act is a CLI tool that runs GitHub Actions workflows locally by simulating the GitHub Actions execution environment. It reads workflow YAML files from .github/workflows/, constructs an execution plan, and uses Docker to run containerized actions while handling environment variables, secrets, artifacts, and caching. The application features a modular architecture separating workflow parsing, expression evaluation, planning, execution, and container management. Key strengths include its expressive expression interpreter, reusable executor pattern for step orchestration, and clean abstraction for Docker/host environment execution. The tool is actively maintained with frequent updates, low technical drift due to updated dependencies, and comprehensive test coverage validating core functionality against GitHub Actions behavior.
This repository is a Python CLI tool (using Typer) that manages a community-curated list of summer internship opportunities for 2027. It ingests new/edit/bulk-inactive contributions via GitHub issue forms, validates and updates a JSON data store (`listings.json`), and regenerates categorized HTML tables embedded in README files (active, inactive, off-season). The system is tightly integrated with GitHub Actions workflows for automated processing, including linting, validation, and README updates on issue events or pushes. It features analytics commands (stats, validate, search, diff, fix) and a rule-based job category classifier. While the primary output is a data artifact (markdown tables), the core is a well-structured application that demonstrates modular design, edge-case handling, and clever use of GitHub Actions primitives (e.g., multiline output). The codebase is actively maintained with recent commits and issue triage, though it lacks unit tests and relies on hardcoded configuration values that may require periodic updates.
This repository is the source of truth for the official Node.js Docker images published on Docker Hub. It contains no application runtime code; it is a release-engineering and build-automation repo that owns three concerns: (1) template-based Dockerfile generation across Node.js major versions 22/24/26 and variants (Alpine 3.23/3.24, Debian bookworm/trixie, and slim flavors), (2) continuous detection of new Node.js releases, and (3) generation of the stackbrew manifest consumed by docker-library/official-images, which triggers the actual Docker Hub build. The generated Dockerfiles perform GPG-verified SHA-256 checksum validation of Node.js tarballs, multi-architecture dispatch (binary download where official musl/glibc builds exist, source compilation otherwise), OpenSSL header pruning to save ~34MB, apt/apk dependency minimization, and runtime smoke tests of node/npm/yarn. The core pipeline is fully automated: a GitHub Actions cron runs every 15 minutes, executing build-automation.mjs which queries nodejs.org/download/release/index.json, detects newer releases, and invokes update.sh. update.sh is the heart of the repo — a bash generator that expands three Dockerfile templates by injecting GPG release keys, architecture-to-binary switch cases, and per-major-version policy (Yarn v1 is stripped for Node >=26; rust/cargo toolchain is stripped for Node <26 since Temporal doesn't require it). When an update PR merges, official-pr.yml regenerates the stackbrew manifest via stackbrew.js and opens a PR against docker-library/official-images. A diff-aware test matrix (genMatrix.js) builds every affected Dockerfile in CI and asserts the resulting node/npm/yarn versions. Craftsmanship is strong: shell scripts are organized as a reusable utility library (functions.sh), linted with shfmt/ShellCheck and ESLint/Prettier/doctoc; GitHub Actions are pinned to commit SHAs; OpenSSF Scorecard supply-chain analysis runs; release GPG keys are synced automatically from nodejs/release-keys. The most transferable artifacts are update.sh (declarative template-to-Dockerfile generation), stackbrew.js (release-schedule-driven tag policy), genMatrix.js (diff-aware CI matrix generation), and docker-entrypoint.sh (the canonical runtime-command dispatch pattern with a documented ash/dash bug workaround). The repo is actively maintained — it tracks current Node.js 26, Alpine 3.24, and Debian 13 (trixie) — and is monolithic in structure but cohesive: a single-purpose infrastructure repo rather than a data/research project.
This repository is the official FastAPI full-stack template, providing a production-ready starter for full-stack web applications. It consists of a FastAPI backend (Python 3.14, SQLModel ORM, PostgreSQL, Alembic migrations) and a React frontend (TypeScript, Vite, TanStack Router/Query, Tailwind CSS, shadcn/ui). The template ships with complete authentication (JWT, password hashing with Argon2/Bcrypt, password recovery via email), user and item CRUD, role-based access control, and a responsive dashboard UI. Deployment is handled via Docker Compose with Traefik, and the project includes comprehensive CI/CD pipelines for testing (pytest, Playwright) and deployment (FastAPI Cloud or self-hosted). While it is a template, the code is structured for immediate extension and includes many reusable patterns such as generic CRUD utilities, email templates written in React Email, and auto-generated OpenAPI client code for the frontend. The repository is not a data research project; it is a pure application template with no data pipelines, notebooks, or ML components. It is actively maintained, with frequent commits and a strong community following.
reviewdog is a Go CLI that bridges linter output to code review platforms. It consumes diagnostic output from any linter or compiler via stdin in multiple formats — Vim errorformat, SARIF 2.1.0, Checkstyle XML, the project's own RDJSON/RDJSONL protobuf-defined format, or raw unified diff — parses it, filters findings against a code diff so only issues on changed lines get posted, and reports them to GitHub (check runs, PR reviews, annotations), GitLab MRs, Bitbucket, Gerrit, or Gitea, or writes them locally in text, RDJSON, or SARIF form. The core architecture is a set of loosely coupled Go packages: parser/ for format decoders, diff/ for unified diff parsing, filter/ for diff-aware result filtering, service/ for per-platform comment and diff API clients, cienv/ for CI context detection, and project/ for executing multi-runner .reviewdog.yml configs. The CLI entry point is cmd/reviewdog/main.go, with orchestration in reviewdog.go around the CommentService and DiffService interfaces; command flow is: subprocess or stdin -> parser -> ResultMap -> diff filter -> reporter service -> host-platform API.
ClawSweeper is a production GitHub App and CLI that autonomously reviews issues and pull requests across OpenClaw repositories, writes durable markdown reports with YAML front matter, applies conservative close/merge/repair actions behind policy guards, and runs Codex/OpenClaw-powered fix, automerge, and issue-implementation repair pipelines. It is deployed as a set of GitHub Actions workflows plus a Cloudflare Workers dashboard backed by Durable Objects, R2, and a separate git state repository with ledgers, canonical record tuples, and telemetry. This is a hard operational bot, not a library or user-facing product; it consumes GitHub webhook and scheduled sweep data and emits state, review records, notifications, and merge/close mutations.
This repository provides a comprehensive suite of GitHub Actions for automating Terraform and OpenTofu workflows in CI/CD pipelines. Each action (e.g., terraform-apply, terraform-plan, terraform-validate) is implemented as a standalone reusable workflow with standardized inputs, outputs, and Docker-based execution environments. The architecture features a common shell library (actions.sh) that handles tool installation, backend initialization, and shared utilities, while individual actions focus on specific operations like plan generation, state management, or pull request commenting. Key capabilities include version detection from multiple sources, backend fingerprinting for state identification, automated PR commenting with approval workflows, and support for both Terraform and OpenTofu. The project emphasizes reliability through extensive testing across versions and backends, with clear separation of concerns between action definitions, implementation logic, and documentation generation.
Cookiecutter PyPackage is a cookiecutter template that generates a modern Python package project with production-ready tooling. It produces a src-layout package with a Typer CLI, pytest tests, Ruff linting, ty type checking, uv dependency management, and a justfile task runner. The generated project includes security-hardened GitHub Actions workflows for CI, PyPI publishing via Trusted Publishers, documentation deployment with Zensical, CodeQL and zizmor security scanning, and Dependabot for dependency updates. The template itself is a Python package with a CLI wrapper around cookiecutter, a development watcher for live template iteration, and a comprehensive post-generation hook that optionally sets up a GitHub repository, enables Pages, and creates the PyPI environment. The codebase demonstrates strong engineering practices: comprehensive test coverage, clear separation of concerns, and thoughtful security defaults. It is actively maintained with recent commits and a well-documented changelog.
This repository implements a GitHub Action (`actions/setup-java`) that installs a Java JDK or JRE in CI environments. It supports 17+ distributions (Adoptium Temurin, Azul Zulu, Microsoft, Amazon Corretto, GraalVM, Liberica, etc.) and resolves versions from user input, version files (`.java-version`, `.tool-versions`, `.sdkmanrc`), or the `latest` alias. The action also sets up dependency caching for Maven, Gradle, and sbt, generates Maven settings.xml with server credentials and GPG signing profiles, and handles Maven toolchains.xml merging across workflow steps. It includes signature verification (GPG) for Temurin and Microsoft distributions and checksum verification for downloaded archives. The architecture is modular: a factory pattern lazily loads distribution-specific installer classes (each extending an abstract `JavaBase`), which handle version resolution, download, extraction, and tool-cache registration. A separate cache system (JDK binary cache, dependency cache, and resolution cache) uses GitHub Actions cache primitives with configurable retention. The codebase is written in TypeScript and heavily leverages the `@actions/*` toolkit. Tests mock all external dependencies and use static JSON fixtures to simulate vendor APIs. The action is deployed as compiled bundles in `dist/` and is actively maintained with comprehensive CI workflows for e2e testing across OS, architecture, and distribution variants. The core value of this repository is its reliability and breadth of support: it automates the brittle process of Java version management in CI, handles edge cases like early-access builds, floating version tags, and platform-specific package types (jdk+fx, jdk+jmods, etc.). The caching and retry logic reduce pipeline execution time and failure rates. While tightly integrated with GitHub Actions, several internal modules (retrying HTTP client, checksum verification, XML escaping) are isolated enough for potential extraction into other TypeScript projects.
nightly.link is a web application that provides shareable links to download the latest build artifacts from GitHub Actions workflows. It acts as a proxy that uses a GitHub App to obtain installation tokens for accessing repository artifacts, bypassing the requirement for users to be logged into GitHub. The application is built with Crystal and features a modular architecture with separate components for routing, GitHub API interaction, caching, and utilities. Key routes handle URL parsing, workflow run lookup, artifact retrieval, and redirect to temporary download URLs. The system caches installation tokens and API responses to minimize GitHub API calls and uses a SQLite database to persist installation data for user-authorized repositories.
octocov is a Go CLI tool and GitHub Action for collecting, analyzing, and reporting code metrics. It measures code coverage (supporting Go cover, LCOV, SimpleCov, Clover, Cobertura, JaCoCo), code-to-test ratio, test execution time, and custom user-defined metrics. The tool integrates deeply with GitHub: it comments on pull requests, posts job summaries, generates SVG badges, uploads artifacts, and stores reports in configurable datastores (local, S3, GCS, BigQuery, GitHub artifacts, Mackerel). It also supports a central mode that aggregates reports from multiple repositories into a single index with per-repo badges. The architecture is a single Go binary with a Cobra CLI. Key entry points are the root command (cmd/root.go) which orchestrates the CI workflow, and subcommands for badge generation, diff comparison, report dump, and central aggregation. Configuration is via YAML (config/). The coverage package contains format-specific parsers that normalize reports into a common model. The datastore package provides a clean interface for storing/retrieving reports, with implementations for each backend. The badge package renders SVG badges using an embedded template and font. The internal page package serves a React-based viewer for coverage diffs. Primary data flow: Parse coverage files from CI (or local), compute metrics, optionally compare with previous report from a datastore, generate badges/comments/summaries, store the new report. Custom metrics are ingested via environment variable files and validated against a JSON schema. Acceptable conditions (using expr-lang) allow failing CI when metrics regress beyond thresholds. External dependencies include GitHub API (google/go-github), AWS SDK, GCP SDK, BigQuery client, Mackerel API, and a JS bundle for the viewer.
Gitea is a self-hosted Git service providing a full DevOps platform including repository hosting, issue tracking, pull requests, wiki, CI/CD (Actions), package registry, and more. The architecture is a monolithic Go web application with a Vue.js frontend, using a SQL database (MySQL, PostgreSQL, SQLite, MSSQL) and supporting various storage backends (local, S3, Azure). Key entry points are the web server (port 3000), SSH server (port 22), and CLI commands for administration. Data flows involve Git operations, webhook notifications, and background job queues. External dependencies include Git, a database, and optional services like Redis, Elasticsearch, and object storage. The codebase is well-structured with extensive testing, but carries some technical debt from a long migration history and dual Git backends.
actions/github-script is a GitHub Action that allows users to run JavaScript/TypeScript scripts in their workflows with access to a pre-authenticated GitHub API client and other GitHub Action toolkit packages. The action executes user-provided scripts as asynchronous functions within a context that includes github, context, core, glob, io, exec, getOctokit, and require objects. Scripts can make GitHub API calls, perform file operations, and return values that become action outputs. The architecture follows standard GitHub Action patterns with TypeScript source code compiled and bundled via ncc into a single distributable file. Key components include async-function.ts for safely executing user scripts, create-configured-getoctokit.ts for creating secondary authenticated clients with inherited configuration, and wrap-require.ts for handling module resolution. The action integrates with GitHub's retry and request-logging plugins and supports configurable retries, user-agent, base URL, and result encoding.
This is a comprehensive Cookiecutter template for generating production-ready Python projects. It is not a running application itself but a project generator that produces applications, libraries, or services based on user-selected features. The template includes sophisticated post-generation hooks that surgically remove unused files and configure dependencies, Docker Compose services, CI/CD workflows, and documentation based on the chosen options. It enforces modern Python practices: uv for package management, Ruff for linting/formatting, mypy for type checking, pytest for testing, and Pydantic Settings for configuration. The generated projects can include FastAPI, Celery, SQLAlchemy, QuasiQueue, aiocache, Jinja2, Typer CLI, Docker, and GitHub Actions. The template itself demonstrates high craftsmanship with clean Jinja2 templating, conditional logic, and a well-organized file structure. It is actively maintained and uses current tooling (uv, Ruff, etc.), indicating low technical drift.
Vouch is a community trust management system that lets open-source projects gatekeep contributions behind an explicit vouching mechanism. It maintains a VOUCHED.td file (a flat text format called Trustdown) listing trusted and denounced users. The system provides a Nushell-based CLI for local management, and eight composite GitHub Actions for full GitHub integration: checking issues/PRs on open/reopen, managing vouches via issue or discussion comments, syncing CODEOWNERS, and installing the CLI. The entire implementation is in Nushell script, making it dependency-light (only requires `nu` and `gh`) while achieving surprising sophistication in API handling, retry logic, and file parsing. Architecturally, Vouch is modular: `vouch/file.nu` handles the custom TD file format with full comment/whitespace preservation; `vouch/lib.nu` provides pure-data operations (add, remove, check, denounce) that operate on parsed tables; `vouch/github.nu` wraps the GitHub REST and GraphQL APIs with exponential-backoff retry, collaborator permission checking, and automated commit/push workflows; and `vouch/template.nu` provides a simple template engine for custom response messages. The GitHub Actions in `action/` are composite actions that invoke these Nushell modules directly. The quality of the codebase is notably high for a Nushell project: it follows a disciplined module structure, has comprehensive tests (both fast unit tests and slow integration tests against the live mitchellh/vouch repository), uses typed flags and structured error handling, and implements patterns like retry with rebase for concurrent edits. The TD file parser (`from td`/`to td`) is a particularly well-crafted component that could be extracted as a standalone Nushell module for any project needing a simple, human-readable trust list format. The comment parsing regex patterns are robust against injection and multiline attacks. Overall, Vouch is a well-engineered, self-dogfooded tool that solves a real open-source moderation problem with minimal external dependencies.
tagpr is a Go CLI tool that automates the GitHub release workflow. It runs as a GitHub Action, monitoring the main branch. When unreleased changes exist, it creates or updates a release pull request with an auto-generated changelog. When that PR is merged, tagpr automatically tags the merge commit with the next semantic or calendar version and creates a GitHub Release. It supports monorepo configurations via tag prefixes, custom version files, label-based version bumping, and both SemVer and CalVer schemes. The tool integrates deeply with the GitHub API (PRs, releases, git trees, issues) and local git commands. It also includes a reusable submodule `gh2changelog` for generating changelogs from GitHub release notes. The codebase is well-structured, with clear separation of concerns, extensive tests, and a functional options pattern for configuration.
Wait-for-secrets is a GitHub Action designed to pause workflow execution until a user manually inputs required secrets via a web interface. It leverages GitHub's OIDC tokens to authenticate with the StepSecurity API, which temporarily stores secret metadata and provides a unique URL for user interaction. The action polls the API until secrets are submitted, then makes them available as outputs for subsequent workflow steps. Key features include optional Slack notifications and configurable timeouts. The architecture is straightforward: a TypeScript-based action compiled via ncc into a single JavaScript file, with core logic separated into utility functions for environment parsing, URL generation, and secret handling.
drawio-skill is a comprehensive toolkit for generating, manipulating, validating, and publishing draw.io architecture diagrams from natural language, codebases, infrastructure-as-code, API specifications, and other structured sources. It provides a unified CLI (`diagramctl.py`) and an optional MCP server (`diagramctl_mcp.py`) that expose workflows for building, syncing, viewing, testing, reviewing, querying, what-if analysis, story generation, and publishing diagrams. The system uses a formal Diagram Intermediate Representation (IR) to separate semantic meaning from geometry, enabling incremental reconciliation, multi-view projection, architecture contract enforcement, and accessible HTML story output. It includes 15+ importers for languages (Python, JS, Go, Rust), IaC (Terraform, Kubernetes, Docker Compose), schemas (SQL, OpenAPI, AsyncAPI, Protobuf, GraphQL), and live infrastructure (Docker, Terraform state). The project is packaged as an AI agent skill compatible with Claude Code, Cursor, Copilot, and other Agent Skills hosts, and ships with GitHub Actions for CI integration. While primarily an application, it also bundles curated icon indices and style presets that could be considered data assets.
This repository is a bilingual curated awesome-list for Agent Skills focused on "persona distillation" — distilling expressive style, decision frameworks, and interaction patterns from people, relationships, conversations, works, or digital traces. The primary content is two static README files (Chinese and English) listing ~70 projects across five categories, sorted by repository name for maintainability. The codebase itself is not an end-user application; it is the curation infrastructure behind the list: a set of Bun/Node.js scripts, GitHub Actions workflows, and tests that automate the submission, validation, and merging of new entries.
This repository implements a GitHub Action that automates deployment of static content to GitHub Pages. It takes a folder from the workspace, optionally builds it, and pushes the contents to a specified branch (default `gh-pages`) using git worktrees and rsync. The action supports authentication via GitHub token, personal access token, or SSH deploy keys, and offers extensive configuration options including clean deployments, single-commit history, target subfolders, dry runs, tags, and Git LFS. The architecture is modular: `src/main.ts` is the entry point, `src/lib.ts` orchestrates the workflow, `src/git.ts` handles repository initialization and deployment, `src/worktree.ts` manages git worktree creation with retry logic, `src/ssh.ts` configures SSH clients, and `src/execute.ts` provides a reusable command execution wrapper. The action relies on external tools `git`, `rsync`, and `ssh-agent`, and uses the `@actions/*` toolkit for GitHub Actions integration. The codebase is well-structured TypeScript with comprehensive unit and integration tests, and follows modern JavaScript practices with ESLint, Prettier, and Jest.