The one place for cross-repo policy shared by seed, stem, and niac-go.
The goal: make a fleet-wide change by editing one file here, not three repos.
| File | Purpose |
|---|---|
default.json |
Renovate policy preset. Repos extend it with { "extends": ["github>MustardSeedNetworks/.github"] }. Edit dependency/lockstep policy here. |
presets/post-upgrade-generate.json |
Opt-in Renovate preset. A repo that generates code extends github>MustardSeedNetworks/.github//presets/post-upgrade-generate so buf, protoc, and Connect bumps run make generate generate-ts. |
presets/rebase-when-behind.json |
Opt-in Renovate preset. The fleet default rebases only on conflicts. A repo with no merge queue whose branch protection requires the head to be up to date extends github>MustardSeedNetworks/.github//presets/rebase-when-behind after the fleet preset, which sets rebaseWhen to behind-base-branch. |
.github/workflows/*.yml (reusable) |
Shared workflow_call CI gates. Repos call them via uses: MustardSeedNetworks/.github/.github/workflows/<name>.yml@<sha>. The product-CI set is ci-changes, ci-backend (Linux, macOS, Windows), ci-race, ci-frontend, ci-storybook, ci-e2e (Playwright chromium/webkit shards), and ci-complete. ci-complete runs if: ${{ !cancelled() }}. Inputs are in each workflow's header. |
.github/actions/* (composite) |
Shared job steps. Repos call them via uses: MustardSeedNetworks/.github/.github/actions/<name>@<sha>. The reusable product workflows pin apt-install and flake-budget the same way, because a relative uses: ./ inside a called workflow resolves in the caller. |
profile/README.md |
The organization profile shown at https://github.com/MustardSeedNetworks. Logo lives beside it. |
SECURITY.md, CODE_OF_CONDUCT.md |
Org-wide defaults GitHub applies to every repo that has no file of its own. Product repos keep their own. |
ui/theme/msn-shared.css |
The canonical shared interface theme. Every UI repo keeps a byte-identical copy at ui/src/theme/msn-shared.css; ci-conformance compares them by sha256. See ui/theme/README.md. |
scripts/phone-width/ |
The fleet's 390×844 gate — one definition of "works at phone width", run through the reusable phone-width.yml. Adopted per repo, so a new rule never goes live fleet-wide unannounced. See scripts/phone-width/README.md. |
scripts/fleet-status.py |
Writes the fleet STATUS.md: plans of record, open PRs, CI on main, releases, and — on the driver host — driver health and working trees. fleet-status.yml runs the GitHub half on dispatch. |
scripts/check-release-artifacts.py |
Checks that a product's latest release published exactly the artifacts its .github/release-artifacts.txt declares, each with its SBOM and cosign bundle, plus checksums and provenance. release-conformance.yml runs it daily over the four products. |
scripts/i18n/ |
The fleet i18n gate — one canonical copy of the checks; each repo keeps only its own glossary, banned vocabulary and locales. See scripts/i18n/README.md. |
scripts/repo-checks/ |
The repo-local gates the products used to copy (banned vocabulary, @layer components variants, the TypeScript strictness contract, Go package reachability, stale test binaries). CI runs them through the repo-checks composite action; make test and the hooks run them through each repo's scripts/shared-check.sh, a copy of shared-check-shim.sh that reads the same pin from ci.yml. Each repo keeps only its own exclusion list and reachability baseline. |
Share undifferentiated plumbing only (dependency versions, CI gates, build contract, release pipeline, security-crypto policy). Never share product code — product features and authz wrappers stay per-repo, each repo owning its own implementation.
The shared interface theme is the one deliberate exception (owner, 2026-09-15).
It is undifferentiated by definition — the four products are meant to look like
one company — and keeping it per-repo is what let the copies drift into three
versions with every repo green. It is shared as a checked file, not as a
package: decision D6 (no shared TS package) stands, each repo still owns its
copy, and ci-conformance fails the copy that disagrees. The brand tokens
that make a product itself — product-<name>.css — stay per-repo.
See the remediation plan for the full rationale and the duplication scorecard.