redline-collect.yml
Nightly telemetry collection across the org. Lives in the redline-metrics repo.
What this is
Pulls review outcomes for merged PRs across the org and commits them as monthly JSONL, via scripts/collect-telemetry.mjs.
How to onboard it
Copy this file into the redline-metrics repository as .github/workflows/redline-collect.yml and set REDLINE_ORG_READ_TOKEN there. It is org infrastructure, not something a product repo installs.
- Lives in: The redline-metrics repo — not this one.
- Trigger: Daily at 05:00 UTC, plus workflow_dispatch with a days input (default 8).
How to use it
Nothing, normally — it runs itself nightly. Trigger it by hand with workflow_dispatch to backfill a gap after an outage.
What a run does, in order:
- Runs scripts/collect-telemetry.mjs with GH_TOKEN, ORG and DAYS from the environment.
- Commits any changed files under data/ as "data: telemetry through <date>", rebasing against the branch before pushing so a concurrent digest commit doesn't collide.
Works, but only where installed: needs REDLINE_ORG_READ_TOKEN configured on the redline-metrics repo. It is org infrastructure for telemetry, not something a product repo runs.
Expected output
Monthly JSONL files under data/, committed as "data: telemetry through <date>". One record per reviewed pull request, carrying the rule ids cited and whether each finding was acted on. Nothing is published — the dashboard and digest read these files.
How to edit it
- Edit the YAML in workflows/ or .github/workflows/workflows/ holds files destined for other repositories; .github/workflows/ is this repository's own CI. The two are not interchangeable — check where this one lives before editing.
- actionlintCI lints .github/workflows/*.yml, workflows/*.yml and templates/redline.yml together. workflows/ is pointed at explicitly because actionlint's own discovery would skip it.
- node scripts/check-pins.mjsIf you add a third-party action, pin it to a 40-character commit SHA with a trailing # vX.Y.Z comment. First-party actions/* are referenced by tag. The pin checker re-resolves the SHA against the tag the comment claims.
- node scripts/validate.mjsAsserts the workflow files the bundle depends on still exist, and that the gate's job ids still match the required check name derived from them.
The full file
# Lives in the redline-metrics repo. Pulls review outcomes for merged PRs across the org
# and commits them as monthly JSONL.
#
# Replaces the old per-repo telemetry workflow: no Redline secret is stored in any
# product repo, so onboarding a repo grants Redline no write access to anything.
name: Redline Collect
on:
schedule:
- cron: '0 5 * * *'
workflow_dispatch:
inputs:
days:
description: Look-back window in days
type: string
default: '8'
permissions:
contents: write
concurrency:
group: redline-collect
cancel-in-progress: false
jobs:
collect:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 22
- name: Collect telemetry
env:
# Read-only: repo metadata + pull requests across the org. No write scope.
# The token travels as an environment variable rather than a flag: a
# command line is visible in the process table.
GH_TOKEN: ${{ secrets.REDLINE_ORG_READ_TOKEN }}
run: |
npx --yes "redlinegate@0.0.3" metrics collect \
--org "${{ github.repository_owner }}" \
--days "${{ inputs.days || '8' }}" \
--out data
- name: Commit
run: |
set -euo pipefail
if git diff --quiet -- data; then
echo "no telemetry changes" >> "$GITHUB_STEP_SUMMARY"
exit 0
fi
git config user.name "redline-bot"
git config user.email "redline-bot@users.noreply.github.com"
git add data
git commit -m "data: telemetry through $(date -u +%Y-%m-%d)"
# Another run (or a digest commit) may have landed since checkout.
git pull --rebase origin "${GITHUB_REF_NAME}"
git push origin "HEAD:${GITHUB_REF_NAME}"
git diff --stat HEAD~1 -- data >> "$GITHUB_STEP_SUMMARY"