fluid-pub/actions

Central GitHub Actions catalog for Fluid execution agents (agent-*) and probes (probe-*). Workload repositories stay thin: they call reusable workflows here instead of copying build, Docker, and release logic.

Pin the catalog with a moving major tag on this repository (today v1):

uses: fluid-pub/actions/.github/workflows/go-workload-release.yml@v1

Workload repositories publish with semver tags without a v prefix (0.1.0, 0.2.3-rc.1). That is separate from the catalog tag above.

Reusable workflows

Workflow	Invocation	Role
go-workload-ci.yml	workflow_call	Tests, gofmt check, linux/amd64 compile smoke on PRs and develop
go-workload-release.yml	workflow_call	On workload semver tag: GHCR image (amd64 + arm64), GitHub Release binary and checksums
validate.yml	push / PR	YAML sanity check for workflow definitions in this repo

Release inputs (workload repos)

Callers pass workload_kind (agent | probe), binary_name, core_repository (fluid-pub/agent-core or fluid-pub/probe-core), and optionally core_ref, image_repository, main_package. See workflow inputs in go-workload-release.yml.

The release job fails if github.ref_name does not match var Version = "..." in cmd/version.go (contract documented in fluid/probes/core/version and the agents equivalent).

Adopting in a workload repository

A public agent-* or probe-* repository typically contains:

• Submodule core/ pointing at fluid-pub/agent-core or fluid-pub/probe-core, with replace fluid/.../core => ./core in go.mod (CI rewrites the replace path for checkout layout).
• Root Dockerfile and .dockerignore derived from templates/Dockerfile.go-workload and templates/dockerignore.go-workload.
• Caller workflows under .github/workflows/ — start from templates/consumer-ci.yml and templates/consumer-release-on-semver-tag.yml, then set binary_name and workload_kind.

Example release caller:

jobs:
  release:
    uses: fluid-pub/actions/.github/workflows/go-workload-release.yml@v1
    with:
      workload_kind: probe
      binary_name: confluence-probe
      core_repository: fluid-pub/probe-core

Monorepo copies of the same templates also live under code/agents/_template and code/probes/_template while modules are split onto GitHub.

Published artifacts (per workload tag)

For semver tag X.Y.Z on repository fluid-pub/probe-confluence:

Artifact	Where
OCI image	ghcr.io/fluid-pub/probe-confluence:X.Y.Z (also X.Y, multi-arch digest)
Binary	GitHub Release: {binary_name}-linux-amd64
Integrity	GitHub Release: SHA256SUMS.txt

Kubernetes deployments consume the image via chart fluid-workload. Host installs pull release assets from GitHub; there is no releases.fluid.pub mirror.

Tag governance

Organization Terraform (infrastructure/github) configures repository rulesets on public workload repos (and this catalog): only semver-shaped tag names, and only release-managers (plus org admins) may create them. Membership is managed with release_manager_usernames in operator terraform.tfvars.

Bumping the catalog (v2, …) is a deliberate change on this repository; bumping a probe or agent is a normal X.Y.Z tag on that workload repo after updating cmd/version.go.