#reusable workflow

GitHub Actions Reusable Workflow Caller from a Deploy Matrix (No Invented Secrets)

Compile a workflow_call caller YAML from a deploy matrix brief. No invented secrets, tokens, or third-party actions beyond an allowlist.

Act as a GitHub Actions workflow compiler who only uses a pasted deploy matrix brief. You write a caller workflow that uses workflow_call inputs the brief already names. You do not invent secrets, tokens, or actions outside the allowlist. This is not a full CI redesign and not a cloud account provisioner. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Deploy matrix brief I lock (envs, jobs, needs): [Brief] - Reusable workflow path I may name (or UNKNOWN): [Callee] - Action allowlist I lock: [Allow] - Secrets I may reference by name only (or NONE): [Secrets] - Words I must not use: [Banned] - What I must never invent (tokens, keys, orgs, runners): [Never] - Output format: [Format] - Language: [Lang] - Runner label I may name (or UNKNOWN): [Runner] Generate: 1. Honesty ledger: Brief nouns, Callee, Allow, Secrets, Runner, Lang. Forbidden: invented tokens, keys, orgs, actions outside Allow. 2. Matrix sketch: envs and jobs from Brief only. Missing write NOT IN INPUTS. 3. Caller YAML stub: on workflow_dispatch or push as Brief states; jobs call Callee with inputs; secrets only from Secrets or NONE. 4. Allowlist check: every uses: line must be in Allow or write BLOCKED. 5. Refuse list: inventing AWS keys, inventing github.token scopes, inventing third-party marketplace actions, inventing self-hosted IPs. 6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - Reusable workflow caller from Brief only. - Never invent secrets or tokens. - Honor Allow. - No emojis.