Workflows¶

Pin a workflow to a release SHA, not @main, in production. Versioning covers tags.

Inputs and defaults are on one page per family:

Workflow	Checks
`cpp-quality.yml`	clang-tidy, cppcheck, clang-format, flawfinder, ASan/UBSan, TSan, coverage, IWYU, hardening, file naming, banned patterns
`infra-lint.yml`	ShellCheck, Hadolint, cmake-lint, dangerous-workflow audit, binary-artifact scan, Gitleaks
`python-quality.yml`	ruff/flake8, pytest, diff-cover
`sast-python.yml`	Semgrep, pip-audit, CodeQL
`fuzz.yml`	ClusterFuzzLite; skipped without `.clusterfuzzlite/Dockerfile`
`sbom.yml`	Syft container SBOM, source dependency scan, Grype, license check
`version-check.yml`	SemVer in package.xml, CMakeLists.txt, pyproject.toml
`auto-release.yml`	Conventional-commit version bump, git tag, GitHub Release, SLSA provenance
`trend-dashboard.yml`	Weekly pass-rate report, optional Slack and Discussions posting
`version-sync.yml`	Sync opt-in version files (CMakeLists.txt, pyproject.toml, package.xml, package.json, `GIT_TAG` in a caller's README) to a release tag; this repo enables only pyproject.toml
`cis-compliance.yml`	CIS supply-chain scan of one repo
`cis-org-compliance.yml`	CIS supply-chain scan across an org
`compliance.yml`	Scan an org for standard-ci drift, optionally open update PRs
`install-test.yml`	Install the package and check `find_package` from a consumer
`pre-commit.yml`	Run pre-commit hooks in CI
`scheduled-health.yml`	Open an issue when a scheduled upstream workflow fails
`release.yml`	This repo only: triggers auto-release and version-sync on push to main

Composite actions for single steps live in actions/: diff-files, clang-tidy, cppcheck, clang-format, ruff-check, shellcheck, gitleaks, gdlint, ts-naming, layering. Use one as PavelGuzenfeld/standard/actions/<name>@<sha>. ruff-check and the ruff mode of python-quality need a diff-cover that lists the ruff.check driver; Python 3.8 cannot install one (diff-cover 9.2.0 has none), and the lint step fails with an error saying so. ruff-check defaults ruff_version to 0.16.9 and picks diff_cover_version by Python version like python-quality.