Utilified — org .github repo

Shared GitHub Actions reusable workflows, the org profile (profile/README.md) and org-level defaults for Utilified repositories.

Reusable workflows

Workflow	Purpose	Used by
reusable-claude.yml	@claude bot for the repo's own people, with an explicit tool list and one secret	All repos
reusable-dependabot-auto-merge.yml	Auto-approve+merge Dependabot patch/minor/security PRs	All repos
reusable-lock-file-npm.yml	Weekly npm install + commit package-lock.json	Node repos
reusable-lock-file-poetry.yml	Weekly poetry lock + commit poetry.lock	Python repos
reusable-pr-title.yml	Fail a PR whose title is not a conventional commit (release-please reads it)	All repos
reusable-resolve-generated-conflicts.yml	On push to main, merge main into PRs whose only conflicts are generated files, regenerate, push	Repos with generated files
reusable-security-audit-npm.yml	Blocking dependency gate: npm audit (high+), registry signature check, optional dependency review	Node repos
reusable-security-audit-pip.yml	Blocking dependency gate for Poetry projects (pip-audit); working-directory for monorepos	Python repos

How to call from a service repo

Each service repo's .github/workflows/ should contain thin caller files. The examples use @main for readability; real callers pin a commit SHA with a # main comment so Dependabot can bump it (see docs/dependency-update-standard.md):

# .github/workflows/claude.yml
name: Claude Code
on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  pull_request_review:
    types: [submitted]
permissions:
  contents: read
  pull-requests: read
  issues: read
  id-token: write
  actions: read
jobs:
  claude:
    uses: Utilified/.github/.github/workflows/reusable-claude.yml@main
    # Pass only this secret. `secrets: inherit` would hand the agent every secret.
    secrets:
      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

CLAUDE_CODE_OAUTH_TOKEN is an org secret shared with selected repos. Add a repo to its access list when you add this caller. Use claude-args, allowed-tools and disallowed-tools to tune the model and tool limits per repo.

# .github/workflows/dependabot-auto-merge.yml
name: Dependabot Auto Merge
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
jobs:
  auto-merge:
    uses: Utilified/.github/.github/workflows/reusable-dependabot-auto-merge.yml@main

# .github/workflows/lock-file-maintenance.yml  (npm)
name: Lock File Maintenance
on:
  schedule:
    - cron: "30 10 * * 5"  # Fri 21:30 AEST / 10:30 UTC
  workflow_dispatch:
jobs:
  update:
    uses: Utilified/.github/.github/workflows/reusable-lock-file-npm.yml@main

# .github/workflows/lock-file-maintenance.yml  (Poetry)
name: Lock File Maintenance
on:
  schedule:
    - cron: "30 10 * * 5"
  workflow_dispatch:
jobs:
  update:
    uses: Utilified/.github/.github/workflows/reusable-lock-file-poetry.yml@main
    with:
      python-version: "3.12"

# .github/workflows/pr-title.yml
name: PR Title
on:
  pull_request:
    types: [opened, edited, reopened, synchronize]
jobs:
  check:
    uses: Utilified/.github/.github/workflows/reusable-pr-title.yml@main

Tests

tests/*.test.sh exercise the non-trivial run: blocks in the reusable workflows. A harness extracts the step's script out of its YAML and runs it against scratch git repos, so there is no second copy to drift. self-test.yml runs them on every PR touching .github/workflows/ or tests/.

bash tests/lock-file-libc-guard.test.sh

Not in this repo

claude-code-review.yml stays per-repo because its review prompt differs meaningfully per codebase (Django, Next.js, CDK, MCP).