dcc-bigfred/common

Reusable GitHub Actions workflows and Go tools for the org. Pin workflow callers to tag v2. Pin Go tools with a semver tag (@v0.1.3 / @latest) — no clone of this repo required.

Workflows

Workflow	Purpose
rust-musl-ci.yml	fmt, clippy, test, musl arm64+amd64, upload binaries-{arch}
rust-release.yml	Wait for CI → optional ELF inject (go run) → GitHub Release assets
ci.yml	Go test/vet/build + shellcheck

Caller example (micronet)

# .github/workflows/ci.yml
jobs:
  ci:
    permissions:
      contents: read
    uses: dcc-bigfred/common/.github/workflows/rust-musl-ci.yml@v2
    with:
      binaries: |
        [
          {"name":"configure-dhcp","dist":"configure-dhcp-linux"},
          {"name":"configure-ethernet","dist":"configure-ethernet-linux"}
        ]

# .github/workflows/release.yml
jobs:
  release:
    permissions:
      contents: write
    uses: dcc-bigfred/common/.github/workflows/rust-release.yml@v2
    with:
      elf_binaries: configure-dhcp-linux-arm64,configure-ethernet-linux-arm64
      elf_section: .micronet.version
    secrets: inherit

Go tools

cmd/fetch

go run github.com/dcc-bigfred/common/cmd/fetch@latest \
  --repo=dcc-bigfred/micronet \
  --artifact=binaries-arm64 \
  --files='configure-dhcp-linux-arm64:bin/configure-dhcp,configure-ethernet-linux-arm64:bin/configure-ethernet' \
  main /tmp/out.tar

Tip refs (main/master/sha-*) → Actions artifact (token required). latest-release / v* → GitHub Release assets.

Token env: BIGFRED_NATIVE_TOKEN / GH_TOKEN / GITHUB_TOKEN.

cmd/inject-elf-version

go run github.com/dcc-bigfred/common/cmd/inject-elf-version@latest \
  path/to/binary v1.2.3 abc1234 .micronet.version

Requires objcopy (binutils). Writes JSON {"version":"…","commit":"…"} into the named ELF section (section name must start with .).

cmd/minisign-sign

go run github.com/dcc-bigfred/common/cmd/minisign-sign@latest \
  release-assets/foo-linux-arm64

Requires minisign on PATH. Env: MINISIGN_SECRET_KEY (required), MINISIGN_PASSWORD (optional), MINISIGN_PUBLIC_KEY (default ./minisign.pub). Signs each file to <file>.minisig and verifies against the public key (fail-closed).

Out of scope

• microinit distroless / Docker image publish (stays in microinit repo)
• ORAS / GHCR binary distribution (removed in v2)