Workflow Reference
All workflows in .github/workflows/, grouped by priority tier.
For trigger details and schedules see Workflow Triggers.
Auto-generated on 2026-07-03 from
config/workflow-quota-costs.ymlandconfig/workflow-priority-tiers.yml.
Quota cost columns: Low = fast/cached run · Mid = typical (p50) · High = large/uncached (p95)
Tier 1 — Critical
| Workflow | Synopsis | Schedule | min_quota | Low | Mid | High |
|---|---|---|---|---|---|---|
| Cancel Runs After Token Rotation | Cancels any queued or in-progress workflow runs immediately after token rotation to prevent runs using the old token. | Manual | 50 | 5 | 15 | 30 |
| Cancel Stale Runs | Cancels queued and in-progress workflow runs older than MAX_AGE_MINUTES (default 90) or created before a fix commit, preventing stale runs from burning quota. | Manual | 100 | 10 | 30 | 80 |
| Critical Deploy | Fast-lane workflow for deploying critical fixes when the system is degraded — commits and pushes changes, clears the queue aggressively, then dispatches priority workflows. | Manual | 50 | 5 | 30 | 100 |
| Critical Deploy — All | Fast-lane critical deploy across all four platforms (Interested-Deving-1896, OSP, OOC, GitLab) in sequence. Cost is approximately 4× the single-org variant. | 200 | 20 | 120 | 400 | |
| Critical Deploy — OOC | Fast-lane critical deploy scoped to OpenOS-Project-Ecosystem-OOC — same three-phase pattern as Critical Deploy but targets the OOC mirror org only. | Manual | 50 | 5 | 30 | 100 |
| Critical Deploy — OSP | Fast-lane critical deploy scoped to OpenOS-Project-OSP — same three-phase pattern as Critical Deploy but targets the OSP mirror org only. | Manual | 50 | 5 | 30 | 100 |
| Flush Active Watchdog | Clears FLUSH_ACTIVE=false whenever Flush Lifecycle Manager or any critical-deploy workflow completes. Prevents stuck-mutex after force-cancel. | Manual | 10 | 1 | 2 | 3 |
| Flush Lifecycle Manager | Coordinates the three-stage flush pipeline with quota reservation, runner slot holding via a parallel sentinel job, and pause/resume at quota reset windows. Sets FLUSH_ACTIVE=true so queue-manager and quota-reserve protect flush stages. | Weekly Sun 06:00 UTC | 1500 | 15 | 40 | 80 |
| GitLab Critical Deploy | Fast-lane GitLab mirror recovery. Pushes current HEAD directly to GitLab via HTTPS, cancels pending pipelines, pauses/resumes schedules, and optionally triggers a fresh pipeline. Works even when GitHub quota is near 0. | 50 | 3 | 8 | 15 | |
| Mirror Watchdog | Triggers when any mirror workflow fails — waits 5 minutes then retries once. Surfaces persistent failures in the Actions tab without consuming quota on repeated retries. | Manual | 50 | 5 | 15 | 30 |
| PR Gate | Required status check for incoming PRs. Checks quota remaining and posts a comment if the system is degraded. Two rate_limit calls per run. | On push | 10 | 2 | 2 | 4 |
| Pre-Flush Prep | Prepares the system for a clean full-chain-flush — cancels stale runs, merges ready PRs, validates config, cleans merged branches, removes template pollution, then dispatches full-chain-flush when quota is sufficient. | Manual | 1500 | 10 | 30 | 60 |
| Queue Manager | Deduplicates queued workflow runs (keeps newest per workflow) and evicts runs queued longer than STALE_QUEUE_MIN (default 25 min) to prevent quota exhaustion cascades. | Every 30 min | 50 | 5 | 15 | 30 |
| Quota Monitor | Polls GitHub quota and optionally dispatches a target workflow once quota recovers above a configurable threshold. Dispatch-only — never scheduled. | 10 | 1 | 5 | 10 | |
| Quota Reserve | Cancels low-priority queued runs when remaining quota drops below RESERVE_FLOOR (default 1000). Uses per-workflow min_quota from workflow-quota-costs.yml for cost-aware cancellation. | Every 30 min | 10 | 1 | 5 | 15 |
| Rate-Limit Re-trigger | Scans recently-failed workflow runs, identifies those that failed due to rate limiting, and re-triggers them after their quota reset epoch. | Every 4h at :05 | 50 | 5 | 20 | 50 |
| Rotate Secret Token | Rotates GitHub PATs and GitLab tokens stored as org/repo secrets. Validates the new token before committing, then triggers Cancel Runs After Token Rotation to clear stale runs. | Manual | 50 | 5 | 10 | 20 |
| Token Health Monitor | Checks expiry dates for all tracked PATs and GitLab tokens. Opens a GitHub issue labelled token-monitor when any token expires within 45 days. | Weekly Mon 09:24 UTC | 50 | 5 | 10 | 20 |
| Validate Config | Validates all config files (gitlab-subgroups.yml, workflow-sync.yml, priority-tiers.yml, registered-imports.json) on every push that touches them. Blocks merges on invalid config. | Manual | 50 | 2 | 5 | 10 |
Tier 2 — High
| Workflow | Synopsis | Schedule | min_quota | Low | Mid | High |
|---|---|---|---|---|---|---|
| Add Mirror Repo | Adds a new repo to the three-org mirror chain (Interested-Deving-1896 → OSP → OOC) by creating the repo in each org, setting up webhooks, and registering it in gitlab-subgroups.yml. | Manual | 200 | 10 | 30 | 60 |
| DwarFS Pack Release | Packages a DwarFS release artifact when an upstream release completes. | Manual | 100 | 5 | 15 | 30 |
| Full Chain Flush | Orchestrates the complete mirror chain in sequence — mirror-to-osp → mirror-osp-to-ooc → mirror-osp-to-gitlab — with quota checks between each stage. | 17 5 1 * * | 1000 | 100 | 400 | 1000 |
| Git Platform Sync | Agnostic git platform sync. Replaces sync-to-gitlab.yml (direction=push) and sync-from-gitlab.yml (direction=pull). Supports GitHub, GitLab, Gitea, Forgejo, Codeberg as source or destination. | Daily 09:23 UTC | 100 | 5 | 25 | 60 |
| Import Repository | Platform-agnostic repo importer — clones any public or authenticated git URL into Interested-Deving-1896, optionally mirrors through the OSP→OOC chain and registers for ongoing sync. | 100 | 10 | 30 | 60 | |
| Merge Repos into Monorepo | Merges multiple git repositories into a single monorepo, preserving full commit history, tags, and Git LFS objects. Manual dispatch only. | Manual | 100 | 10 | 30 | 60 |
| Mirror Chain Dispatch | Agnostic mirror-chain backend. Dispatch-only on canonical instance — dedicated mirror workflows own schedules. Downstream forks without dedicated workflows may add a schedule. | 1200 | 5 | 50 | 800 | |
| Mirror Interested-Deving-1896 → OSP | Bare-clones every repo in Interested-Deving-1896 and git push --mirror into OpenOS-Project-OSP, syncing all branches, tags, and refs exactly. | Every 6h at :13 | 500 | 20 | 80 | 200 |
| Mirror OSP → GitLab | Mirrors every repo in OpenOS-Project-OSP to its GitLab counterpart under openos-project, creating the GitLab project in the correct subgroup if it does not exist yet. | Daily 01:23 UTC | 300 | 5 | 20 | 50 |
| Mirror to OpenOS-Project-Ecosystem-OOC | Bare-clones every repo in OpenOS-Project-OSP and git push --mirror into OpenOS-Project-Ecosystem-OOC, completing the second hop of the three-org mirror chain. | Every 6h at :45 | 300 | 20 | 80 | 200 |
| Mirror to OpenOS-Project-OSP | Mirrors Interested-Deving-1896 repos to OpenOS-Project-OSP on schedule and push. | 0 * * * * | 500 | 50 | 200 | 500 |
| PR Lifecycle Guard | Reusable quota + queue pre-flight called by PR-creating workflows (OTA Release, Upstream PRs, Rebase PRs). One rate_limit call plus optional queue-manager pass. | 50 | 3 | 8 | 20 | |
| Pin Workflow Actions | Pins GitHub Actions uses references to exact SHA commits via ratchet. | Weekly Tue 05:00 UTC | 100 | 10 | 50 | 150 |
| Pre-Mirror CI Gate | Checks CI status on all OSP-bound repos in Interested-Deving-1896 before mirroring. Dispatches resolve-failures for red repos, waits, then re-checks. Blocks the mirror if repos are still failing. | Manual | 800 | 50 | 150 | 300 |
| Rebase PRs | Rebases open PRs in Interested-Deving-1896 onto their base branch when they fall behind, keeping PRs mergeable without manual intervention. | 10 5 */2 * * | 100 | 5 | 20 | 50 |
| Sync All Forks | Syncs all branches of every fork owned by Interested-Deving-1896 with their upstream via the GitHub merge-upstream API, falling back to force-reset on divergence. | Daily 06:07 UTC | 500 | 50 | 200 | 500 |
| Sync Registered Imports | Re-syncs all repos listed in registered-imports.json — bare-clones each source URL and pushes all branches and tags to Interested-Deving-1896. | Daily 04:55 UTC | 200 | 5 | 15 | 30 |
| Sync from GitLab | DEPRECATED. Superseded by Git Platform Sync (direction=pull). Stub kept for backwards compatibility. | Manual | 100 | 0 | 0 | 0 |
| Sync to GitLab Variant | Variant of Sync to GitLab that uses a different token and push strategy — used when the primary sync is blocked or for testing. | Daily 01:50 UTC | 100 | 5 | 20 | 50 |
Tier 3 — Medium
| Workflow | Synopsis | Schedule | min_quota | Low | Mid | High |
|---|---|---|---|---|---|---|
| Audit Arch Repos | Weekly audit of expected vs actual repos across Interested-Deving-1896. Reports missing, unexpected, and mismatched repos to the step summary. | Weekly Mon 04:00 UTC | 100 | 5 | 20 | 50 |
| Auto-merge PRs | Merges open PRs once required checks pass. Hybrid auto-detection per PR: scope (label/bot/all), strategy (rebase/squash/merge), mechanism (native auto-merge vs poll). | Every 6h at :55 | 300 | 5 | 30 | 80 |
| BDFS Dev Workspace | Creates and manages mutable dev workspaces on top of immutable filesystem roots using the bdfs framework (btrfs, overlay, or dwarfs backends). Actions: create, drop, list, commit, status. | Manual | 0 | 0 | 0 | 0 |
| BDFS Dev — BTRFS Backend | Creates a writable BTRFS snapshot of a source subvolume as a bdfs dev workspace. Source must be on a BTRFS filesystem. | Manual | 0 | 0 | 0 | 0 |
| BDFS Dev — DwarFS Backend | Mounts a DwarFS image read-only as the lower layer of an overlayfs workspace, with a writable upper layer (BTRFS subvolume or tmpfs). | Manual | 0 | 0 | 0 | 0 |
| BDFS Dev — Overlay Backend | Creates an overlayfs workspace with a source path as the read-only lower layer and tmpfs or a directory as the writable upper layer. Works on any filesystem. | Manual | 0 | 0 | 0 | 0 |
| Bootstrap Triggers | One-shot self-destruct workflow that fires pending workflow_dispatch triggers on push. | Manual | 50 | 2 | 5 | 10 |
| Build (self-hosted) | Builds the project on a self-hosted runner. | Manual | 20 | 1 | 2 | 5 |
| Build ARM64 | Builds the project for ARM64 architecture. | Manual | 20 | 1 | 2 | 5 |
| Build x86-64 | Builds the project for x86-64 architecture. | Manual | 20 | 1 | 2 | 5 |
| CI | Runs CI checks on push and pull request events. | On push | 20 | 1 | 2 | 5 |
| Check Accessibility | Multi-layer accessibility audit — CODEOWNERS coverage, README screen-reader scan, WCAG 2.1 AA HTML check, audio overview (espeak-ng), and Braille output (liblouis). Commits README.audio.mp3 and README.brl artifacts. | Weekly Mon 04:17 UTC | 500 | 5 | 15 | 40 |
| Check CI Status | Agnostic CI status checker. Runs check-ci.sh for each enabled target in config/ci-check-targets.yml (GitHub orgs and GitLab groups). | Daily 09:05 UTC | 300 | 50 | 300 | 900 |
| Check OOC CI Status | Daily check of CI status on the default branch HEAD for every OOC-bound repo. Reports failing repos to the step summary. | Daily 06:30 UTC | 500 | 50 | 150 | 300 |
| Check Shell Tools CI | Batch-fetches CI run status for all 24 shell-tools repos via a single GraphQL query. Minimal quota cost. Weekly Monday 06:30 UTC. | Weekly Mon 06:30 UTC | 50 | 1 | 2 | 3 |
| Cleanup Stale Branches | Deletes branches that have been merged into the default branch across all repos in Interested-Deving-1896, OSP, and OOC. | 29 4 1 * * | 200 | 10 | 60 | 200 |
| Cleanup Template Pollution | Removes files incorrectly propagated from fork-sync-all to consumer repos via the template sync pipeline, across all three GitHub orgs and GitLab. | Manual | 200 | 20 | 80 | 200 |
| Clone Org | Clones all repositories from an org or user on any supported platform (GitHub, GitLab, Bitbucket, Gitea) into Interested-Deving-1896. | Manual | 200 | 20 | 80 | 200 |
| Create Missing READMEs | Creates README.md from the standard template for OSP-bound repos that have no README, with placeholder sections for human-owned content. | Daily 07:08 UTC | 200 | 20 | 80 | 200 |
| Delete Stale Repos | One-shot cleanup of superseded repos across GitHub orgs and GitLab. Manual dispatch only. | Manual | 50 | 2 | 6 | 20 |
| Deploy Book | Builds the mdBook documentation site from DOCS/ and deploys it to GitHub Pages at interested-deving-1896.github.io/fork-sync-all/. | Manual | 50 | 5 | 10 | 20 |
| Devcontainer SDK | Validates devcontainer.json, features, and automations templates. Optionally builds and pushes the devcontainer image or publishes features to GHCR. | Manual | 50 | 0 | 5 | 20 |
| Docker → Incus Migration | Scans repos for Docker artifacts (Dockerfile, docker-compose.yml) and replaces them with Incus equivalents. Runs after Add Mirror Repo and weekly. | Weekly Sun 03:08 UTC | 100 | 10 | 40 | 100 |
| Enforce Agnostic Vendor | Scans vendor/ for distro-specific hardcoded fallback values in shell, YAML, and TypeScript. All vendored components must be deployment-agnostic. | Manual | 50 | 2 | 5 | 10 |
| FSA API | FSA API server lifecycle and adapter dispatch. Validates config, smoke-tests server startup, or calls individual adapters directly via workflow_dispatch. | Manual | 200 | 2 | 10 | 30 |
| Fork KDE Neon Repos | One-shot workflow that clones the 6 KDE Invent neon repos into Interested-Deving-1896 and pushes them through the OSP mirror chain. Ongoing re-sync handled by sync-registered-imports. | Manual | 100 | 10 | 30 | 60 |
| Full Audit | Weekly structural audit of workflows, scripts, config registries, assets, and vendor dirs. No REST calls. | Weekly Mon 04:00 UTC | 50 | 0 | 0 | 0 |
| Generate Book Pages | Regenerates DOCS/generated/ pages from config sources (workflow-quota-costs.yml, priority-tiers.yml, gitlab-subgroups.yml, registered-imports.json) and commits the result. | Manual | 50 | 1 | 2 | 5 |
| Generate Repo Descriptions | AI-powered per-file description generator. Fetches file tree (1 REST call) then reads each file for context (1 REST call per file) before calling GitHub Models. Cost scales with MAX_FILES setting. | Weekly Sun 03:30 UTC | 300 | 20 | 100 | 300 |
| HW Detect CI | Runs CI for hardware detection tooling on schedule and push. | Weekly Mon 06:00 UTC | 50 | 2 | 5 | 15 |
| Inject Built-with-Ona Badges | Adds a Built-with-Ona badge to README.md for all repos in Interested-Deving-1896 that are missing it. Skips repos that already have the badge. | 15 8 */2 * * | 200 | 5 | 30 | 80 |
| List Active Runs | Lists all active workflow runs with clickable web and API URLs. | Every 30 min | 50 | 2 | 3 | 5 |
| Manage Repo Settings | Declarative repo settings drift detection and enforcement. Check mode reads current state (1 REST call per repo) and reports drift. Apply mode patches drifted fields (1-3 REST calls per drifted repo). | Weekly Mon 04:30 UTC | 200 | 10 | 60 | 150 |
| Merge Ready PRs | Waits for CI then merges all open PRs with passing checks across fork-sync-all and btrfs-dwarfs-framework. | Manual | 200 | 10 | 40 | 100 |
| Mirror Flatpak Repo | Builds and publishes a self-hosted Flatpak repo on GitHub Pages. Downloads Flatpak bundles from OSP/OOC releases and imports them into the org flatpak-repo. | Daily 05:00 UTC | 300 | 20 | 60 | 150 |
| Mirror GHCR Images | Re-tags and pushes GHCR container images from an upstream owner into OSP and OOC orgs. Daily schedule. | Daily 03:00 UTC | 200 | 10 | 40 | 100 |
| Mirror PyPI Packages | Re-publishes PyPI packages from upstream repos to OSP/OOC with org-prefixed package names (e.g. osp-linux-kernel-manager). | Manual | 100 | 5 | 20 | 60 |
| Mirror RPM Repo | Mirrors RPM packages from OSP/OOC releases to a self-hosted RPM repo on GitHub Pages. Daily schedule. | Daily 04:30 UTC | 200 | 10 | 40 | 100 |
| OTA Discover | Scans forks of fork-sync-all for .ota/config.yml with enabled: true and adds newly discovered repos to config/ota-registry.yml. | Daily 06:38 UTC | 100 | 10 | 40 | 100 |
| OTA Opt-In | Propagated to opted-in forks. Fork owners run this once to create .ota/config.yml and open a registration PR against fork-sync-all's OTA registry. | 50 | 5 | 15 | 30 | |
| OTA Release | Triggered on semver tag push. Assembles and delivers OTA updates to all opted-in repos in config/ota-registry.yml, then updates CHANGELOG.md with release notes. | Manual | 100 | 10 | 40 | 100 |
| OTA Self-Update | Propagated to opted-in forks. Pulls the latest OTA release from fork-sync-all and applies it to the fork's workflow files. | Weekly Mon 05:15 UTC | 50 | 5 | 15 | 30 |
| Onboard Bugzilla | Guided one-time setup: validates Bugzilla connectivity, creates product/components, writes config/bugzilla.yml. | Manual | 100 | 5 | 15 | 30 |
| Onboard Repository | Onboards new repos into the ecosystem — applies labels, branch protection, topics, description, welcome issue, and dispatches sync-template/setup-osp-mirrors/sync-registered-imports. | Manual | 200 | 20 | 60 | 150 |
| Org Storage Maintenance | Weekly GitLab storage housekeeping across openos-project: triggers artifact expiry and deletes old generic package versions older than 90 days (keeps 5 per package). | Weekly Sun 02:00 UTC | 0 | 0 | 0 | 0 |
| PR Automation | Applies size labels, path-based labels, reviewer auto-assignment, risky pattern detection, and auto-merge for low-risk PRs on every PR open or update. | On push | 50 | 5 | 15 | 30 |
| Pin Manager | Manages version pinning, GitHub profile pins, and repo issue pins. | Weekly Mon 06:00 UTC | 150 | 3 | 10 | 25 |
| Pipeline Telemetry | Post-run observability workflow. Fetches completed run data, builds a span tree (workflow→jobs→steps), computes Thoth-equivalent metrics, parses log severity, writes a step summary and trace artifact, and upserts a rolling metrics issue. | Manual | 200 | 5 | 15 | 30 |
| Post-Flush Verification | End-to-end health check after full-chain-flush — mirror integrity across all three pairs, CI status on I-D-1896 OSP-bound repos, quota health, and workflow queue health. | Manual | 300 | 150 | 350 | 600 |
| Provision GitLab Maintenance Schedules | Pushes .gitlab/scheduled-maintenance.yml and creates a weekly maintenance schedule on every actively developed project under openos-project. Safe to re-run. | 0 | 0 | 0 | 0 | |
| Push Kernel Content | Pushes kernel version metadata (READY, VERSION, config/, patches/, README.md) to the debian-{arch}-kernel-base repos (one per arch, up to 10). | Manual | 100 | 10 | 30 | 80 |
| Rebuild LTS Branch (penguins-eggs) | Rebases the all-features branch onto the upstream master after each pieroproietti sync, then force-pushes the result to the lts branch. | Manual | 50 | 5 | 15 | 30 |
| Reconcile Identity Assets | Detects the current FSA instance, selects the matching brand variant, writes active assets to assets/brand/.active/, and injects identity content into DOCS/cover.md. | Manual | 10 | 1 | 3 | 5 |
| Reconcile Org References | Rewrites org/repo references in OSP and OOC mirrors to point at the correct org, fixing stale Interested-Deving-1896 references left by the mirror process. | 50 5 */2 * * | 300 | 10 | 60 | 150 |
| Release | Creates a GitHub release and uploads build artifacts on tag push. | Manual | 100 | 5 | 15 | 30 |
| Resolve CI Failures | Analyses CI failure patterns across OSP-bound repos and applies automated fixes (dependency updates, config corrections, workflow patches) where possible. | Daily 07:43 UTC | 100 | 10 | 40 | 100 |
| Resolve CI Failures (Agnostic) | Agnostic CI failure resolver. Runs resolve-ci.sh for each enabled target in config/ci-check-targets.yml. GitHub targets use LLM analysis and auto-fix; GitLab targets retry failed/canceled pipelines. | Daily 07:43 UTC | 100 | 10 | 120 | 400 |
| Runner Status | Reports runner utilisation and queue depth across the org. Flags workflows with queue depth above configurable warn/critical thresholds. | Every 1h at :10 | 50 | 2 | 4 | 8 |
| Seed Patchset Branches | Seeds 9 patchset branches per debian-{arch}-kernel-base repo for Debian (trixie/forky/sid), Devuan (excalibur/forky/ceres), and Ubuntu (resolute/stonking/devel). | Manual | 200 | 20 | 60 | 150 |
| Setup Dashboard Variables | Sets all VITE_* repository variables required by the infra-dashboard public-dashboard build. Safe to re-run — blank inputs leave existing variables unchanged. | Manual | 50 | 5 | 15 | 30 |
| Setup OSP Mirror Workflows | Ensures all repos in OpenOS-Project-OSP have the correct mirror workflow files and secrets configured for the OSP→OOC mirror chain. | Daily 02:45 UTC | 200 | 20 | 80 | 200 |
| Sync FSA Forks | Keeps downstream fork-sync-all forks in sync with upstream. Opens PRs on drift. | Daily 04:00 UTC | 200 | 5 | 20 | 60 |
| Sync KDE Groups Mirrors | Syncs all KDE group mirror repos under openos-project/kde-ecosystem-deving/kde-groups from invent.kde.org. Daily schedule. | Daily 01:00 UTC | 300 | 20 | 80 | 200 |
| Sync KDE Neon Mirrors | Syncs all KDE Neon mirror repos in openos-project/kde-ecosystem-deving/neon-deving from invent.kde.org/neon/. Daily schedule, offset 30 min from Sync KDE Groups Mirrors. | Daily 01:30 UTC | 300 | 20 | 80 | 200 |
| Sync Pieroproietti GitLab Forks | Syncs the three pieroproietti GitLab forks (penguins-eggs, penguins-eggs-book, oa-tools) from their GitHub upstreams. Mirrors branches, tags, and creates GitLab Releases for new tags. | Daily 02:15 UTC | 100 | 5 | 15 | 40 |
| Sync Registry Backend | Agnostic registry sync backend propagated to upstream-sync consumers. Dispatch-only, no schedule, no hardcoded defaults. Reads vars.AF_REGISTRY_REPO / AF_REGISTRY_BRANCH / AF_REGISTRY_PATH for self-configuration. | 100 | 10 | 40 | 100 | |
| Sync Registry Sources | Registry-driven upstream sync (central orchestrator) — reads a JSON registry of upstream sources and syncs each repo via merge-upstream or force-reset. Runs daily from fork-sync-all with penguins-eggs defaults. | Daily 03:05 UTC | 100 | 10 | 40 | 100 |
| Sync Shell Tools Vendor | Sparse-clones each of the 24 shell-tools forks and copies entrypoint scripts into vendor/shell-tools/. One clone per tool (~2 REST calls each via git protocol). Weekly Sunday 02:00 UTC. | Weekly Sun 02:00 UTC | 300 | 24 | 48 | 72 |
| Sync Template | Syncs fork-sync-all's file tree into target repos. Three modes — create (new repo + mirror chain), inject (copy into existing repo), propagate (push-triggered sync to all consumers in template-consumers.yml). | Manual | 200 | 20 | 80 | 200 |
| Sync UAA Vendor | Syncs vendor/unified-agnostic-api from Interested-Deving-1896/unified-agnostic-api via sparse checkout. Runs on push to vendor/unified-agnostic-api/** or weekly schedule. | Weekly Tue 05:00 UTC | 100 | 5 | 15 | 30 |
| Sync Upstream Mirrors (GitLab) | Syncs all upstream mirror repos in openos-project/upstream-mirrors from their original GitHub sources. Daily schedule. | Daily 00:00 UTC | 200 | 10 | 40 | 100 |
| Sync Upstream Sources | Reads the Origins section of every OSP-bound repo and syncs each referenced external fork to its upstream HEAD via merge-upstream or force-reset. | Daily 01:37 UTC | 200 | 20 | 80 | 200 |
| Sync btrfs-devel Branches | Syncs tracked btrfs-devel branches from the upstream kernel tree into the btrfs-dwarfs-framework fork. | Daily 05:02 UTC | 100 | 5 | 20 | 50 |
| Sync pieroproietti Forks | Syncs all penguins-eggs forks owned by Interested-Deving-1896 with their upstream pieroproietti sources via merge-upstream. | Daily 01:07 UTC | 100 | 10 | 40 | 100 |
| Sync to GitLab | DEPRECATED. Superseded by Git Platform Sync (direction=push). Stub kept for backwards compatibility. | Manual | 100 | 0 | 0 | 0 |
| Sync-in | Manages Sync-in server/client lifecycle. Server role: health-check, deploy, token rotation. Client role: register OSP-bound repos as workspaces, trigger syncs. Scheduled health every 6h, workspace sync daily. | Every 6h at :37 | 50 | 2 | 20 | 80 |
| Trigger README Update (All Repos) | Dispatches update-readmes.yml for all OSP-bound repos in batch. Use after a rate-limit reset to propagate README updates org-wide. | Manual | 200 | 10 | 30 | 80 |
| Update READMEs | Regenerates AI-owned sections (what-it-does, architecture, ci, mirror-chain, etc.) in README.md for all OSP-bound repos, preserving human-owned sections. | Daily 03:15 UTC | 300 | 50 | 150 | 300 |
| Upload Asset | Uploads files from URLs, artifacts, or repo paths to a release, repo directory, or issue comment. | Manual | 50 | 2 | 5 | 15 |
| Upload NotebookLM Assets | Uploads NotebookLM generated output files (audio, PDF) to a GitHub Release. Creates the release if it does not exist yet. | Manual | 50 | 2 | 5 | 10 |
| Upstream Contribute (caller) | Consumer-repo caller for upstream-contribute.yml. Analyses push diff and opens upstream PRs. | Manual | 50 | 2 | 10 | 20 |
| Validate README Render | Checks README.md for rendering issues — leaked log lines, unclosed fences, bare brackets, raw angle brackets, unclosed AI markers, missing H1, and empty sections. | Manual | 50 | 5 | 15 | 30 |
| Verify Fork Integrity | Compares this repo's default-branch HEAD against its upstream parent (or upstream_override from .ota/config.yml). Reports sync status; configurable hard-fail on drift. | Weekly Mon 06:25 UTC | 100 | 3 | 5 | 8 |
| Verify Mirror Integrity | Compares default-branch HEAD SHAs between source and destination for all OSP-bound repos after a mirror stage. Reports mismatches as warnings; configurable hard-fail mode. | Manual | 400 | 50 | 100 | 150 |
| Vouch Check PR | Hybrid A/B/C PR trust gate. Reads VOUCHED.td and changed file paths to select response — denounced authors auto-closed, unknown authors touching sensitive paths blocked, unknown authors on safe paths warned only. | 30 | 3 | 8 | 20 | |
| Vouch Manage | Manages contributor vouch status via issue/PR comments. Maintainers use vouch/unvouch/denounce commands; changes are applied via auto-opened PRs against VOUCHED.td. | Manual | 20 | 2 | 5 | 10 |
| bdfs Package | Packages fork-sync-all as a bdfs workspace (DwarFS + BTRFS). | Manual | 50 | 1 | 2 | 5 |
Tier 4 — Low
| Workflow | Synopsis | Schedule | min_quota | Low | Mid | High |
|---|---|---|---|---|---|---|
| Accessibility PR Gate | Accessibility gate on pull requests. Blocks merge if accessibility violations are found. | 0 | 0 | 0 | 0 | |
| Bootstrap Org | One-shot org bootstrap: fork fork-sync-all into a new org, substitute config, set secrets, dispatch post-bootstrap workflows. | Manual | 100 | 30 | 60 | 80 |
| Branch Hygiene Report | Reports stale and unmerged branches. Manual dispatch only. | Weekly Mon 14:00 UTC | 0 | 0 | 0 | 0 |
| Bugzilla Failure Reporter | Files or updates a Bugzilla bug when a monitored workflow fails; comments on recovery. | Manual | 30 | 2 | 5 | 10 |
| Bugzilla Milestone Ship | Marks Bugzilla target milestone as shipped and notifies resolved bugs when a version tag is pushed. | Manual | 30 | 2 | 8 | 20 |
| Build | Builds the project. Triggered on push/PR. | Manual | 0 | 0 | 0 | 0 |
| Check GitLab CI Sync | Compares paired jobs in .gitlab-ci.yml against config/workflow-sync.yml and reports drift — scripts with changed entry points, mismatched cadence rules, or jobs missing from either side. | Manual | 50 | 2 | 5 | 10 |
| Checks | General checks workflow. Triggered on push/PR. | On push | 0 | 0 | 0 | 0 |
| Clear All Notifications | Marks all GitHub notifications as read for the authenticated user. | Manual | 50 | 1 | 2 | 5 |
| CodeQL | CodeQL security analysis. Triggered on push/PR/schedule. | 0 | 0 | 0 | 0 | |
| Create OOC GitLab Subgroups | Creates the GitLab subgroup structure for OpenOS-Project-Ecosystem-OOC and records the resulting subgroup IDs. | Manual | 50 | 5 | 20 | 50 |
| Critical Deploy — Stub (template — not functional) | Template for new platform critical deploy targets. Non-functional until copied, renamed, and filled in. Update costs when the platform is activated. | Manual | 50 | 5 | 30 | 100 |
| Eco Audit | Audits fork-sync-all against KDE Eco / Blue Angel DE-UZ 215 criteria. Checks green hosting, CI efficiency, telemetry, dependency footprint. Stubs KEcoLab energy measurement for GitLab activation. Weekly on Sundays. | Weekly Sun 05:00 UTC | 50 | 1 | 3 | 5 |
| Export Book (Multi-Engine) | Exports the book to one or all supported engines (mdBook, MkDocs, Docusaurus, Pandoc). Manual dispatch only. | Manual | 0 | 0 | 0 | 0 |
| Generate NotebookLM Content | Generates NotebookLM content artifacts (audio, video, slides, infographic, quiz, flashcards, report) for a given notebook and uploads them to a GitHub Release. | Manual | 50 | 5 | 15 | 30 |
| Generate OSP Dependency Graph | Scans all OSP-bound repos for package.json and requirements.txt files and generates a dependency graph showing inter-repo relationships. | Weekly Sun 03:10 UTC | 100 | 20 | 60 | 150 |
| Generate SBOM | Four-stage SBOM pipeline — Trivy generates CycloneDX+SPDX, sbomasm augments metadata, parlay enriches components, sbomqs scores quality. Runs weekly and on push to main. Release assets attached by OTA Release. | Weekly Tue 02:41 UTC | 10 | 2 | 5 | 10 |
| Generate architecture config | Generates architecture config from org repo metadata. | Manual | 50 | 2 | 5 | 15 |
| GitBook OSS | Manages the GitBook OSS (Next.js) renderer. Actions: build, export, update, dev-info. Weekly update check on Mondays. | Weekly Mon 04:17 UTC | 0 | 0 | 0 | 0 |
| GitLab Storage Scan | Scans all projects under openos-project on GitLab and reports storage usage. Useful for diagnosing when the namespace approaches its 10 GiB limit. | Manual | 50 | 2 | 5 | 10 |
| Inject Repo Motto | Injects repo motto/slogan into README.md files across all orgs. | 30 8 */2 * * | 200 | 5 | 30 | 100 |
| Integrate Shell Tools | Runs smoke tests and integration demos for vendored shell-tools. No GitHub API calls — pure runner execution. Weekly Sunday 03:00 UTC (after sync-shell-tools). | Weekly Sun 03:00 UTC | 50 | 1 | 2 | 5 |
| LTS README Standardisation | Standardises README.md structure for LTS-tagged repos, ensuring they follow the LTS template with correct version badges and support tables. | 19 3 1 * * | 100 | 10 | 40 | 100 |
| List Chromium GitLab Repos | Lists all projects under the Chromium_Browser_OS_Deving GitLab group. Informational only — used to audit what has been mirrored. | Manual | 50 | 2 | 5 | 10 |
| Manage Subtrees | Keeps git subtrees, submodules, and umbrella repo relationships current per config/subtree-manifest.yml. | Weekly Sun 01:00 UTC | 50 | 0 | 0 | 5 |
| Mirror Artifacts | Mirrors GitHub Releases, Flatpak packages, and RPM packages from Interested-Deving-1896 repos to their OSP and OOC counterparts. | Daily 02:10 UTC | 200 | 10 | 50 | 150 |
| Mirror Orgs | Mirrors all repos from Interested-Deving-1896 to OpenOS-Project-OSP and OpenOS-Project-Ecosystem-OOC using bare clone + push --mirror. | Daily 02:17 UTC | 100 | 20 | 60 | 150 |
| Mirror Releases | Mirrors GitHub Releases (tags + release notes + assets) from Interested-Deving-1896 repos to their OSP and OOC counterparts. | Every 12h at :03 | 200 | 10 | 50 | 150 |
| Notification Manager | Hourly notification triage. Auto-marks known-safe patterns (mirror failures, quota artifacts, Dependabot) as read. Supports manual dispatch with list/mark-all-read actions. | 17 * * * * | 200 | 1 | 5 | 15 |
| Notification Poller | Polls GitHub notifications for unread CI failure notifications and triggers resolve-failures immediately when any are found. | Every 4h at :32 | 50 | 1 | 5 | 15 |
| OTA Reconcile | Weekly drift detection and quota-fallback reconcile for mirror-chain consumer repos. Autonomously selects path A (stamp), B (drift PR), or C (quota-recovery PR) per repo based on .ota/version SHA, open PR state, and OTA_SYNC_INCOMPLETE variable. | Weekly Wed 03:17 UTC | 200 | 20 | 80 | 200 |
| PR Labeler | Automatically labels pull requests based on changed paths. Triggered on pull_request. | 50 | 1 | 2 | 5 | |
| README Wizard | AI-guided README authoring — writes or rewrites a README for a specific repo according to custom instructions (audience, tone, sections), respecting existing human-owned markers. | Manual | 100 | 10 | 30 | 60 |
| Rate Limit Status | Queries current rate limit status for all external APIs used by fork-sync-all. On-demand health check. | Manual | 10 | 2 | 3 | 5 |
| Refresh NotebookLM Auth | Rotates the short-lived __Secure-1PSIDTS cookie in NOTEBOOKLM_AUTH_JSON weekly and writes the updated state back to the repo secret. | Weekly Tue 06:17 UTC | 10 | 1 | 2 | 5 |
| Repo Manifest | Exports a manifest of all repos in an org, or imports repos from a manifest into a target GitHub org. Supports multi-platform bulk import. | Manual | 100 | 10 | 40 | 100 |
| Setup GitLab CI Schedules | Replaces all existing GitLab pipeline schedules in openos-project/ops/fork-sync-all with the 3 consolidated CADENCE-based schedules. Safe to re-run. | 50 | 2 | 5 | 10 | |
| Shallow Reclone Large GitLab Mirrors | Reduces GitLab storage usage by replacing full git history on large mirror projects with a shallow clone. Run when openos-project approaches its 10 GiB storage limit. | Manual | 50 | 2 | 5 | 10 |
| Sync Agent Prices | Weekly hybrid A+B+C price refresh for config/agent-cost-profiles.yml. Fetches LiteLLM model_prices_and_context_window.json at a pinned SHA, diffs against current prices, and opens a PR for human review if anything changed. Flags stale manual entries as warnings. Never auto-merges. | Weekly Mon 09:00 UTC | 50 | 3 | 8 | 15 |
| Sync Ona Projects | Reconciles config/ona-projects.yml with the Ona API. Creates or updates Ona projects for all repos in the org chain. Runs in dry-run mode when ONA_TOKEN is absent. | Daily 06:00 UTC | 50 | 1 | 5 | 20 |
| Sync penguins-eggs docs to penguins-eggs-book | Triggered by repository_dispatch from penguins-eggs when docs/chromiumos/ changes on all-features. Syncs the updated docs into the penguins-eggs-book repo. | Manual | 50 | 5 | 15 | 30 |
| Sync to Bugzilla | Parses commits and PRs for Bug NNN references and updates Bugzilla status and comments. | Manual | 50 | 2 | 8 | 20 |
| Test Time Format | Validates time_format.py portability across glibc, musl, and BSD libc. Runs on push/PR to time_format.py. | Manual | 0 | 0 | 0 | 0 |
| Track Agent Costs | Records AI agent session cost estimates (OCUs, USD, tokens) to a structured JSON log. Supports Ona Agent, Codex, GitHub Models, and direct API agents. Builds an observed cost dataset to replace code-audit estimates in DOCS/ai-agent-costs.md over time. | Manual | 10 | 1 | 2 | 3 |
| Translate Docs | Translates DOCS/ mdBook pages into a target language using GitHub Models API. Writes translated files to DOCS/ | 15 11 */2 * * | 100 | 5 | 15 | 30 |
| Translate READMEs | Translates README.md files for OSP-bound repos into additional languages using GitHub Models API. Writes translated files alongside the English original. | 43 10 */2 * * | 100 | 10 | 40 | 100 |
| Trigger Artifact Mirror | Dispatches mirror-artifacts immediately when a release is published in this repo, so OSP and OOC receive the release without waiting for the next scheduled run. | Manual | 50 | 2 | 5 | 10 |
| Update Book Index | Regenerates DOCS/generated/ pages (source tree, glossary, workflow index) on push to main. Commits with [skip ci]. | Manual | 0 | 0 | 0 | 0 |
| Update Infrastructure Dependencies | Scans workflow files across the three-org chain for outdated Actions versions, EOL runners, and EOL Node/Python versions, then opens PRs. | Weekly Mon 06:11 UTC | 200 | 50 | 150 | 250 |
| Update Quota Cost Registry | Reads quota-instrument records from job logs, computes observed p50/p95 REST costs per workflow, and commits updated values to workflow-quota-costs.yml weekly. | Weekly Mon 08:00 UTC | 200 | 30 | 80 | 150 |
| Update Workflow Triggers Doc | Regenerates docs/workflow-triggers.md and docs/workflow-triggers.txt whenever a workflow file changes on main. Commits the result directly to main. | Manual | 50 | 5 | 10 | 20 |
| Update kde-builder vendor | Pulls latest kde-builder upstream into vendor/kde-builder/ via git subtree. Manual dispatch only. | Manual | 0 | 0 | 0 | 0 |
| Upstream Direct Commits from OSP + OOC | Detects commits pushed directly to OSP/OOC default branches (without a PR) and opens PRs against Interested-Deving-1896 to reconcile them. | Daily 03:47 UTC | 200 | 20 | 80 | 200 |
| Upstream PRs from OSP + OOC | Detects commits on OSP and OOC default branches that are not present in Interested-Deving-1896 and opens PRs to bring them upstream. | Daily 03:33 UTC | 200 | 20 | 80 | 200 |
| Upstream Workflow Proposal | Scans OSP-bound repos for new workflow patterns not present in fork-sync-all and opens a PR proposing them as template skeletons. | Weekly Mon 06:06 UTC | 50 | 5 | 20 | 50 |
| Vouch Onboard | Onboards contributors into the vouch registry (admin/self/auto/seed modes). Runs platform verification checks and commits registry + VOUCHED.td changes. Also triggered by vouch-labelled issues. | Daily 03:00 UTC | 30 | 3 | 10 | 25 |
| Vouch Sync Codeowners | Weekly sync of CODEOWNERS entries and org members into VOUCHED.td via vouch-seed.sh. Opens a PR if VOUCHED.td changed. | Weekly Mon 04:23 UTC | 50 | 5 | 15 | 40 |
| btrfs-devel sync | Weekly sync of fs/btrfs/ subtree from kdave/btrfs-devel into this repo via git read-tree. Opens a PR when changes are found. | Weekly Mon 03:00 UTC | 50 | 0 | 1 | 2 |
| opencode | OpenCode AI assistant integration. Triggered on issue/PR comments. | 0 | 0 | 0 | 0 |
✦ Mid value is an observed p50 measurement. All other values are code-audit estimates.