diff --git a/enforce-flutter-version/action.yml b/enforce-flutter-version/action.yml
new file mode 100644
index 0000000..3490ba4
--- /dev/null
+++ b/enforce-flutter-version/action.yml
@@ -0,0 +1,36 @@
+name: 'Enforce Flutter Version Constraint'
+description: 'Scans all pubspec.yaml files to ensure they use the required Flutter SDK constraint.'
+inputs:
+  expected_version:
+    description: 'The exact Flutter SDK constraint expected (e.g., ^3.19.0)'
+    required: true
+    default: '^3.19.0'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Scan pubspec files
+      shell: bash
+      run: |
+        ERROR_COUNT=0
+        EXPECTED="${{ inputs.expected_version }}"
+        
+        while IFS= read -r -d '' pubspec; do
+          # Skip non-Flutter Dart packages
+          if ! grep -q "sdk:[[:space:]]*flutter" "$pubspec" && ! grep -q "^flutter:" "$pubspec"; then
+            echo "Skipping non-Flutter package: $pubspec"
+            continue
+          fi
+
+          CONSTRAINT=$(awk '/^environment:/{flag=1; next} /^[^ ]/{flag=0} flag && /^  flutter:/ {print $2}' "$pubspec" | tr -d "'" | tr -d '"')
+          
+          if [ "$CONSTRAINT" != "$EXPECTED" ]; then
+            echo "::error file=$pubspec::Invalid Flutter constraint in $pubspec. Expected '$EXPECTED', found '$CONSTRAINT'."
+            ERROR_COUNT=$((ERROR_COUNT+1))
+          fi
+        done < <(find . -name "pubspec.yaml" -print0)
+
+        if [ $ERROR_COUNT -gt 0 ]; then
+          echo "Workflow failed: Found $ERROR_COUNT pubspec(s) with unauthorized Flutter SDK constraints."
+          exit 1
+        fi
diff --git a/run-buildifier/action.yml b/run-buildifier/action.yml
new file mode 100644
index 0000000..b4d1135
--- /dev/null
+++ b/run-buildifier/action.yml
@@ -0,0 +1,17 @@
+name: 'Run Buildifier'
+description: 'Downloads and runs buildifier on Starlark files.'
+inputs:
+  version:
+    description: 'Buildifier version to download'
+    required: false
+    default: 'v8.0.1'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Run Buildifier
+      shell: bash
+      run: |
+        curl -sSL "https://github.com/bazelbuild/buildtools/releases/download/${{ inputs.version }}/buildifier-linux-amd64" -o buildifier
+        chmod +x buildifier
+        ./buildifier --mode=check -r .
diff --git a/setup-bazel/action.yml b/setup-bazel/action.yml
new file mode 100644
index 0000000..5f80e80
--- /dev/null
+++ b/setup-bazel/action.yml
@@ -0,0 +1,32 @@
+name: 'Setup Bazel (Bazelisk)'
+description: 'Installs Node, Bazelisk, and configures Git for private SSH dependencies.'
+inputs:
+  node_version:
+    description: 'Node.js version'
+    required: false
+    default: '24'
+  git_token:
+    description: 'Gitea token for private dependency authentication'
+    required: false
+    default: ''
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ inputs.node_version }}
+
+    - name: Set up Bazel (Bazelisk)
+      shell: bash
+      run: |
+        if ! command -v bazel &> /dev/null && ! command -v bazelisk &> /dev/null; then
+          npm install -g @bazel/bazelisk
+        fi
+
+    - name: Configure Git for private SSH dependencies
+      if: ${{ inputs.git_token != '' }}
+      shell: bash
+      run: |
+        git config --global url."https://${{ inputs.git_token }}@git.rodydavis.dev/".insteadOf "ssh://git@git.rodydavis.dev:2222/"