Zondax GitHub Actions

Reusable composite GitHub Actions for Zondax / Kunobi CI. Prefer these over ad-hoc workflow copy-paste.

Repository: github.com/Zondax/actions

Upgrading consumers? See MIGRATION.md for the post-#23–#28 train (setup-mise, setup-node-env, WIF, sign-*, react-doctor).

Canonical mise bootstrap (cache + shims on PATH).

- uses: zondax/actions/setup-mise@v1

Node + one package manager via mise. Optionally install deps / run env:init:ci.

- uses: zondax/actions/setup-node-env@v1
  with:
    node_version: '24'
    package_manager: 'pnpm'
    pnpm_version: '10'
    install_deps: true

Outputs: pm, pm_run, node_version.

Checkout with optional GitHub App token + safe.directory hardening.

- uses: zondax/actions/checkout-with-app@v1
  with:
    github_app_auth: true
    app_id: ${{ secrets.APP_ID }}
    app_pem: ${{ secrets.APP_PEM }}
    fetch_depth: 0

Optional Init7/mirror config + apt install helpers.

- uses: zondax/actions/setup-ubuntu-packages@v1
  with:
    packages: |
      - build-essential
      - pkg-config

Workload Identity Federation via a single google-github-actions/auth step.

- uses: zondax/actions/gcp-wif-auth@v1
  with:
    workload_identity_provider: ${{ vars.WIF_PROVIDER }}
    project_id: ${{ vars.GCP_PROJECT_ID }}
    service_account: ${{ vars.GCP_SA }}   # optional
    token_format: access_token            # when you need access_token output

Time-based gate before publishing (artifact / release age).

- uses: zondax/actions/release-hold@v1
  with:
    hold_period: '30'
    anchor: release-asset

CLI-owned React Doctor scan (mise-installed, configurable gate).

- uses: actions/checkout@v7
  with:
    fetch-depth: 0
- uses: zondax/actions/react-doctor@v1
  with:
    version: '0.9.11'
    blocking: none    # none | error | warning
    fail_on: pr       # pr | always | never

See react-doctor/README.md.

Platform code-signing (GCP KMS / Secret Manager / jsign / rcodesign).

• Prefer snake_case inputs; kebab-case aliases still work for existing Kunobi workflows.
• Linux/macOS compose ./gcp-wif-auth + ./setup-mise from the same tag.
• See each action’s action.yml for inputs.

# Linux OpenPGP (KMS)
- uses: zondax/actions/sign-linux-binary@v1
  with:
    target_path: dist/app.tar.gz
    # or legacy: target-path: dist/app.tar.gz
    workload_identity_provider: ${{ vars.PGP_SIGN_WIF_PROVIDER }}
    gcp_project_id: ${{ vars.PGP_SIGN_GCP_PROJECT_ID }}
    signer_token: ${{ steps.app.outputs.token }}
    kms_key: ${{ vars.PGP_SIGN_KMS_KEY_VERSION }}
    cert_base64: ${{ secrets.PGP_CERT_BASE64 }}

S3/MinIO rclone helper (cache/copy/sync). CI workflow is currently disabled (test-rclone.yml.disabled) — treat as best-effort until re-enabled. See rclone/README.md.

1. Land changes on main.
2. Tag vX.Y.Z (semver; breaking input removals = major if we ever leave v1).
3. Move the floating major: git tag -f v1 vX.Y.Z && git push -f origin v1 (maintainers only).
4. Publish a GitHub Release with notes listing new/changed actions.
5. Consumers on @v1 pick up the floating major; pin @vX.Y.Z for hermetic builds.

git clone git@github.com:Zondax/actions.git
cd actions
# Local composite paths work in workflows under .github/workflows/

CI:

• install-node.yml — matrix Node 22/24 × package managers, setup-mise, release-hold smoke, react-doctor parser
• install-ubuntu.yml — package helper
• actionlint.yml — workflow lint