First commits

[jsf9k]

🗣 Description

This pull request contains the first commits for a new skeleton for GitHub composite actions.

💭 Motivation and context

We need a skeleton of this type. See, for example, cisagov/action-disable-apparmor and cisagov/action-job-preamble.

🧪 Testing

All automated tests pass.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
• All new and existing tests pass.

✅ Pre-merge checklist

• Finalize version.

✅ Post-merge checklist

• Create a release.

[dav3r]

LGTM, aside from one documentation question.

[mcdonnnj]

Seems straightforward enough. 👍

[mcdonnnj]

I feel like we may benefit from having a tag.sh that is used solely to generate the major (vX) and minor (vX.Y) tags based on the full version tag that would generated when creating a release (if we don't want the script to just create all three and then just select the full version tag when creating the release).

[jsf9k]

I was thinking about that too. This afternoon I started creating a release workflow that will create those tags automatically when a release is created.

[jsf9k]

Please see commits 4156a58 through 666579b, as well as the following GitHub Actions runs:

• https://github.com/cisagov/skeleton-action-composite/actions/runs/13551125481
• https://github.com/cisagov/skeleton-action-composite/actions/runs/13551184170

Once @mcdonnnj resolves this conversation I will do a git rebase to clean up the commit history, remove all the prereleases and tags generated during testing, etc. I think that stuff muddies the history for future folks who review the commits in this repo.

[jsf9k]

Also, if @cisagov/vm-dev folks have any opinions as to my use of zyactions/semver versus any of the other GH Actions listed here please let me know. There are other actions listed there that do the same thing.

[mcdonnnj]

This looks pretty solid. Just a few minor suggestions for your consideration.

[mcdonnnj]

Another consistency one.

Suggested change

	- id: checkout-code
	name: Checkout the code
	uses: actions/checkout@v4
	- uses: actions/checkout@v4

[jsf9k]

I have been trying to add an id and name for every step since I started working with the GH Actions jazz recently. What is your reasoning for not doing that?

[mcdonnnj]

I don't have a reason to not do that, but we should start with cisagov/skeleton-generic and push it down in a consistent manner. This is specifically because we haven't done it with uses of actions/checkout.

[jsf9k]

My intent was to take care of this inconsistency when I'm able to start using reusable workflows via cisagov/github-actions-workflows. In the meantime I'd like to continue using name and id in the new code I am creating.