central_ci

Reusable Forgejo Actions workflows shared across HomeIoT / BHK projects.

Repo: faicel/central_ci

Layout

Path	Role
.forgejo/workflows/validate_flow.yml	PR branch flow (*→dev, dev→staging, staging→main)
.forgejo/workflows/check_version_sync.yml	Cargo.toml ↔ CHANGELOG.md version gate
.forgejo/workflows/rust_crate_checks.yml	fmt, clippy, machete, deny, version sync, tests
.forgejo/workflows/deploy_job_tracker.yml	Stub / WIP
scripts/check-version-sync.sh	Same logic as the workflows (local / copy into crates)

The reusable workflows inline the version-sync shell so callers do not need read access to check out central_ci as a second repository (works across orgs with one PAT).

Companion image

Rust jobs expect the shared toolchain image:

code.bhk-itsolutions.com/homeiot/ci-rust-embedded:rust-1.97.0

(needs node for actions/checkout, plus cargo-deny / cargo-machete).

Usage — version sync only

jobs:
  version:
    uses: faicel/central_ci/.forgejo/workflows/check_version_sync.yml@main
    secrets:
      RUNNER_TOKEN: ${{ secrets.RUNNER_TOKEN }}

Usage — full Rust crate checks

jobs:
  checks:
    uses: faicel/central_ci/.forgejo/workflows/rust_crate_checks.yml@main
    secrets:
      RUNNER_TOKEN: ${{ secrets.RUNNER_TOKEN }}

  publish:
    needs: checks
    runs-on: docker
    # tag + cargo publish stay in the consumer workflow

Optional inputs (see workflow files for defaults):

• ci_image — override the container image tag
• working_directory — crate subdirectory
• enable_deny / enable_machete / enable_version_sync
• test_command — default cargo test

Local test of the version-sync script

chmod +x scripts/*.sh
./scripts/test-check-version-sync.sh

Version sync convention

Consumer crates must keep these equal:

1. Cargo.toml → version = "x.y.z"
2. CHANGELOG.md → top heading ## [x.y.z] - YYYY-MM-DD

Security note

Prefer pinning @vX.Y.Z (or a commit SHA) instead of @main once you tag releases of central_ci. Protect .forgejo/**/*.yml on consumer main branches (Forgejo Protected file patterns).