Build Flow Action — Build first. Release last.

Why Build Flow?

Stop manually wiring separate workflows. Let Build Flow orchestrate your entire lifecycle.

🔒

Safe by Default

Releases are always published last — after all artifacts succeed. No more public releases with missing builds.

🔍

Auto-Detection

Detects your ecosystem from lockfiles and manifests. Zero config for most projects — just add one workflow file.

🛡️

Built-in Security

Gitleaks and CodeQL scanning enabled by default. Secrets detection gates releases. Static analysis runs in parallel.

📦

Full Lifecycle

CI, security scanning, package publishing, container builds, and GitHub Releases — all from a single workflow call.

🧹

Clean PRs

Smart check visibility means only relevant checks appear on your pull requests. No skipped-job noise.

⚡

Matrix Testing

Test across multiple runtime versions automatically with built-in dependency caching for fast iterations.

How It Works

A safe dependency graph ensures nothing ships until everything passes.

1

Context Detection

Determines branch, event type, and policy gates.

2

CI Gate

Install, lint, typecheck, test, build — plus Gitleaks secret scanning.

parallel after CI

3a

Package Publishing

npm, PyPI, GitHub Packages

3b

Container Publishing

Docker Hub, GHCR

4

Release Finalization

GitHub Release created last — only after all artifacts succeed.

CodeQL runs independently in parallel — does not gate publishing or release.

Supported Ecosystems

Auto-detected from your lockfiles and manifests. Or bring your own.

🟢

Node.js + Bun

bun.lockb, bun.lock

install, lint, typecheck, test, build

🟩

Node.js

package.json

npm ci, lint, typecheck, test, build

🐍

Python

pyproject.toml, requirements.txt

pip install, pytest

🐹

Go

go.mod

go build, go test

🦀

Rust

Cargo.toml

cargo build, cargo test, cargo clippy

☕

Java

pom.xml, build.gradle

gradlew/mvn build and test

⚙️

C/C++

CMakeLists.txt

cmake build, ctest

🔧

Custom

your commands

Bring your own install, lint, test, build

Available Workflows

Pick the level of orchestration you need.

Recommended

app.yml

Full orchestration: CI + security + package + container + release.

uses: wgtechlabs/build-flow-action/.github/workflows/app.yml@main

ci.yml

CI and security validation only. No publishing or releases.

uses: wgtechlabs/build-flow-action/.github/workflows/ci.yml@main

package.yml

CI + package publishing + release finalization.

uses: wgtechlabs/build-flow-action/.github/workflows/package.yml@main

container.yml

CI + container publishing + release finalization.

uses: wgtechlabs/build-flow-action/.github/workflows/container.yml@main

Getting Started

Add one file. That's it.

1

Create the Workflow File

Add a single workflow file to your repository.

.github/workflows/build-flow.yml

2

Add the Zero-Config Setup

Build Flow auto-detects your project. No configuration needed for most projects.

name: Build Flow

on:
  pull_request:
    branches: [dev, main]
  push:
    branches: [dev, main]

jobs:
  build-flow:
    uses: wgtechlabs/build-flow-action/.github/workflows/app.yml@main
    secrets: inherit

3

Push and Merge

Build Flow handles everything from here — CI, security, packaging, and releases.

Branch Strategy

Designed for Clean Flow. Works with any branch model.

PR to dev or main

CI + security gates

Push to dev

CI + dev artifact publishing

Push to main

CI + publish + release

Manual dispatch

Configurable recovery

Part of the Build Flow Ecosystem

Build Flow orchestrates these WG Technology Labs primitives internally.

release-build-flow-action

Release automation — tag creation and GitHub Release finalization.

View on GitHub →

package-build-flow-action

Package publishing — npm, PyPI, GitHub Packages.

View on GitHub →

container-build-flow-action

Container publishing — Docker Hub, GHCR.

View on GitHub →