Workflow catalog

This catalog describes the workflow files in the current checkout. It does not assert that remote jobs have run successfully. GitHub Actions supplies the hosted events, permissions, runners and artifact transport. The Ansible process adapter delegates four engineering controls to Lua; the reusable lint workflow retains the resulting requirement evidence graph.

On this page

Checks and campaigns
Hosted services and publication
Process pilot
CICD-001: Events and selection
CICD-002: Required results

Checks and campaigns

Paths in the command column are repository entry points. Follow the linked runbook for arguments, required tools and evidence handling. Local adapters reproduce their stated work, not the entire hosted workflow.

Workflow	Hosted entry point	Local commands or guide	Environment and coverage
documentation.yml	PR, merge queue, default-branch push and manual execution.	lua scripts/documentation/main.lua build; documentation guide.	Read-only validation and full Doxygen build; separate default-branch Pages deployment.
ci.yml	Push, PR, merge group, manual, reusable call	Local checks	Selects reusable checks and campaigns; CI gate reconciles required jobs.
_lint.yml	Reusable call	scripts/check/c.lua, scripts/check/lua.lua, scripts/check/doc_examples.lua, scripts/check/mermaid.lua, scripts/check/sdd.lua; documentation checks	Declared lint tools; languages, configuration, examples and diagrams. Native Ansible bootstrap, tools, cleanup, builds and documentation on macOS ARM and Intel.
_spelling.yml	Reusable call	scripts/check/links.lua; spelling tools from the workflow	CSpell, codespell, typos, Vale and links.
_reuse.yml	Reusable call	reuse lint with repository configuration	SPDX and license metadata.
specifications.yml	Issue label events and manual execution.	Specification procedure.	Trusted default-branch metadata reconciliation; maintainer roster and current write permission.
commit-policy.yml	Push, PR, manual, reusable call	lua scripts/check/commits.lua REVISION	Git history and commit policy; hosted signature checks have additional context.
build-matrix.yml	Manual, reusable call	scripts/build/plan.lua, build.lua, report.lua; build guide	Profile-specific Linux, macOS and Windows workers; mock compatibility matrix.
build-nightly.yml	Schedule, manual	Build and qualification guides	Coordinates extended and clean campaigns.
qualification.yml	Manual, reusable call	scripts/qualification/plan.lua, scripts/qualification/batch.lua, scripts/qualification/report.lua; qualification guide	Producer/consumer artifacts, mock semantics, instrumentation and PGO.
_qualification-batch.yml	Reusable call	scripts/qualification/dependencies.lua, scripts/qualification/batch.lua	Prepared worker with its producer artifacts; preserves per-case records.
_c-analysis.yml	Reusable call	scripts/analysis/run.lua, scripts/check/c_analysis.lua, scripts/check/msvc.lua; C analysis	Campaign tools and native MSVC host where required.
c-analysis-nightly.yml	Schedule, manual	C analysis	Invokes the reusable extended analysis workflow.
reproducible.yml	Schedule, manual, reusable call	scripts/reproducible/; reproducibility	Independent packages, comparisons, environment variations and normalizers.
openssf.yml	Schedule, manual	scripts/security/plan.lua, scripts/security/run.lua, scripts/security/report.lua	Adapter-specific tools and service prerequisites; explicit blockers.
_release-checks.yml	Reusable call	scripts/release/build.lua --mock, verify.lua, check_schemas.lua; fixture guide	Mock builds, evidence validation, negative tests and Conan packages.

Hosted services and publication

Workflow	Hosted entry point	Purpose and boundary
security.yml	Push, PR, schedule, manual, reusable call	Workflow/dependency audit, secret scanning and optional gittuf policy. Individual tools can run locally with their prerequisites.
codeql.yml	Push, schedule, manual, reusable call	CodeQL database capture, queries and hosted result upload; no process-pilot adapter.
scorecard.yml	Schedule, manual	Repository assessment and SARIF upload; public Scorecard API publication remains disabled in the workflow.
renovate.yml	Schedule, manual	Dependency pull requests with scoped credentials. Runs as a hosted service.
release.yml	Published release	Validation, source packaging, protected signing and authorized mock-channel publication. No manual-dispatch entry point.

Reusable-only workflows need a caller. Workflows with manual dispatch can run through the Actions interface when available on the appropriate repository branch and with the required permissions. Local commands do not replace protected environments, OIDC identity or publication authorization.

Process pilot

The process pilot runbook documents scripts/process/main.lua with plan, run, gate, report and campaign subcommands, plus infra/ansible/playbooks/prepare.yml and verify-environment.yml. The local profile executes four controls. _lint.yml invokes the same process-ci task through Ansible; phase ordering and evidence validation live in Lua. Track additional adapters and protected promotion in the gap register.

CICD-001: Events and selection

Class: CORRECTNESS. Obligation: project requirement.

Run CI on pushes, pull requests, merge groups, manual dispatches, and reusable workflow calls. The change detector selects affected checks on ordinary branch changes. Default-branch pushes, merge groups, manual runs, tags, and releases force the full selection. REUSE runs independently of the selection. PRs use the bounded build and qualification campaigns described in their runbooks. Manual runs, merge groups and default-branch pushes select integration builds and the broad qualification campaign; tags/releases select release qualification.

Treat detection failure as a failure, not an empty diff. Test rename, deletion, shared configuration, and language detection behavior before changing the detector. Keep Python detection and its lint job: repository-owned scripts are Lua, but Python source introduced elsewhere still requires validation. HTML, CSS, JavaScript and TypeScript have separate change categories; the web job runs only selected languages with indexed sources. See the web checker and tool graph.

Evidence: entry workflow and detector tests.

flowchart TD
    Event[Push / PR / merge group / manual / reusable call] --> Changes[Detect affected areas]
    Full[Default branch / merge group / manual / tag / release] -->|Force all| Changes
    Changes --> Lint[Reusable lint jobs]
    Changes --> Spell[Spelling and prose selection]
    Event --> Reuse[REUSE]
    Changes -->|engineering| Fixture[Release contract / build / qualification / reproducibility]
    Changes -->|c| Analysis[C analysis]
    Changes --> Gate[CI gate: inspect all required results]
    Lint --> Gate
    Spell --> Gate
    Reuse --> Gate
    Fixture --> Gate
    Analysis --> Gate
    Gate --> Result{Required results accepted?}
    Result -->|Yes| Pass[Success]
    Result -->|No| Fail[Failure]

CICD-002: Required results

Class: CORRECTNESS. Obligation: project requirement.

The stable CI gate runs with always() and evaluates the executable acceptance contract. Detection, lint and REUSE must succeed. Engineering campaigns must succeed when engineering is true and must be skipped otherwise. Selected spelling and C analysis must succeed; their unselected reusable workflows may report success or skipped. Every cancellation, failure, unknown result or missing detector output fails the gate.

Job	Selection	Selected result	Unselected result
changes	Always	success	N/A
lint	Always	success	N/A
reuse	Always	success	N/A
spelling	SPELLING_CHANGED	success	success or skipped
c-analysis	C_CHANGED	success	success or skipped
release-checks	ENGINEERING_CHANGED	success	skipped
build-matrix	ENGINEERING_CHANGED	success	skipped
qualification	ENGINEERING_CHANGED	success	skipped
reproducibility	ENGINEERING_CHANGED	success	skipped

Regression tests exercise all detector combinations and verify the workflow's dependencies, result bindings and this generated table against that same contract.

Branch protection must require this result, commit policy, and the security results relevant to the branch. Repository files do not configure those settings. A maintainer must verify the required check names and a failing pull request in GitHub before describing merge protection as enforced.

Do not use continue-on-error to hide a required finding. Optional diagnostics must have separate names and must not satisfy a required gate.