github/workflows v11.0.0

Call a workflow at this version with its uses: line. Every workflow here is at the same version as the scripts that a .pigeon/version of github/workflows/v11.0.0 fetches.

blog-changelog.yml

uses: noisypigeon/runway/.github/workflows/blog-changelog.yml@github/workflows/v11.0.0

Source at this tag

Inputs

Name	Type	Required	Default	Description
site_dir	string	no		Path (in the caller's checkout) to a directory holding the blog's src/, e.g. noisypigeon.com. Resolves the daily digest under <site_dir>/src/content/changelog/. Set this or src_dir, not both.
src_dir	string	no		Path (in the caller's checkout) to the Zola site root itself, e.g. web. Resolves the daily digest under <src_dir>/content/changelog/. Set this or site_dir, not both; requires changelog_path.
changelog_path	string	no		Path (in the caller's checkout) to the blog's CHANGELOG.md. Defaults to <site_dir>/CHANGELOG.md when empty; required with src_dir, which has no such default.
deploy_workflow	string	yes		Workflow filename to dispatch after committing the changelog, in deploy_repo.
deploy_repo	string	no		owner/name of the repo whose deploy_workflow to dispatch. Empty (the default) means the caller's own repo; a site workload names its Pages shim repo (LIB-0031 §6).
site_key	string	no		Optional site input to pass the dispatched workflow, for callers whose deploy workflow still multiplexes sites. Omit for a single-purpose deploy workflow (e.g. a Pages caller) that takes no such inp
changelog_tag	string	no	blog	Bracket tag on each line of the blog's own CHANGELOG.md (LIB-0034 §5).
fetch_script	string	no	.config/pigeon/tools.sh	Script (relative to the caller's repo root) that materializes library at the version the caller pins.
changelog_script	string	no	.config/pigeon/src/tools/github/scripts/root-changelog.sh	Path (relative to the caller's repo root) to root-changelog.sh, as left by fetch_script.
root_changelog_tag	string	no		Bracket tag used in the caller's root CHANGELOG.md rollup line, e.g. 'blog'. Empty (the default) skips the root rollup entirely -- what a single-site repo wants.
git_user_name	string	no	istx25
git_user_email	string	no	[email protected]

Secrets

Name	Required	Description
BOT_GITHUB_TOKEN	yes

container-image-release.yml

uses: noisypigeon/runway/.github/workflows/container-image-release.yml@github/workflows/v11.0.0

Source at this tag

Inputs

Name	Type	Required	Default	Description
version	string	yes		The version to publish, bare (X.Y.Z). Tagged X.Y.Z and X.Y.
ref	string	no		Git ref to build. Defaults to the tag v<version>.
image	string	no		Image name without a tag. Defaults to ghcr.io/<owner>/<repo>, lowercased.
context	string	no	.	Build context, relative to the caller's repo root.
dockerfile	string	no	Dockerfile	Dockerfile path, relative to the caller's repo root.
platforms	string	no	[ { "runner": "ubuntu-24.04-arm", "platform": "linux/arm64" }, { "runner": "ubuntu-24.04", "platform": "linux/amd64" } ]	JSON array of {"runner": "...", "platform": "linux/<arch>"}, one native build per entry.
build_args	string	no		Newline-separated KEY=VALUE build arguments.
smoke_test	string	no		Shell run inside each platform's image (sh -ec, entrypoint overridden) before it is pushed. A non-zero exit fails the release and nothing reaches the registry. Empty skips the check.
latest	boolean	no	true	Also move the latest tag to this version.

Outputs

Name	Description
image	The image name published to.
digest	The multi-arch index digest.

interaction-limits-renew.yml

uses: noisypigeon/runway/.github/workflows/interaction-limits-renew.yml@github/workflows/v11.0.0

Source at this tag

Secrets

Name	Required	Description
GH_ADMIN_TOKEN	yes

rust-crate-release.yml

uses: noisypigeon/runway/.github/workflows/rust-crate-release.yml@github/workflows/v11.0.0

Source at this tag

Inputs

Name	Type	Required	Default	Description
crate	string	yes		The crate's name on crates.io, e.g. pigeon-cli.
bin	string	yes		The binary's name, e.g. pigeon.
codesign_id	string	yes		Identifier for the macOS ad-hoc codesign, e.g. dev.pigeon.cli.
targets	string	yes		JSON array of build targets, each {"runner": "...", "triple": "...", "smoke_test": true|false}.
package_files	string	no	LICENSE.md	Extra files from the repo root to add to each binary tarball.
fetch_script	string	no	.config/pigeon/tools.sh	Script (relative to the caller's repo root) that materializes library at the version the caller pins.
scripts_dir	string	no	.config/pigeon/src/tools/github/scripts	Path (relative to the caller's repo root) to the library's tools/github/scripts, as left by fetch_script.

Secrets

Name	Required	Description
CARGO_REGISTRY_TOKEN	yes

Outputs

Name	Description
version	The version this run released.

site-dispatch.yml

uses: noisypigeon/runway/.github/workflows/site-dispatch.yml@github/workflows/v11.0.0

Source at this tag

Inputs

Name	Type	Required	Default	Description
site_repo	string	no		owner/name of the Pages shim repo that deploys the site. Empty (the default) reads each changed site workload's shim from its workload.yaml (LIB-0034 §3, LIB-0037 §4).
workflow	string	no		Deploy workflow filename in site_repo. Only read with site_repo; the workload.yaml mode always dispatches pages.yml (LIB-0034 §4).

Secrets

Name	Required	Description
BOT_GITHUB_TOKEN	yes

site-generate.yml

uses: noisypigeon/runway/.github/workflows/site-generate.yml@github/workflows/v11.0.0

Source at this tag

Inputs

Name	Type	Required	Default	Description
src_dir	string	yes		Path (in the caller's checkout) to the site whose generated files to commit, e.g. workloads/garden. Only changes under it are committed.
generate_cmd	string	yes		Command to run from the caller's repo root, after fetch_script, that writes the generated files under src_dir.
fetch_script	string	no	.config/pigeon/tools.sh	Script (relative to the caller's repo root) that materializes library at the version the caller pins, with every tag.
git_user_name	string	no	istx25
git_user_email	string	no	[email protected]

Secrets

Name	Required	Description
BOT_GITHUB_TOKEN	yes

site-pages.yml

uses: noisypigeon/runway/.github/workflows/site-pages.yml@github/workflows/v11.0.0

Source at this tag

Inputs

Name	Type	Required	Default	Description
spoke	string	yes		owner/name of the spoke whose workload holds the site, e.g. noisypigeon/runway.
workload	string	yes		The workload's path under the spoke's workloads/, <zone>/<workload> (LIB-0037), e.g. noisypigeon.com/blog.

site-r2.yml

uses: noisypigeon/runway/.github/workflows/site-r2.yml@github/workflows/v11.0.0

Source at this tag

Inputs

Name	Type	Required	Default	Description
src_dir	string	yes		The site workload's directory, holding its config.toml and its workload.yaml, e.g. workloads/example.com/site.
base_url	string	no		The URL to check the deployed site at, e.g. https://example.com. Empty skips the checks.
www_url	string	no		A URL that must redirect to base_url, e.g. https://www.example.com. Empty skips that check.
prepare_cmd	string	no	./.config/pigeon/tools.sh && .config/pigeon/src/tools/github/scripts/resolve-workloads.sh	Command run from the repo root before terragrunt reads state: fetching the library and generating the workload's stubs.
theme_script	string	no	.config/pigeon/src/tools/static-site/zola/resolve-theme.sh	Path (relative to the repo root) to tools/static-site/zola/resolve-theme.sh, as left by prepare_cmd.
build_cmd	string	no	zola build	Command to run (in src_dir) to build the site.
zola_version	string	no	0.23.6

Secrets

Name	Required	Description
SOPS_AGE_KEY	yes

spoke-root-changelog.yml

uses: noisypigeon/runway/.github/workflows/spoke-root-changelog.yml@github/workflows/v11.0.0

Source at this tag

Inputs

Name	Type	Required	Default	Description
precedence	string	yes		Ordered <ERE>=<tag> lines, one per line, matched against the PR's changed paths; the first line with any matching path picks the tag. Split on the last =, so the pattern may contain one and the ta
fallback_tag	string	no	repo	Tag for a PR no precedence line matches.
fetch_script	string	no	.config/pigeon/tools.sh	Script (relative to the caller's repo root) that materializes library at the version the caller pins.
changelog_script	string	no	.config/pigeon/src/tools/github/scripts/root-changelog.sh	Path (relative to the caller's repo root) to root-changelog.sh, as left by fetch_script.
git_user_name	string	no	istx25
git_user_email	string	no	[email protected]

Secrets

Name	Required	Description
BOT_GITHUB_TOKEN	yes

state-backup.yml

uses: noisypigeon/runway/.github/workflows/state-backup.yml@github/workflows/v11.0.0

Source at this tag

Inputs

Name	Type	Required	Default	Description
secrets_files	string	no		Space-separated sops dotenv files (relative to the caller's repo root) to read secrets from; every value is masked. Empty (the default) means whichever of terraform/secrets/terraform.enc and cloudflar

Secrets

Name	Required	Description
SOPS_AGE_KEY	yes

terragrunt-ack.yml

uses: noisypigeon/runway/.github/workflows/terragrunt-ack.yml@github/workflows/v11.0.0

Source at this tag

terragrunt-detect.yml

uses: noisypigeon/runway/.github/workflows/terragrunt-detect.yml@github/workflows/v11.0.0

Source at this tag

Inputs

Name	Type	Required	Default	Description
leaf_pattern	string	no	^[^/]+/terraform/|^terraform/secrets/|^workloads/[^/]+/(values|secrets)\.yaml$|^workloads/[^/]+/[^/]+/(workload|secrets\.workload)\.yaml$|^zones/[^/]+/zone\.yaml$|^zones\.yaml$|^\.env\.enc$|^	ERE matching paths that require a terragrunt run.

Outputs

Name	Description
affects-leaves	Whether the PR touches a terraform leaf ('true'/'false').

terragrunt-run.yml

uses: noisypigeon/runway/.github/workflows/terragrunt-run.yml@github/workflows/v11.0.0

Source at this tag

Inputs

Name	Type	Required	Default	Description
command	string	yes		terragrunt subcommand to run: plan or apply.
checkout_ref	string	no		git ref to check out before running. Empty (the default) means the PR's head commit: the event's own SHA on pull_request, or the SHA the API reports for the PR on issue_comment.
secrets_files	string	no		Space-separated sops dotenv files (relative to the caller's repo root) whose decrypted values are masked in the log. Empty (the default) means every terraform/secrets/*.enc that exists.
prepare_cmd	string	no		Optional command run from the caller's repo root before terragrunt -- e.g. fetching library and materializing root.hcl.
scripts_dir	string	no	.config/pigeon/src/tools/github/scripts	Path (relative to the caller's repo root) to the library's tools/github/scripts, as left by prepare_cmd's fetcher.

Secrets

Name	Required	Description
SOPS_AGE_KEY	yes
BOT_GITHUB_TOKEN	no

Outputs

Name	Description
deferred	'true' when the run left workload leaves deferred (LIB-0024).
exit_code	The run's exit code.

zola-site-pages.yml

uses: noisypigeon/runway/.github/workflows/zola-site-pages.yml@github/workflows/v11.0.0

Source at this tag

Inputs

Name	Type	Required	Default	Description
src_dir	string	yes		Path (in the checkout) to the site's src/.
repository	string	no		owner/name of the repo to build the site from. Empty (the default) means the caller's own; a Pages shim repo names the spoke whose workload holds the site (LIB-0031 §4).
ref	string	no		Ref of repository to build. Empty (the default) means the event's ref for the caller's own repo, or the default branch's head for another repo.
build_cmd	string	no	zola build	Command to run (in src_dir) to build the site.
extra_step	string	no		Optional site-specific command to run before building.
zola_version	string	no	0.23.6
terraform_docs	boolean	no	false	Install terraform-docs before extra_step -- generate-module-redirects.sh --static-root needs it for LIB-0023's schemas.
fetch_script	string	no		Optional script (relative to the caller's repo root) to run before resolving the theme -- materializes the library version this site pins.
theme_script	string	no	.pigeon/src/tools/static-site/zola/resolve-theme.sh	Path (relative to the caller's repo root) to tools/static-site/zola/resolve-theme.sh, as left by fetch_script.

Release notes are on GitHub.