public-workflows

Reusable GitHub Actions workflows (on: workflow_call) for TIOBE repositories.

This repository is public so that its workflows can be called from any TIOBE repository — private or public — without cross-repo Actions access configuration.

Rules for contributing here, in decreasing order of importance:

• Everything in this repository is world-readable. Never commit credentials, tokens, internal hostnames or URLs, or anything else that should not be public. Secrets must always be passed in by the calling repository (secrets: inherit or explicit secrets: mappings) and referenced only via ${{ secrets.* }}.
• Workflows here must only use the workflow_call trigger. They execute in the calling repository's context, with the caller's permissions and secrets — this repository itself has no secrets and runs nothing on its own.

release-publish.yml

The publish job (Nexus upload + GitHub Release attach) lifted out of TICSc/TICSpp/GawlKeeper's release.yml, byte-identical across all three except for product-name substitution — parameterized here as product-name/semver inputs instead.

Usage from a product repo:

on:
  release:
    types: [published]

permissions:
  contents: write

jobs:
  build:
    uses: ./.github/workflows/build.yml
    with:
      ref: ${{ github.event.release.tag_name }}
      package: true
    secrets: inherit

  publish:
    needs: build
    uses: tiobe/public-workflows/.github/workflows/release-publish.yml@vN
    with:
      product-name: TICSc   # TICSpp / GawlKeeper per repo
      semver: ${{ needs.build.outputs.semver }}
    secrets: inherit

Requires the calling repo to have PRIVATE_NEXUS_USERNAME/PRIVATE_NEXUS_PASSWORD secrets. Relies on the called workflow inheriting the calling workflow's github context (so github.event.release.tag_name resolves correctly even though this job itself never runs on a release trigger directly) — this is standard workflow_call behavior, not something special configured here.

elegant-checkers

Workflows shared by the elegant-common-based product repos (TICSc, TICSpp, GawlKeeper, ...): checking upstream tiobe/elegant-common releases and bumping the pinned version, plus a GitVersion variant tailored to how these repos actually version themselves.

Note: these live as flat files directly in .github/workflows/, not under an elegant-checkers/ folder — GitHub Actions does not support subdirectories under .github/workflows/ for reusable workflows (see the GitHub docs and the open feature request actions/runner#2102). "elegant-checkers" is just the grouping used in this README.

elegant-checkers-dependency-check.yml

Polls any tiobe/<dependency-name> repo (e.g. elegant-common, elegant-sdk) for its latest release tag and, if it differs from the calling repo's .<dependency-name>-version marker file, opens a bump PR.

Usage from a product repo (one job per dependency to track):

on:
  schedule:
    - cron: '0 6,18 * * *'
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  check-elegant-common:
    uses: tiobe/public-workflows/.github/workflows/elegant-checkers-dependency-check.yml@vN
    with:
      dependency-name: elegant-common
      ticket-id: '#38576'   # optional, this is the default
    secrets:
      deploy-key: ${{ secrets.ELEGANT_COMMON_DEPLOY_KEY }}
      gh-pat: ${{ secrets.GH_PAT }}

  check-elegant-sdk:
    uses: tiobe/public-workflows/.github/workflows/elegant-checkers-dependency-check.yml@vN
    with:
      dependency-name: elegant-sdk
    secrets:
      deploy-key: ${{ secrets.ELEGANT_SDK_DEPLOY_KEY }}
      gh-pat: ${{ secrets.GH_PAT }}

Unlike the other workflows in this repo, this one declares an explicit secrets: block (deploy-key, gh-pat) instead of relying on secrets: inherit — the deploy-key secret name differs per dependency (ELEGANT_COMMON_DEPLOY_KEY vs ELEGANT_SDK_DEPLOY_KEY, etc.), and GitHub Actions has no way to derive that name dynamically from the dependency-name input, so the caller maps its own correctly-named secret in explicitly. gh-pat is the existing org-level GH_PAT secret, used for a read-only lookup to resolve the release tag's commit author for bump-PR auto-assignment.

tag-pattern defaults to plain semver with no prefix (elegant-common's and elegant-sdk's shared convention); override it per dependency if a future one tags differently.

elegant-checkers-gitversion.yml

A gitversion workflow for the elegant-common product repos. Unlike the gitversion.yml variant in the (private) tiobe/workflows repo, this one:

• does not generate a GitVersion.yml inline — it relies on the calling repo's own committed GitVersion.yml at the repo root. TICSc/TICSpp/GawlKeeper each commit one with tag-prefix: 'v' and no increment override, which is load-bearing: GitVersion 6.x's default Continuous Delivery mode then bumps the patch version on every commit past the last tag on main, which is what drives "merge a commit → new version → new release" in these repos.
• outputs semVer (not fullSemVer/assemblySemFileVer), matching what build.yml in these repos already consumes downstream (Nexus targetdir, GitHub Release tag).
• runs on ubuntu-latest, not a self-hosted runner.

Usage from a product repo:

jobs:
  gitversion:
    uses: tiobe/public-workflows/.github/workflows/elegant-checkers-gitversion.yml@vN
    with:
      ref: ${{ inputs.ref || github.ref }}
  build:
    needs: gitversion
    runs-on: ubuntu-latest
    steps:
      - run: echo "SEMVER=${{ needs.gitversion.outputs.semVer }}" >> "$GITHUB_ENV"

Requires the calling repo to have its own GitVersion.yml committed at the repo root.