@theholocron/.github

Org-level community health files, reusable CI workflows, and workflow templates.

Using reusable workflows

Any public repo can call these workflows directly. A full CI setup is a handful of thin caller files in .github/workflows/:

# .github/workflows/lint.yml
name: Lint
on: [push, pull_request]
permissions:
  contents: write
  statuses: write
jobs:
  lint:
    uses: theholocron/.github/.github/workflows/lint.yml@main
    secrets: inherit

For theholocron repos the recommended approach is holocron setup, which writes and maintains these files automatically from holocron.config.json.

Available workflows

Workflow	Trigger	Purpose
lint.yml	push + PR	super-linter CI gate — Prettier, YAML, ESLint configs, Gitleaks, ActionLint
test.yml	push + PR	vitest + Codecov coverage upload
typecheck.yml	push + PR	pnpm typecheck (tsc --noEmit)
codeql.yml	push/PR to main + weekly	CodeQL security scan (javascript-typescript)
review.yml	PR only	ReviewDog annotation layer — ESLint, tsc, ShellCheck, Hadolint, ActionLint, Gitleaks, YamlLint, dotenv-linter, Alex
release.yml	push to main	semantic-release + OIDC Trusted Publishing (no NPM_TOKEN needed)
stale.yml	daily schedule	marks stale issues/PRs
greetings.yml	PR + issues	first-time contributor welcome message
dependencies.yml	PR	Dependabot auto-merge for semver-patch updates
bookkeeping.yml	PR opened/edited	labels PRs from Conventional Commit title (fix: → bug, feat: → enhancement, etc.)
audit.yml	push + PR	BundleWatch bundle size analysis

Each workflow accepts inputs to customise behaviour — see the workflow files in .github/workflows/ for the full input/secret declarations.

Composite actions

Reusable action steps callable from any workflow:

- uses: theholocron/.github/.github/actions/setup@main

Action	Purpose
setup	Orchestrates setup-node + install in one step
setup-node	pnpm + Node 22 with pnpm dependency caching
install	pnpm install --frozen-lockfile

Workflow starter templates

The workflow-templates/ directory powers the "By your organization" section in GitHub's Actions → New workflow UI. Every template is a thin caller of the matching reusable workflow above — repos that adopt a template get the same logic as repos that use holocron setup.

holocron setup

For theholocron repos, the CLI manages everything from a holocron.config.json at the repo root:

{
  "project": {
    "name": "my-project",
    "repo": "theholocron/my-project",
    "repoPolicy": {
      "preset": "strict",
      "requiredChecks": ["Lint entire codebase", "Run tests and collect coverage", "tsc --noEmit"]
    },
    "workflows": ["lint", "test", "typecheck", "codeql", "review", "release"]
  },
  "providers": {
    "vault": ["doppler", { "project": "my-project", "config": "dev" }],
    "source": "github",
    "ci": "github",
    "secrets": "github"
  }
}

Running pnpm holocron setup (or npx @theholocron/cli setup) will:

• Enable all GitHub security features (Dependabot, secret scanning, CodeQL, etc.)
• Apply repo settings (squash-only merges, auto-merge, no wiki, etc.)
• Create branch protection rulesets with the configured required checks
• Write thin workflow caller files to .github/workflows/
• Provision .github/dependabot.yml with grouped update configuration
• Sync repo labels to the canonical set (create missing, fix drift, delete stale)

See theholocron/holocron for the full CLI docs.

Labels

Every repo in the org uses the same label set, applied and kept in sync by holocron setup. The bookkeeping workflow maps Conventional Commit title prefixes to these labels automatically.

Label	Color	Description	Auto-applied from
bug	d73a4a	Something isn't working	fix:
chore	ededed	Maintenance, no user-facing change	chore:
ci	0075ca	CI/CD pipeline changes	ci:
dependencies	0366d6	Dependency update	chore(deps): / Dependabot
documentation	0075ca	Documentation only	docs:
duplicate	cfd3d7	Already reported	—
enhancement	a2eeef	New feature or request	feat:
good first issue	7057ff	Good for newcomers	—
help wanted	008672	Extra attention needed	—
invalid	e4e669	Doesn't seem right	—
performance	fbca04	Performance improvement	perf:
question	d876e3	Further information requested	—
refactor	cfd3d7	Code restructuring	refactor:
released	ededed	Included in a release	—
test	bfd4f2	Test-related changes	test:
triage	e4e669	Needs investigation	—
wontfix	ffffff	Won't be addressed	—

The canonical set is defined in CANONICAL_LABELS in theholocron/holocron. To change a label, edit that constant and open a PR — the next holocron setup run in each repo picks up the change.

Source of truth

The workflow and action files in this repo are generated from theholocron/holocron — do not edit them directly here. To update a workflow:

1. Edit packages/cli/src/templates/workflows/<name>.yml in holocron
2. Push to alpha — the sync-github CI workflow opens a PR here automatically

Community health files (CONTRIBUTING.md, CODE_OF_CONDUCT.md, issue templates, CODEOWNERS, labeler.yml, etc.) are hand-maintained in this repo directly.