setup-ci

CI/CD Standards

Universal conventions that apply across all languages. For language-specific CI jobs, build matrices, and caching, see the corresponding scaffold-* skill.

Workflow Naming Convention

File	Trigger	Purpose
ci.yml	pull_request: branches: [main] + workflow_call	Quality gate: fmt, lint, test
release.yml	push: branches: [main] + workflow_dispatch	Automated releases

• No build.yml or publish.yml build and publish are jobs within release.yml
• Specialized workflows allowed for domain-specific needs (e.g., experiments.yml)
• Exception: Terraform uses a single terraform.yml (see scaffold-terraform)

Pipeline Flow

PR -> ci.yml (fmt -> lint -> test)
Push main -> release.yml:
  fsrc -> ci -> sr release -> build -> publish -> teasr

sr v9+ syncs lock files (Cargo.lock, uv.lock, poetry.lock, package-lock.json) during the version bump and commits them in the release commit, so release.yml needs no separate lock sync step or [skip ci] lock commit. See sync-release for details.

Release Config

• Canonical filename: sr.yaml (not .urmzd.sr.yml)
• floating_tags: true in all configs
• tag_prefix: "v" and Angular commit pattern
• See sync-release for full sr.yaml reference

Concurrency

# CI workflows: cancel stale runs
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Release workflows: never cancel mid-release
concurrency:
  group: release
  cancel-in-progress: false

Bot Skip

Prevent infinite loops from bot commits:

if: github.actor != 'sr[bot]'

CI Reuse Pattern

ci.yml exposes workflow_call so release.yml can gate on it:

# ci.yml
on:
  pull_request:
    branches: [main]
  workflow_call:

# release.yml
jobs:
  ci:
    uses: ./.github/workflows/ci.yml
  release:
    needs: ci

App Token Pattern

Release workflows use a GitHub App for bot commits that can trigger further workflows: