rsd-github-actions

Central repository for shared GitHub Actions and workflows used across RSD projects.

Consuming actions

Reference actions with the floating major version tag so downstream repos automatically pick up new v1.x.x releases:

- name: Validate Packages
  uses: DFE-Digital/rsd-github-actions/.github/actions/validate-packages@v1
  with:
    environment: ${{ needs.set-env.outputs.environment }}

GitHub Actions does not support wildcard refs such as @v1.*. The @v1 tag is maintained automatically and always points at the latest v1.x.x release.

When a major version changes (for example v2.0.0), downstream repos must update their reference manually (for example from @v1 to @v2).

Releasing a new version

1. Merge your changes to main via pull request (see Governance below).

2. Create and push an immutable semver tag:

   git tag v1.2.0
   git push origin v1.2.0

3. The Release workflow will:

   • Validate the tag format (vMAJOR.MINOR.PATCH)
   • Move the floating v1 tag to the new release (for all v1.x.x tags)
   • Publish a GitHub Release with generated release notes

First-time bootstrap

If the floating v1 tag does not exist yet, push any v1.x.x tag (or re-run the Release workflow for an existing tag) to create it.

Governance

Changes to main are protected by a repository ruleset that requires:

• Pull requests (no direct pushes to main)
• At least one approving review
• Approval from a code owner

The ruleset is defined in .github/rulesets/main-protection.json and applied by the Apply Repository Ruleset workflow.

Setup after merging these changes

1. Update CODEOWNERS — edit .github/CODEOWNERS and set the correct GitHub username(s) or team(s). See the comments in that file for the valid formats.
2. Add admin token secret — a repository admin creates a fine-grained PAT with Administration: Read and write for this repository, then adds it as a secret named RULESET_ADMIN_TOKEN under Settings → Secrets and variables → Actions.
3. Apply the ruleset — run Actions → Apply Repository Ruleset → Run workflow once (it also runs automatically when ruleset files change on main).

If you prefer not to store a PAT, a repository admin can create the same ruleset manually in Settings → Rules → Rulesets using .github/rulesets/main-protection.json as a reference.

Actions

Action	Description
validate-packages	Validates .NET package references and licenses against a central policy