Reusable CI Workflows

This repository contains reusable GHA workflows for Medrunner projects. The workflows are published as the v1 contract for API, bot, and standalone site repositories.

See the workflow catalog for permissions, environments, outputs, and side effects. See the consumer templates for copy-ready API, MED, and MOD caller workflows. See Node sites and Cloudflare Pages for PR validation and simple versioned build/deploy delivery.

Local validation

Run the inline Pages/Node workflow contract tests:

npm ci
npm test

Production delivery logic stays in workflow steps; the JavaScript files under tests/ only exercise those steps locally. No helper script is distributed to consumer repositories.

Run static workflow validation:

rtk docker run --rm -v "${PWD}:/repo" -w /repo rhysd/actionlint:1.7.12

Run the Docker-backed Test and Dockerfile smoke suite:

rtk act -P ubuntu-latest=catthehacker/ubuntu:act-latest -W tests/fixtures/workflow-contract/node-local.yml workflow_dispatch -e tests/fixtures/events/workflow_dispatch.json --container-architecture linux/amd64
rtk act -P ubuntu-latest=catthehacker/ubuntu:act-latest -W tests/fixtures/workflow-contract/pnpm-local.yml workflow_dispatch -e tests/fixtures/events/workflow_dispatch.json --container-architecture linux/amd64
rtk act -P ubuntu-latest=catthehacker/ubuntu:act-latest -W tests/fixtures/workflow-contract/dotnet-local.yml workflow_dispatch -e tests/fixtures/events/workflow_dispatch.json --container-architecture linux/amd64
rtk act -P ubuntu-latest=catthehacker/ubuntu:act-latest -W tests/fixtures/workflow-contract/container-public-local.yml workflow_dispatch -e tests/fixtures/events/workflow_dispatch.json --container-architecture linux/amd64
rtk act -P ubuntu-latest=catthehacker/ubuntu:act-latest -W tests/fixtures/workflow-contract/container-private-local.yml workflow_dispatch -e tests/fixtures/events/workflow_dispatch.json --container-architecture linux/amd64 --secret NODE_AUTH_TOKEN=fixture-token

Run the deterministic stable-tag ancestry checks:

rtk bash tests/fixtures/git/release-stable-reachable.sh
rtk bash tests/fixtures/git/release-stable-needs-backprop.sh

The complete suite passed locally on 2026-09-21. act verifies Test and Dockerfile build paths only. Semantic release, protected environments, GHCR publishing, PR creation, approval, and auto-merge intentionally remain outside local execution.