I published my first GitHub Action. Five things I'd tell myself first

Description and use

The author built a simple GitHub Action and shares five lessons: use composite, avoid embedding inputs in run, pass secrets via env, pin versions, and test thoroughly.

Problem

Developers often overlook simple but critical practices when creating GitHub Actions, leading to security and reliability issues.

Outcome

The action now runs securely, reliably, and with clear failure handling, demonstrating best practices for composite actions.

Workflow

• Choose composite action for simple command execution
• Define inputs and avoid embedding them directly in run blocks
• Pass secrets via env instead of command line
• Pin npm package and action version to exact releases
• Test action in its own repo, including failure paths
• Address Marketplace gotchas

Evidence

A composite action is just a list of steps, like a mini-workflow. No build step, no dist/ folder to commit, no container to pull.

Source

Never put ${{ inputs.x }} inside run:

Source

Secrets go in env, not on the command line

Source

Pin two different things, two different ways

Source