Ionfury Homelab Gha Pipelines

GitHub Actions Pipelines

This repository uses mise for tool version management so CI and local dev use identical versions. Delegate to Taskfile commands, not raw CLI. Follow homelab-specific conventions below; for generic GHA patterns (matrix builds, github-script, action catalog), see the global gha-pipelines skill.

Core Patterns

Tool setup — always jdx/mise-action@v3, never apt-get/brew:

steps:
  - uses: actions/checkout@v6
  - uses: jdx/mise-action@v3
  - run: task k8s:validate

Actions reference:

Path-based triggers — always include the workflow file itself and .mise.toml:

on:
  pull_request:
    paths:
      - "kubernetes/**"
      - ".github/workflows/kubernetes-validate.yaml"
      - ".mise.toml"
      - ".taskfiles/kubernetes/**"
  workflow_dispatch:

YAML schema comment on every workflow file:

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

Permissions — always minimal:

permissions:
  contents: read
  packages: write   # Only when pushing to GHCR
  statuses: read    # Only when reading commit status events

Workflow Inventory

OCI Promotion Pipeline

For full pipeline tracing and debugging, see the promotion-pipeline skill.

Key design decisions when modifying these workflows:

• Integration polls with semver >= 0.0.0-0 (accepts -rc.N); live polls >= 0.0.0 (stable only)
• tag-validated-artifact has idempotency guard — checks for existing validated-* tag before re-tagging (Flux Alerts fire on every reconciliation cycle)
• Build workflow queries GHCR for latest stable tag, bumps patch, creates next RC

New Validation Workflow Template

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: <Domain> Validate

on:
  pull_request:
    paths:
      - "<domain>/**"
      - ".github/workflows/<domain>-validate.yaml"
      - ".mise.toml"
  workflow_dispatch:

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: jdx/mise-action@v3
      - run: task <domain>:validate

Anti-Patterns

• NEVER install tools with apt-get or brew — use mise
• NEVER use raw curl/jq for GitHub API — use actions/github-script
• NEVER hardcode versions in workflow files — versions come from .mise.toml or versions.env
• NEVER use permissions: write-all — specify exact permissions needed
• NEVER skip workflow_dispatch — all workflows support manual runs

Cross-References

• .github/CLAUDE.md — Declarative workflow architecture
• promotion-pipeline skill — Debugging promotion failures
• .taskfiles/CLAUDE.md — Task commands used in workflows

Source: ionfury/homelab — distributed by TomeVault.