actions

Shared GitHub Actions building blocks for Jebel Quant Research.

Two kinds of thing live here, and GitHub treats them differently:

Kind	Lives in	Consumed with
Composite actions	a top-level directory containing action.yml	uses: inside a step
Reusable workflows	.github/workflows/*.yml with a workflow_call trigger	uses: inside a job

Reusable workflows must sit in .github/workflows/ — that is a GitHub constraint, not a style choice. Composite actions can live anywhere, so they get one directory each at the top level, which keeps the uses: path short.

Composite actions

configure-git-auth

Rewrites https://github.com/ to a token-authenticated URL so uv/pip can install private packages from GitHub.

steps:
  - uses: jebel-quant/actions/configure-git-auth@v1
    with:
      token: ${{ secrets.GH_PAT }}   # optional; defaults to github.token

See its README for token scopes, the GITHUB_TOKEN fallback, and a full example workflow.

Reusable workflows

lint-actions.yml

Runs actionlint over the calling repo's workflows and validates every action.yml parses as YAML.

jobs:
  lint:
    uses: jebel-quant/actions/.github/workflows/lint-actions.yml@v1

Pinning

@v1 is the readable choice inside the org. For anything security-sensitive, pin the full commit SHA and note the tag in a trailing comment — that is how jebel-quant/rhiza pins every action it consumes, including this one:

uses: jebel-quant/actions/configure-git-auth@v1
uses: jebel-quant/actions/configure-git-auth@6d52725ca371d609489c5b50236965ad70bbe528 # v1

A cross-repo uses: is resolved at Set up job, before any step runs, so the ref must already exist when the calling workflow is pushed. Never point a workflow at a tag of its own repository that a pending release will create — that deadlocks the release, since the workflow fails before it can publish the tag it references.

Adding a composite action

1. mkdir <name> at the top level, add action.yml.
2. Give it a name: and description: — GitHub shows both in the UI.
3. Every run: step in a composite action needs an explicit shell:.
4. Document it in the table above and open a PR; CI lints it.

License

MIT — see LICENSE.