Shared Workflow Org Refs

---
name: shared-workflow-org-refs
description: "Use when creating or editing GitHub Actions workflows that call reusable workflows (uses: OWNER/repo/.github/workflows/...) — org owner references must be the literal current org, and shared-CI homes are under dryvist."
---

# Shared Workflow Org References

GitHub Actions reusable-workflow and action `uses:` clauses are the one place the
"don't rewrite `JacobPEvans/*` on sight — the redirect holds" rule does NOT apply.

Two hard GitHub constraints:

- `uses:` cannot contain expressions or variables — the owner is always a literal.
  `uses: ${{ vars.X }}/repo/...@ref` is rejected. No org variable can centralize it.
- `uses:` does NOT follow repository transfer/rename redirects (by design). API, git, and the browser DO follow them; Actions does not.

Consequence: when a shared-CI repo changes orgs, every consumer's `uses:` fails at parse time
(the run shows zero jobs and "workflow was not found"). There is no runtime variable that prevents this.

## Canonical home: dryvist

**dryvist is the canonical home for everything dryvist uses.** Anything a dryvist
repo consumes — reusable workflows, presets, policies — belongs under `dryvist/*`.
`JacobPEvans-personal/*` may depend on `dryvist/*`; `dryvist/*` must **never** depend
on `JacobPEvans-personal/*`. When a shared workflow is used by dryvist, its home is
`dryvist/.github` (or the relevant `dryvist/*` repo), not the personal account.

Because `uses:` does not follow redirects, reference each workflow by its literal
**current** owner from the table below until a pending relocation actually lands.

| Shared-CI workflow set | Current home | Status |
| --- | --- | --- |
| `ai-workflows` reusable workflows | `dryvist/ai-workflows` | canonical |
| Nix reusable workflows (`_nix-validate.yml`, `_nix-build.yml`) | `dryvist/.github` | canonical |
| Release-please (`_release-please.yml`) | `dryvist/.github` | canonical — org-native (dryvist release App, major-bump block, auto-merge) |
| `_markdown-lint`, `_file-size`, `_osv-scan`, `_ci-gate`, … | `JacobPEvans-personal/.github` | **pending relocation to `dryvist/.github`** |

Nix and release-please were deliberately relocated to `dryvist/.github` (the org owns
its own CI). The remaining non-Nix `.github` workflows are still in
`JacobPEvans-personal/.github` **only until they are moved the same way** — that is a
transitional home, not a permanent one. Repoint consumers via the sweep below as each
moves; do not move any back to the personal account.

## Rules

- In `uses:`, always reference the literal current owner above.
- Do NOT replace a reusable-workflow call with a `gh workflow run` / checkout `vars.*` dispatcher
  just to gain a variable: that loses required-check status, inputs/outputs, and `secrets: inherit`.

## If a shared-CI repo must move anyway (sweep)

1. `gh search code 'OLD_OWNER/REPO' --owner dryvist` (and `--owner JacobPEvans-personal`), filtered to `.github/workflows/*.yml`.
2. Per consumer repo: swap only the `uses:` owner segment, preserving path and `@ref`; one PR per repo.
3. Skip docs and files that are not reusable-workflow callers.
4. Token tiers: dryvist repos → DRYVIST; JacobPEvans-personal repos → PRIVATE.