Publish reusable workflows: rg-ci / rg-security / rg-release

[jmcte]

Context

The org CI/CD audit (docs/omt-global-ci-cd-audit-2026-04-14.md) names github-runner-fleet as the release-isolation reference and recommends:

Extend its policy into explicit rg-ci / rg-security / rg-release governance

and

Use as the source repo for reusable PR/security/release workflows

pr-fast-ci.yml, extended-validation.yml, and release-image.yml already encode the right patterns, but they are repo-local and cannot be consumed from downstream repos via workflow_call. #28 covers the docs side (shell-safe workflow cookbook); this issue is the artifact side.

Scope

• Carve out workflow_call reusable workflows under .github/workflows/ (or a sibling reusable/ directory) for:
  • rg-ci.yml — cheap PR gate template (lint/test/build, shell-safe runner allowlist)
  • rg-security.yml — wraps the security scan workflow added in the security-scanning issue (CodeQL / dep-review / OSV) on hosted runners only
  • rg-release.yml — signed-image / OIDC-only release template, derived from release-image.yml
• Each reusable workflow exposes minimal, well-typed inputs and secrets: inherit boundaries.
• Each one pins external actions by SHA and constrains permissions: to least-privilege.
• Add an example consumer snippet to docs/workflow-cookbook.md showing how a downstream repo references each workflow with uses: OMT-Global/github-runner-fleet/.github/workflows/rg-*.yml@<tag>.
• Validate via a smoke-style test (or a separate test-consumer repo / matrix job) that each reusable workflow is callable.

Acceptance Criteria

• A downstream repo can adopt the org standard with three uses: lines instead of copying YAML.
• Inputs and required secrets are documented in the workflow file header.
• README or docs/workflow-cookbook.md links the canonical reference for each reusable workflow.
• The repo's own CI continues to use CI Gate as the single required status check.

Related

• Audit doc: docs/omt-global-ci-cd-audit-2026-04-14.md (Wave 4)
• Publish a shell-safe workflow cookbook and compatibility matrix #28 Shell-safe workflow cookbook (docs counterpart)

[jmcte]

A current-tree review found that this issue's public contract and several acceptance criteria are still unmet or have regressed, so I am reopening it rather than creating a duplicate.

Verified gaps:

• docs/workflow-cookbook.md:41-48 tells consumers to use @v1, but the repository has no v1 ref. Current remote tags are v0.1.1, v0.1.9, v0.1.10, and v0.1.11.
• rg-release.yml:32-53 routes QEMU/Buildx/registry publication to [self-hosted, linux, shell-only, public], while the cookbook explicitly says rg-release stays GitHub-hosted.
• rg-ci.yml:33-46 selects the shell-only pool but uses actions/setup-node; the same cookbook says that action can fail on Synology and prescribes the bundled shell-safe setup.
• None of the external actions in the reusable workflows is pinned to a full commit SHA, despite this issue's scope requiring immutable pins. Existing Code Scanning PinnedDependenciesID alerts confirm the drift.
• Tests parse the workflow files but do not prove that a downstream repository can call the documented refs successfully.

Recommended closure criteria:

• publish and maintain resolvable stable consumer refs;
• restore workload-compatible runner routing;
• pin external actions by full SHA with update automation;
• add a real caller smoke test for all three reusable workflows;
• keep exploit-sensitive trust-routing details in the repository's private security advisory, per SECURITY.md.

[jmcte]

2026-07-13 implementation status

PR #175 provides the three SHA-pinned, least-privilege reusable workflows, executable caller smoke coverage, and immutable consumer examples. PR #170 provides the reviewed v0.2.2 release/tag contract they reference. Both are green and mergeable.

Keep this issue open until those PRs merge, v0.2.2 is published, and the caller smoke is rerun against the public immutable tag.