call-graph checks |
| workflow-lint | Actionlint syntax/reference checks, pre-merge performance rules, and job timeout/required-path failure contracts (report-only inventory or enforce) |
| secret-scan | Runs gitleaks over added commits; reports locations without values and accepts exact reasoned exceptions |
| literal-address-guard | Rejects newly added infrastructure-owned IP literals from a freshly generated inventory, with exact declaration-scalar authorizations |
| plain-language | Warns about coined terms on the lines a pull request adds |
| identifiers | Fails when a change adds an id generator, or a text or serial primary key, that is not a UUIDv7 |
| chat-senders | Fails when a change adds a direct Telegram, Slack or Discord chat-API host outside the action's allow-list; products send chat through Notify |
| stack-conformance | Fails a change that adds a departure from the default stack, an agent-runtime part Sylphx Agents owns that policy/agent-runtime.json does not allow until a date, or a knowledge-graph or CRM table that policy/knowledge-tables.json does not allow until a date |
| zh-hant | Fails when a change adds a Simplified-only character to Traditional Chinese text |
| Broker CI actions | One-repository Broker exchange, independent path-aware source credentials, and top-level-identity image/red-main adapters |
| git-app-credentials | Creates a job-scoped GitHub App token for private git and cargo fetches |
| cache-toolchain | Dependency cache keyed per toolchain (cargo, bun, npm, pnpm, gradle, unity) |
| run-store | Hands a file or directory between the jobs of a run through the BuildCache gateway, keyed by run id; CI never depends on GitHub artifact storage |
| setup-keel-tools | The keel CLI at the title's KEEL_PIN and the wasm-bindgen CLI at its Cargo.lock version, cached per pin so a warm run takes seconds |
| setup-sylphx-cli | Installs a pinned @sylphx/cli |
| setup-changesets-publisher | Installs the Changesets publish command used by release workflows |
Reusable workflows are in .github/workflows; the CI fast-path recipe (changes.yml, cache-toolchain, ci-fast-path starter) is docs/ci-template.md.
disarm-auto-merge-on-push clears an
arm predating a new push without dequeuing an entry already on that head.
The image lane accepts source-sha for post-verification dispatches. Pass the
verified commit both as source-sha and tag; checkout and build evidence bind
that commit even when the dispatch runs after main advances. An omitted
source-sha keeps the triggering commit as the source.
The image lane's promotion digest is the authenticated Docker-Content-Digest
from a manifest HEAD using the OCI/Docker index and manifest types accepted by
the runtime. It then reads that exact digest and verifies its bytes before
comparing the published content with the local OCI layout. A separately
negotiated skopeo --raw response is not a promotion identity: an index and its
child manifest can expose the same image content but have different digests.
Missing headers, an unreadable digest, or inconsistent identity/content fail
publication readback; the scoped publisher credential never appears in logs.
The same credential helper supports declared read-only CI consumers with
--identity github-oidc --actions pull; see
registry pull credentials. The default remains
the existing publisher's pull,push request.
Company repositories delete a pull request's head branch when it merges
(delete_branch_on_merge=true). The policy and the script that applies it are
in docs/repository-settings.md and
scripts/set-delete-branch-on-merge.sh.
Shared branch integrity is inherited from Enterprise. The property-scoped ci-ok
rule remains organization-level because the Enterprise API refused the candidate.
Current scope, source payloads and the migration constraint are in
Enterprise repository rules. Merge queues remain
repository-level policy (settings).