Reusable GitHub Actions Workflows

Warning

These workflows are intended solely for use by @IndrajeetPatil repositories. They are tuned to specific personal conventions and are not designed for general use. Workflows will explicitly fail if called from a repository not owned by IndrajeetPatil.

Reusable GitHub Actions workflows for IndrajeetPatil repositories.

All external actions are pinned to commit SHAs to prevent supply chain attacks. The workflows default to read-only token access, disable persisted checkout credentials except for the one intentional push job, and bound every job with a timeout. Write credentials are isolated in deployment and release jobs rather than exposed while repository code and dependencies are built or tested.

The repository's only standalone workflow is security.yml. It runs on pull requests to main, scans the complete Git history with Gitleaks, and audits every workflow with zizmor in pedantic mode so future changes cannot silently weaken these controls.

Most R package workflows are check-only — they validate code but never modify or auto-commit changes. Some workflows do perform deployment or release actions, including pkgdown.yaml, which deploys the pkgdown site to gh-pages, and submit-cran.yaml, which builds and submits a source tarball before creating a GitHub Release in a separate least-privilege job.

Usage

Reference a reusable workflow from your repository:

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

jobs:
  format:
    uses: IndrajeetPatil/workflows/.github/workflows/check-formatting.yaml@<full-commit-sha>

For workflows with inputs:

jobs:
  R-CMD-check:
    uses: IndrajeetPatil/workflows/.github/workflows/R-CMD-check.yaml@<full-commit-sha>
    with:
      hard: true

Pin reusable workflows to a full commit SHA. A branch such as @main is convenient but mutable; immutable references prevent an upstream change from silently altering a caller's CI. Callers must also grant only the permissions required by the selected workflow. GitHub can maintain or reduce permissions through a reusable-workflow chain, but a called workflow cannot elevate scopes that its caller did not grant.

Avoid secrets: inherit when a workflow needs only one named secret. Pass that secret explicitly so unrelated repository or organization secrets are not made available to the called workflow.

Python Packages

Workflow	Description	Inputs
python-docs.yaml	Build & deploy Python package documentation to GitHub Pages	—
python-qa.yaml	Code Quality checks, including build, test coverage, and README render	—
python-test.yaml	Run Tests across multiple OS and Python versions	—

R Packages

Workflow	Description	Inputs
check-docs.yaml	Check for broken links using lychee and spelling using typos	—
check-formatting.yaml	Check and suggest code formatting using air	—
R-CMD-check.yaml	R CMD check across multiple OS/R versions; use hard: true for a hard-deps-only CI check (PR-only)	extra-packages, hard
check-extra.yaml	Parallel extra checks: no-warnings, random test order, README render	extra-packages
lint.yaml	Package linting with {lintr}	—
pkgdown.yaml	Build & deploy a pkgdown site with verified canonical URLs; use no-suggests: true for a hard-deps-only CI check	no-suggests
pre-commit.yaml	Run pre-commit hooks; fails if hooks would modify files	—
seo-files.yaml	Deploy SEO and AI-discovery files (robots.txt, .well-known/llms.txt) to gh-pages after pkgdown build	package-name
submit-cran.yaml	Build and submit a source tarball to CRAN, then create a GitHub Release	extra-packages
test-coverage.yaml	Two parallel coverage jobs: unit tests (enforces 100%) + examples/vignettes (enforces 100%)	—

Presentations

Workflow	Description	Inputs
build-presentation-python.yaml	Build & deploy Python/UV Quarto RevealJS presentation to GitHub Pages	—
build-presentation-r.yaml	Build & deploy R Quarto RevealJS presentation to GitHub Pages	—

Generic

Generic workflows are language-agnostic and provide utility across diverse types of projects, ensuring high code quality and robust documentation regardless of the underlying tech stack.

Workflow	Description	Inputs
check-link-rot.yaml	Check for broken links using lychee	—

License

MIT