Extract repeated setup steps into reusable composite actions

.github/actions/setup-git/README.md

@@ -0,0 +1,25 @@
+# Set up Git
+
+This composite action configures SSH authentication, Git user identity, and optional commit signing.
+
+## Simple usage example
+
+```yml
+steps:
+  - uses: actions/checkout@v4
+  - uses: ./.github/actions/setup-git
+    with:
+      ssh-private-key: ${{ secrets.GITHUB_USER_SSH_KEY }}
+      user-email: ${{ secrets.GITHUB_USER_EMAIL }}
+      user-name: ${{ secrets.GITHUB_USER_NAME }}
+```
+
+## Inputs
+
+| Name                | Default   | Description                                                                                                      |
+|---------------------|-----------|------------------------------------------------------------------------------------------------------------------|
+| `ssh-private-key`   | `''`      | Private SSH key for authentication.                                                                              |
+| `user-email`        | `''`      | Git user email.                                                                                                  |
+| `user-name`         | `''`      | Git user name.                                                                                                   |
+| `ssh-public-key`    | `''`      | Public SSH key for commit signing.                                                                               |
+| `automated-commits` | `'false'` | Enable Git settings for automated commits (auto-tracks remote branches on push, silences ignored-file warnings). |

.github/actions/setup-git/action.yml

@@ -0,0 +1,58 @@
+name: Set up Git
+description: Set up SSH agent, Git identity, and optional commit signing.
+
+inputs:
+  ssh-private-key:
+    description: Private SSH key for authentication.
+    default: ''
+    required: false
+  user-email:
+    description: Git user email.
+    default: ''
+    required: false
+  user-name:
+    description: Git user name.
+    default: ''
+    required: false
+  ssh-public-key:
+    description: Public SSH key for commit signing.
+    default: ''
+    required: false
+  automated-commits:
+    description: Enable Git settings for automated commits (auto-tracks remote branches on push, silences ignored-file warnings).
+    default: 'false'
+    required: false
+
+runs:
+  using: composite
+  steps:
+    - name: Set up SSH
+      if: ${{ inputs.ssh-private-key != '' }}
+      uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
+      with:
+        ssh-private-key: ${{ inputs.ssh-private-key }}
+
+    - name: Set up Git identity
+      if: ${{ inputs.user-email != '' && inputs.user-name != '' }}
+      shell: bash
+      run: |
+        git config --global user.email "${{ inputs.user-email }}"
+        git config --global user.name "${{ inputs.user-name }}"
+
+    - name: Set up Git configuration
+      if: ${{ inputs.automated-commits == 'true' }}
+      shell: bash
+      run: |
+        git config --global advice.addIgnoredFile false
+        git config --global push.autoSetupRemote true
+
+    - name: Set up commit signing
+      if: ${{ inputs.ssh-public-key != '' }}
+      shell: bash
+      run: |
+        : # Create empty SSH private key file so Git does not complain.
+        touch "${{ runner.temp }}/signingkey"
+        echo "${{ inputs.ssh-public-key }}" > "${{ runner.temp }}/signingkey.pub"
+        git config --global commit.gpgsign true
+        git config --global gpg.format ssh
+        git config --global user.signingkey "${{ runner.temp }}/signingkey.pub"

.github/actions/setup-node/README.md

@@ -0,0 +1,26 @@
+# Set up Node
+
+This composite action sets up Node.js, automatically detects lock files for dependency caching, and installs project dependencies.
+
+## Simple usage example
+
+```yml
+steps:
+  - uses: actions/checkout@v4
+  - uses: ./.github/actions/setup-node
+    with:
+      registry-url: ${{ inputs.NPM_REGISTRY_DOMAIN }}
+      node-auth-token: ${{ secrets.NPM_REGISTRY_TOKEN }}
+```
+
+## Inputs
+
+| Name                   | Default                         | Description                                                                                                 |
+|------------------------|---------------------------------|-------------------------------------------------------------------------------------------------------------|
+| `node-version`         | `'18'`                          | Node version to set up.                                                                                     |
+| `node-version-file`    | `''`                            | Path to a file containing the Node version (takes precedence over `node-version`).                          |
+| `registry-url`         | `'https://npm.pkg.github.com/'` | npm registry URL.                                                                                           |
+| `node-auth-token`      | `''`                            | Authentication token for the npm registry.                                                                  |
+| `node-options`         | `''`                            | Space-separated list of command-line Node options.                                                          |
+| `package-manager`      | `'npm'`                         | Package manager to use (`npm` or `yarn`). **Deprecated:** yarn support will be removed in a future version. |
+| `install-dependencies` | `'true'`                        | Whether to install dependencies (`'true'` or `'false'`).                                                    |

.github/actions/setup-node/action.yml

@@ -0,0 +1,85 @@
+name: Set up Node
+description: Set up Node with cache detection and dependency installation.
+
+inputs:
+  node-version:
+    description: Node version to set up.
+    default: '18'
+    required: false
+  node-version-file:
+    description: Path to a file containing the Node version (takes precedence over node-version).
+    default: ''
+    required: false
+  registry-url:
+    description: npm registry URL.
+    default: 'https://npm.pkg.github.com/'
+    required: false
+  node-auth-token:
+    description: Authentication token for the npm registry.
+    default: ''
+    required: false
+  node-options:
+    description: Space-separated list of command-line Node options.
+    default: ''
+    required: false
+  package-manager:
+    description: "Package manager to use (npm or yarn). Deprecated: yarn support will be removed in a future version."
+    default: 'npm'
+    required: false
+  install-dependencies:
+    description: Whether to install dependencies ('true' or 'false').
+    default: 'true'
+    required: false
+
+runs:
+  using: composite
+  steps:
+    - name: Package manager deprecation warning
+      if: ${{ inputs.package-manager != 'npm' }}
+      shell: bash
+      run: |
+        echo "::warning::The package-manager input is deprecated and will be removed soon. Please update your workflow to use npm."
+
+    - name: Detect cache mode
+      id: cache-detection
+      shell: bash
+      run: |
+        CACHE_MODE=""
+        if [ "${{ inputs.package-manager }}" == 'npm' ] && { [ -f "${GITHUB_WORKSPACE}/package-lock.json" ] || [ -f "${GITHUB_WORKSPACE}/npm-shrinkwrap.json" ]; }; then
+          CACHE_MODE="npm"
+        elif [ "${{ inputs.package-manager }}" == 'yarn' ] && [ -f "${GITHUB_WORKSPACE}/yarn.lock" ]; then
+          CACHE_MODE="yarn"
+        else
+          echo "No lock files found for ${{ inputs.package-manager }}"
+        fi
+        echo "cache-mode=$CACHE_MODE" >> "$GITHUB_OUTPUT"
+
+    - name: Set up Node
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      env:
+        NODE_OPTIONS: ${{ inputs.node-options }}
+        NODE_AUTH_TOKEN: ${{ inputs.node-auth-token }}
+      with:
+        node-version: ${{ inputs.node-version-file && '' || inputs.node-version }}
+        node-version-file: ${{ inputs.node-version-file }}
+        registry-url: ${{ inputs.registry-url }}
+        cache: ${{ steps.cache-detection.outputs.cache-mode }}
+
+    - name: Install dependencies
+      if: ${{ inputs.install-dependencies == 'true' }}
+      shell: bash
+      run: |
+        CACHE_MODE="${{ steps.cache-detection.outputs.cache-mode }}"
+        if [ "${{ inputs.package-manager }}" == 'yarn' ]; then
+          if [ "$CACHE_MODE" == 'yarn' ]; then
+            yarn --frozen-lockfile
+          else
+            yarn install
+          fi
+        else
+          if [ "$CACHE_MODE" == 'npm' ]; then
+            npm ci
+          else
+            npm install
+          fi
+        fi

.github/actions/setup-php/README.md

@@ -0,0 +1,26 @@
+# Set up PHP
+
+This composite action sets up PHP, validates `composer.json`/`composer.lock`, and installs Composer dependencies.
+
+## Simple usage example
+
+```yml
+steps:
+  - uses: actions/checkout@v4
+  - uses: ./.github/actions/setup-php
+    with:
+      composer-auth-json: ${{ secrets.COMPOSER_AUTH_JSON }}
+```
+
+## Inputs
+
+| Name                 | Default           | Description                                                                               |
+|----------------------|-------------------|-------------------------------------------------------------------------------------------|
+| `php-version`        | `'8.2'`           | PHP version to set up.                                                                    |
+| `php-extensions`     | `''`              | PHP extensions to install.                                                                |
+| `php-tools`          | `'composer'`      | PHP tools to install (e.g. `composer`, `cs2pr`, `parallel-lint`).                         |
+| `coverage`           | `'none'`          | Code coverage driver (`none`, `xdebug`, `pcov`, or empty for default).                    |
+| `composer-install`   | `'true'`          | Whether to validate and install Composer dependencies (`'true'` or `'false'`).            |
+| `composer-options`   | `'--prefer-dist'` | Arguments passed to Composer install.                                                     |
+| `composer-auth-json` | `''`              | Authentication for privately hosted packages and repositories as a JSON formatted object. |
+

.github/actions/setup-php/action.yml

@@ -0,0 +1,56 @@
+name: Set up PHP
+description: Set up PHP, validate and install Composer dependencies.
+
+inputs:
+  php-version:
+    description: PHP version to set up.
+    default: '8.2'
+    required: false
+  php-extensions:
+    description: PHP extensions to install.
+    default: ''
+    required: false
+  php-tools:
+    description: PHP tools to install (e.g. composer, cs2pr, parallel-lint).
+    default: 'composer'
+    required: false
+  coverage:
+    description: Code coverage driver (none, xdebug, pcov, or empty for default).
+    default: 'none'
+    required: false
+  composer-install:
+    description: Whether to validate and install Composer dependencies ('true' or 'false').
+    default: 'true'
+    required: false
+  composer-options:
+    description: Arguments passed to Composer install.
+    default: '--prefer-dist'
+    required: false
+  composer-auth-json:
+    description: Authentication for privately hosted packages and repositories as a JSON formatted object.
+    default: ''
+    required: false
+
+runs:
+  using: composite
+  steps:
+    - name: Set up PHP
+      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+      with:
+        php-version: ${{ inputs.php-version }}
+        extensions: ${{ inputs.php-extensions }}
+        tools: ${{ inputs.php-tools }}
+        coverage: ${{ inputs.coverage }}
+
+    - name: Validate composer.json and composer.lock
+      if: ${{ inputs.composer-install == 'true' }}
+      shell: bash
+      run: composer validate
+
+    - name: Install Composer dependencies
+      if: ${{ inputs.composer-install == 'true' }}
+      uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
+      env:
+        COMPOSER_AUTH: ${{ inputs.composer-auth-json }}
+      with:
+        composer-options: ${{ inputs.composer-options }}

.github/workflows/automatic-release.yml

@@ -44,13 +44,13 @@ jobs:
           sparse-checkout-cone-mode: false
           path: semantic-release-repo
 
-      - name: Set up node
-        uses: actions/setup-node@v4
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
+      - name: Set up Node
+        uses: inpsyde/reusable-workflows/.github/actions/setup-node@main
         with:
           node-version-file: semantic-release-repo/package.json
           registry-url: ${{ inputs.NPM_REGISTRY_DOMAIN }}
+          node-auth-token: ${{ secrets.NPM_REGISTRY_TOKEN }}
+          install-dependencies: 'false'
 
       - name: Install dependencies
         run: |
@@ -68,25 +68,13 @@ jobs:
           persist-credentials: false
           ssh-key: ${{ secrets.GITHUB_USER_SSH_KEY }}
 
-      - name: Set up SSH
-        env:
-          GITHUB_USER_SSH_KEY: ${{ secrets.GITHUB_USER_SSH_KEY }}
-        if: ${{ env.GITHUB_USER_SSH_KEY != '' }}
-        uses: webfactory/ssh-agent@v0.9.1
+      - name: Set up Git
+        uses: inpsyde/reusable-workflows/.github/actions/setup-git@main
         with:
-          ssh-private-key: ${{ env.GITHUB_USER_SSH_KEY }}
-
-      - name: Set up signing commits
-        env:
-          GITHUB_USER_SSH_PUBLIC_KEY: ${{ secrets.GITHUB_USER_SSH_PUBLIC_KEY }}
-        if: ${{ env.GITHUB_USER_SSH_PUBLIC_KEY != '' }}
-        run: |
-          : # Create empty SSH private key file so Git does not complain.
-          touch "${{ runner.temp }}/signingkey"
-          echo "${{ env.GITHUB_USER_SSH_PUBLIC_KEY }}" > "${{ runner.temp }}/signingkey.pub"
-          git config --global commit.gpgsign true
-          git config --global gpg.format ssh
-          git config --global user.signingkey "${{ runner.temp }}/signingkey.pub"
+          ssh-private-key: ${{ secrets.GITHUB_USER_SSH_KEY }}
+          ssh-public-key: ${{ secrets.GITHUB_USER_SSH_PUBLIC_KEY }}
+          user-email: ${{ secrets.GITHUB_USER_EMAIL }}
+          user-name: ${{ secrets.GITHUB_USER_NAME }}
 
       - name: Check presence of release.config.js
         run: |
@@ -113,25 +101,8 @@ jobs:
         run: |
           rm -rf workflow-repo
 
-      - name: Set up release environment variables
-        env:
-          GITHUB_USER_EMAIL: ${{ secrets.GITHUB_USER_EMAIL }}
-          GITHUB_USER_NAME: ${{ secrets.GITHUB_USER_NAME }}
-        run: |
-          ${{ env.GITHUB_USER_EMAIL != '' }} && echo "GIT_AUTHOR_EMAIL=${{ env.GITHUB_USER_EMAIL }}" >> $GITHUB_ENV || true
-          ${{ env.GITHUB_USER_NAME != '' }} && echo "GIT_AUTHOR_NAME=${{ env.GITHUB_USER_NAME }}" >> $GITHUB_ENV || true
-          ${{ env.GITHUB_USER_EMAIL != '' }} && echo "GIT_COMMITTER_EMAIL=${{ env.GITHUB_USER_EMAIL }}" >> $GITHUB_ENV || true
-          ${{ env.GITHUB_USER_NAME != '' }} && echo "GIT_COMMITTER_NAME=${{ env.GITHUB_USER_NAME }}" >> $GITHUB_ENV || true
-
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_USER_TOKEN != '' && secrets.GITHUB_USER_TOKEN || secrets.GITHUB_TOKEN }}
         run: npx semantic-release
 
-      - name: Delete signing key files
-        env:
-          GITHUB_USER_SSH_PUBLIC_KEY: ${{ secrets.GITHUB_USER_SSH_PUBLIC_KEY }}
-        if: ${{ always() && env.GITHUB_USER_SSH_PUBLIC_KEY != '' }}
-        run: |
-          rm -f "${{ runner.temp }}/signingkey"
-          rm -f "${{ runner.temp }}/signingkey.pub"