4.3.1. Starter Workflows, Public and Private

💡 First Principle: A starter workflow is a scaffold offered at the right moment — it appears in the "New workflow" chooser, filtered to the repository's detected languages — so its job is to make the good first draft the easy first draft, not to enforce anything.

GitHub ships a large public catalogue (CI for common languages, deployment, automation, code scanning), and organizations publish their own from the .github repository's workflow-templates directory (3.1.1). Each private template is a pair: my-ci.yml plus my-ci.properties.json supplying name, description, iconName, categories, and optional filePatterns that control when the template surfaces. Placeholder tokens are substituted at creation: $default-branch becomes the repository's default branch, $protected-branches its protected branches.

Visibility follows the .github repository. A public .github repository offers its templates to anyone; an internal or private one offers them to members of the organization — which is precisely what the objectives mean by "consume non-public organization workflow templates." Enterprise Cloud organizations can therefore distribute proprietary pipelines to their own members without publishing them.

The customization expectation is explicit: after creating from a template, the team edits it. Pin the runner image, adjust the matrix, add the org's required security steps. If a scenario says "every repository must run this pipeline identically and stay current," the starter workflow is the wrong answer — that's a reusable workflow, possibly enforced by a required status check or a ruleset.

⚠️ Exam Trap: Starter workflows must live in the organization's .github repository specifically — not in a repository named .github-private, not in an arbitrary "templates" repository — under a top-level workflow-templates folder, with the .properties.json companion. Any other location silently produces no chooser entry.

Reflection Question: Two requirements: "make it easy for teams to start correctly" and "guarantee every team stays current." Explain why a starter workflow satisfies exactly one of them, and what you'd pair it with for the other.