Grindstone Systems shared workflows

Reusable GitHub Actions workflows for the Grindstone Systems toolkits (Visual Toolkit, Documentation Toolkit and those that follow). Each toolkit stays its own repository, app and OIC listing. This repository holds only the CI plumbing they would otherwise copy.

Checking an OIC listing is OIC's job: oic-profile.yml wraps the public profile-check Action, which any publisher can use directly. Only Grindstone's own conventions live here.

Workflow	What it does
check.yml	pnpm install, then the commands you pass, one per line. chrome: true sets CHROME_PATH for browser-driven checks
pages.yml	Tests, builds with BASE set for Pages, and deploys dist to GitHub Pages
oic-profile.yml	Checks .oic/project.yaml with OIC's importer and Charter preflight

Use

.github/workflows/ci.yml in a toolkit:

name: CI
on:
  pull_request:
  push:
    branches: [main]
permissions:
  contents: read
jobs:
  check:
    uses: Grindstone-Systems/.github/.github/workflows/check.yml@main
    with:
      run: |
        pnpm typecheck
        pnpm test
        pnpm build
  oic-profile:
    uses: Grindstone-Systems/.github/.github/workflows/oic-profile.yml@main

.github/workflows/deploy-pages.yml:

name: Deploy app
on:
  push:
    branches: [main]
  workflow_dispatch:
permissions:
  contents: read
  pages: write
  id-token: write
concurrency:
  group: pages
  cancel-in-progress: true
jobs:
  pages:
    uses: Grindstone-Systems/.github/.github/workflows/pages.yml@main
    with:
      test: pnpm test
      build: pnpm build

The caller grants the permissions; a called workflow can't raise them. Enable Pages once per repository (Settings → Pages → Source: GitHub Actions).

Conventions

• Toolkits are static, $0 to host, and deployed from main.
• Commits in public repositories use the b-mac-gs noreply identity.
• Changes here reach every toolkit on its next run, so keep inputs backward compatible and test a change on one toolkit's pull request before relying on it.