Q: Your enterprise has 180 microservice repositories maintained by 40 development teams. Currently, each repository maintains its own `.github/workflows/deploy.yml` with duplicated security scans, hardcoded action versions, and inconsistent secret handling. When an audit revealed unpinned third-party actions and unencrypted test reports, the security committee mandated a centralized, immutable CI/CD pipeline template standard. You must design and implement a centralized workflow repository (`org-workflows`) using Reusable Workflows and Composite Actions, enforcing strict permissions, automated matrix testing, and secure secret inheritance without breaking team velocity.

Evaluate the architectural trade-offs: Reusable Workflows run in their own job execution context, support job-level matrix strategies, isolate concurrency groups, and strictly control secret and token delegation via `secrets: inherit` or explicit inputs. Composite Actions run as sequential steps within an existing caller job, sharing the caller's environment, filesystem workspace, and process space without supporting independent job-level matrices or distinct runner labels.

<!-- Architecture Comparison -->
Caller Job
  ├── Step: actions/checkout@v4
  ├── Step: org-workflows/.github/actions/setup-java@v2  <-- Composite Action (Shares FS & Env)
  └── Step: Run Unit Tests

Caller Workflow
  └── Job: call-build-deploy
        └── uses: org-workflows/.github/workflows/maven-deploy.yml@v3  <-- Reusable Workflow (Isolated Job Context, Matrix Support)

Define `.github/workflows/deploy-service.yml` in the centralized `infra-ci` repository. Specify mandatory input validation, pinned SHA actions, least-privilege `permissions` blocks, and typed outputs for downstream notification jobs.

name: Standard Microservice Pipeline
on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
      docker_context:
        required: false
        type: string
        default: '.'
    secrets:
      AWS_ROLE_ARN:
        required: true
    outputs:
      image_tag:
        description: 'Generated immutable image digest'
        value: ${{ jobs.build.outputs.digest }}

permissions:
  contents: read
  id-token: write

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build-image.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1

Protect the centralized workflow repository with strict semantic version tags (e.g., `@v2`, `@v2.1.0`) and immutable release branches. Configure Dependabot to automatically generate pull requests for GitHub Actions dependencies using SHA-256 commit hashes to eliminate tag mutation attacks.

Refactor application repositories to consume the centralized workflow using a 15-line stub file. Eliminate all local credential configurations by delegating OIDC role assuming to the centralized template.

name: CI/CD
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  pipeline:
    uses: enterprise-org/infra-ci/.github/workflows/deploy-service.yml@v2.4.0
    with:
      environment: ${{ github.ref == 'refs/heads/main' && 'production' || 'staging' }}
    secrets:
      AWS_ROLE_ARN: ${{ secrets.PROD_OIDC_ROLE_ARN }}