DRY GitHub Actions with reusable workflows

Extract shared build-and-scan steps into a reusable workflow and call it from every repo with inputs and secrets.

Copy-pasted CI is a maintenance tax you pay forever. GitHub Actions reusable workflows let you define a build-test-scan pipeline once and call it from every repo with inputs and secrets — fix a bug in one place and every caller gets it.

Define it once

on:
  workflow_call:
    inputs:
      image: { required: true, type: string }
    secrets:
      registry_token: { required: true }
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: docker build -t ${{ inputs.image }} .

Call it from anywhere

jobs:
  ci:
    uses: acme/ci-templates/.github/workflows/build.yml@v1
    with:
      image: ghcr.io/acme/api:latest
    secrets: inherit

Why it is worth it

One security fix — a new scanner, a pinned action, an OIDC change — rolls out to the whole org by bumping a version, not by editing fifty YAML files.

Related posts