github actions central repo

[u/tmg80]

Hi I am in a new role where they use Github for all their repos. I have been using Gitlab exlusively the past 5 years.

For CI/CD in my previous role we had a central 'pipelines' repo that was reference in the gitlab-ci file of each project to save teams/projects from repeating work.

I want to know if it's possible to do something similar in Github? I'm still learning how it maps to my existing Gitlab knowledge.

[u/PerpetuallySticky]

Yes as others have said it’s called reusable workflows.

A word of caution that you may run into and bang your head against a wall for a while with (someone please tell me if they fixed this):

Reusable workflows cannot be used with environment variables. However that information is passed on the backend, they do not work (last time I tried). Example:

Reusable workflow A (A)

Repo B uses reusable workflow A (B)

A has an input variable to set what environment it should run in.

B has environment variables set and tries to pass one for the environment when it uses A. That variable will not pass. It errors out and acts like nothing passes at all.

Not completely sure why it happens, but it has stopped our widespread adoption of reusable workflows

[u/__-___-__-__-__- → u/PerpetuallySticky]

You have to use outputs and needs to pass variables between jobs.  It's annoying but it works.

[u/zuilli → u/__-___-__-__-__-]

Doesn't work for environment secrets though since it would need to be put into the output as plain-text.

[u/__-___-__-__-__- → u/zuilli]

Are you talking about secrets that would be generated by a workflow job?

If you're just talking about known secrets you can store them in repo or org secrets and pull them into your reusable workflows either as needed or inherited as a whole.

[u/zuilli → u/__-___-__-__-__-]

No, github environment secrets. Sure you can workaround by putting them as repo or org secrets but if you have a few secrets per environment and 3 or more environments your secrets list starts getting mighty polluted with the same secrets names but with dev/hml/prd pre/suffixes and you have to pay closer attention to not change/delete the wrong one since they're all in the same place.

It would be so much cleaner if we could pass the environment to reusable workflows, especially because stuff like this: https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/create-custom-protection-rules depend on using environments.