redline.yml

What this is

The thin per-repo caller workflow — the only workflow file an onboarded repo owns for the gate. Everything else lives centrally in the org .github repo.

How to onboard it

• Installed as: .github/workflows/redline.yml
• Installed by: redline init, verbatim — this exact file, with the org name and the gate's ADR threshold, dependency-severity floor and soft-fail labels filled in.

How to use it

Leave it alone once installed. If the org's reusable gate location ever moves, every repo's copy of this file needs the org path updated — there's no sync mechanism for that yet (see redline-sync.yml).

• Triggers on pull_request (opened, synchronize, reopened, edited, labeled, unlabeled, ready_for_review) and calls the reusable workflow by org path: <org>/.github/.github/workflows/redline-gate.yml@main.
• The job id is literally redline-gate. Do not rename it: the branch ruleset requires the check context redline-gate / gate, derived from this job id plus the aggregate gate job id inside the reusable workflow — renaming either half makes the required check unreportable and silently blocks every PR in the repo.

Expected output

.github/workflows/redline.yml in the onboarded repository, and through it the redline-gate / gate status check on every pull request. It produces no output of its own — it exists to call the org's reusable gate with this repository's thresholds.

How to edit it

The real source: This template file, which redline init installs verbatim. The job id redline-gate is load-bearing: the required check context derives from it, so renaming it makes the check unreportable and blocks every pull request in the repository.

1. Check whether the CLI reads this file at allSeveral of these are reference shapes: the CLI generates the equivalent in code and never opens the checked-in copy. Editing one of those changes nothing about what redline init writes. The onboarding section above says which kind this is.
2. Edit the real sourceFor a generated artifact that is cli/commands/init.ts; for a file installed verbatim it is the template itself.
3. npm test && node scripts/validate.mjsThe install path is unit-tested against a fake host client, and validate.mjs pins the shapes the merge gate's required check name depends on.

The full file

# Managed by Redline. Regenerate with `redline init`; edits here are overwritten.
#
# Keep the job id `redline-gate`: the branch ruleset requires the check
# `redline-gate / gate`, which is built from this id. Renaming it makes that
# check unreportable.

name: Redline

on:
  pull_request:
    types: [opened, synchronize, reopened, edited, labeled, unlabeled, ready_for_review]

permissions:
  contents: read
  pull-requests: write

concurrency:
  group: redline-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  redline-gate:
    uses: <org>/.github/.github/workflows/redline-gate.yml@main
    with:
      adr-diff-threshold: 300
      fail-on-dependency-severity: high
      soft-fail-labels: redline-exempt,redline-sync
      # Written by `redline init --rung`. observe and warn report without blocking;
      # block-blocker and block-high stop a merge. The security floor — dependency
      # review and the secret scan — is not on this ladder and blocks at every rung.
      rung: observe
      # Gate jobs another tool in this repository already covers, written by
      # `redline init` from the tools you declared. A stood-down job is skipped
      # and the aggregate reads a skip as a pass. Empty runs every job.
      stand-down: ''