Roadmap: LibreCode shared GitHub workflow platform

[vitormattos]

Goal

Build a shared GitHub Actions platform for LibreCode/LibreSign with reproducible upstream imports, a GitHub-native organization catalog, explicit downstream adaptations, safe consumer updates and tested security controls.

Final architecture

Nextcloud / selected upstreams
        ↓
immutable source commit + SHA-256
        ↓
vendored source
        ↓
minimal LibreCode organization patch
        ↓
generated workflow template
        ↓
tests + actionlint + zizmor + workflow policy
        ↓
LibreCodeCoop/.github catalog
        ↓
consumer-local sync-workflow-templates.yml
        ↓
actions/sync-workflows
        ↓
optional consumer-local <workflow>.patch
        ↓
actions-lock.txt + reviewable PR

LibreCodeCoop/github-workflows is the source of truth.

LibreCodeCoop/.github is the catalog/distribution layer.

Consumers own product-specific patches, credentials, branch policy and the review/merge decision.

Completed workstreams

• Publish workflow catalog to LibreCodeCoop/.github and validate first consumer #7 — publish the catalog and validate real consumers;
• Automate workflow catalog publication to LibreCodeCoop/.github #12 — automate catalog publication;
• Automate consumer workflow synchronization and update PRs #13 — automate reviewable consumer updates;
• Validate workflow update failure and recovery paths end to end #14 — validate failure and recovery paths end to end;
• Migrate Nextcloud-derived workflow families incrementally #15 — complete migration decisions for evaluated workflow families;
• Define template versus reusable workflow adoption rules #16 — define the template/Action/reusable-workflow decision model;
• Configure cross-repository credential for workflow automation #20 — configure scoped GitHub App automation credentials;
• Create reusable action for consumer workflow synchronization #52 — extract deterministic consumer synchronization into a reusable Action;
• Define shared GitHub Actions security policy checks #6 — define and enforce the shared Actions security policy;
• Define shared policy for dependency update and auto-merge workflows #34 — define dependency update and auto-merge policy.

Production validation

The materialized consumer-sync model has been exercised in:

• LibreCodeCoop/extract;
• LibreCodeCoop/profile_fields;
• LibreSign/libresign.

The obsolete central consumers.json / sync-consumers.yml architecture has been removed.

Definition of done

• developers can discover versioned workflow templates through the organization catalog;
• consumers keep normal local workflow files;
• future updates arrive as reviewable pull requests;
• organization and consumer differences are explicit patches;
• unexplained local divergence is never silently overwritten;
• upstream refreshes are reproducible and avoid pin-only noise;
• workflow security rules are enforced in CI;
• privileged dependency/release workflows have explicit distribution and credential decisions.

The initial shared GitHub workflow platform roadmap is complete. Future workflow families or policy extensions should be tracked as new focused issues rather than keeping this bootstrap roadmap open.