.github

Org-wide community-health defaults for Selamy Labs. GitHub applies these to any repository in the org that does not provide its own:

• CONTRIBUTING.md — how to contribute (PR-only, Conventional Commit titles, tests + coverage, privacy-clean).
• SECURITY.md — how to report a vulnerability privately.
• .github/PULL_REQUEST_TEMPLATE.md — the PR checklist.
• .github/ISSUE_TEMPLATE/ — bug report + feature request forms.

A repository overrides any default by adding its own copy of the file.

Reusable workflows

This repo also hosts org-wide reusable GitHub Actions workflows. Define CI once here, call it from each repo with a tiny caller workflow.

• .github/workflows/python-ci.yml — lint + test + coverage for Python repos.
• .github/workflows/black-check.yml — standalone Black format check for repos that need an explicit black --check --diff . gate.
• .github/workflows/vulture-check.yml — standalone Vulture dead-code check for repos that need an explicit vulture . --min-confidence 80 gate.
• .github/workflows/buf-lint-breaking.yml — standalone Buf lint and breaking-change check for protobuf repos.
• .github/workflows/secret-scan.yml — PR-diff secret scanning (gitleaks CLI). Fails CI when a new commit introduces a plaintext credential; already-committed secrets do not block new PRs.
• .github/workflows/diagram-freshness.yml — PR-diff diagram-freshness ratchet. Warns, or optionally fails, when source or spec files change without a matching architecture diagram update or documented no-diagram-impact escape hatch.

The shared gitleaks ruleset lives at .gitleaks.toml.

Adopt the secret-scan gate

Add .github/workflows/secret-scan.yml to any repo:

name: Secret Scan
on:
  pull_request:
  push:
    branches: [main]
permissions:
  contents: read
jobs:
  secret-scan:
    uses: selamy-labs/.github/.github/workflows/secret-scan.yml@main
    with:
      runner: speedforge-lite

speedforge-lite is the default for Selamy Labs callers. Public or cross-org repositories must pass a runner label available to their repository. The resulting check is secret-scan / Scan. Ask an admin to mark it a required branch-protection check once it is green.

Adopt the Black format gate

Add .github/workflows/black-check.yml to any repo:

name: Black Check
on:
  pull_request:
  push:
    branches: [main]
permissions:
  contents: read
jobs:
  black-check:
    uses: selamy-labs/.github/.github/workflows/black-check.yml@main

The resulting check is black-check / Check.

Adopt the Vulture dead-code gate

Add .github/workflows/vulture-check.yml to any repo:

name: Vulture Check
on:
  pull_request:
  push:
    branches: [main]
permissions:
  contents: read
jobs:
  vulture-check:
    uses: selamy-labs/.github/.github/workflows/vulture-check.yml@main

The resulting check is vulture-check / Check. Repos with intentional false positives can pass allowlist: .vulture_allowlist.py.

Adopt the Buf lint and breaking-change gate

Add .github/workflows/buf-lint-breaking.yml to any protobuf repo:

name: Buf Lint and Breaking Check
on:
  pull_request:
  push:
    branches: [main]
permissions:
  contents: read
jobs:
  buf-lint-breaking:
    uses: selamy-labs/.github/.github/workflows/buf-lint-breaking.yml@main

The resulting check is buf-lint-breaking / Check. Repos with protobuf sources outside the default Buf input can pass input: proto. The default breaking baseline is origin/main, matching the default-branch ref fetched by actions/checkout.

Adopt the diagram-freshness ratchet

Add .github/workflows/diagram-freshness.yml to any repo:

name: Diagram Freshness
on:
  pull_request:
permissions:
  contents: read
  pull-requests: write
jobs:
  diagram-freshness:
    uses: selamy-labs/.github/.github/workflows/diagram-freshness.yml@main
    with:
      enforce: false

The resulting check is diagram-freshness / Check. Start public repositories with enforce: false, then flip to true after the warning signal is clean.

Set repo-specific source-globs when the defaults are too broad or too narrow:

with:
  source-globs: |
    src/**
    proto/**
    charts/**
    **/*.spec.md

The escape hatch label is no-diagram-impact. A PR using it must also include a single body line in this format:

Diagram impact: none - <reason>