Xemantic .github Repository

This is the special .github repository for the Xemantic GitHub organization. It supplies the public organization profile, the contributor documents that apply to every Xemantic project, and the reusable GitHub Actions workflows that the other repositories call.

• profile/README.md — rendered publicly on github.com/xemantic
• profile/ABOUT.md — about page; the region between the <!-- loc --> markers is generated, see Code statistics

These apply to every repository in the organization, not just this one.

• CONTRIBUTING.md — how to contribute
• CODE_OF_CONDUCT.md — adapted from Contributor Covenant 3.0
• CLA.md — Individual Contributor License Agreement, signed via CLA Assistant

Called from other repositories — see Using the reusable workflows.

• build-gradle.yml — configurable Gradle build, publishing and release
• claude-code.yml — responds to @claude mentions in issues and pull requests
• claude-code-review.yml — automated Claude review of pull requests

• code-statistics.yml — updates the statistics in profile/ABOUT.md
• action-version-updater.yml — keeps action versions current
• claude.yml — applies claude-code.yml to this repository
• review.yml — applies claude-code-review.yml to this repository

The last two are the smallest working examples of calling the reusable workflows.

• scripts/count-loc.sh — clones the organization's repositories and counts lines of code
• scripts/update-stats.sh — writes those counts into profile/ABOUT.md

Reference them by path and ref, and pass secrets: inherit:

jobs:
  build:
    uses: xemantic/.github/.github/workflows/build-gradle.yml@main
    secrets: inherit
    with:
      gradle_args: build

secrets: inherit is required rather than optional. build-gradle.yml reads publishing, signing and announcement secrets directly from the calling repository's context instead of declaring them as workflow inputs, so without inherit they resolve to empty strings and the build fails late, during publication.

The single declared secret is env_secrets, taking secret environment variables as KEY=value lines. The boolean inputs above gate additional secrets that are read from the caller's context:

• maven_central — MAVEN_CENTRAL_USERNAME, MAVEN_CENTRAL_PASSWORD, SIGNING_KEY, SIGNING_PASSWORD
• jreleaser — DISCORD_ANNOUNCEMENTS_WEBHOOK, LINKEDIN_ACCESS_TOKEN, LINKEDIN_OWNER, BLUESKY_PASSWORD, and the BLUESKY_HOST and BLUESKY_HANDLE variables
• anthropic — ANTHROPIC_API_KEY
• moonshot — MOONSHOT_API_KEY, and the MOONSHOT_API_BASE_URL and MOONSHOT_DEFAULT_MODEL variables

The workflow file is authoritative; consult it when in doubt.

Requires the CLAUDE_CODE_OAUTH_TOKEN secret. The calling workflow supplies the triggers, and the job runs only when the comment, issue title or issue body contains @claude. See claude.yml for the triggers this repository uses.

Requires the CLAUDE_CODE_OAUTH_TOKEN secret. Reviews pull requests for code quality, bugs, performance, security and test coverage, using the calling repository's CLAUDE.md for conventions, and posts the review as a pull request comment. See review.yml.

code-statistics.yml runs weekly on Sundays at midnight UTC, or on manual trigger. It clones every public non-fork repository in the organization, counts lines of code with cloc, which detects languages automatically, and rewrites the table between the <!-- loc --> markers in profile/ABOUT.md.

Because main is protected, the workflow opens or updates a pull request rather than pushing directly. Hand-edits inside the markers are overwritten on the next run.

action-version-updater.yml runs daily at midnight UTC, or on manual trigger, and raises updates for outdated action versions.

Repositories calling build-gradle.yml with maven_central, jreleaser, anthropic or moonshot enabled additionally need the secrets and variables listed under Build Gradle.