I published my first GitHub Action. Five things I'd tell myself first

Описание и применение

Автор создал простое действие GitHub Actions, поделился пятью уроками: использовать composite, избегать вставки входных данных в run, передавать секреты через env, фиксировать версии и тщательно тестировать.

Задача

Developers often overlook simple but critical practices when creating GitHub Actions, leading to security and reliability issues.

Результат

The action now runs securely, reliably, and with clear failure handling, demonstrating best practices for composite actions.

Рабочий процесс

• Choose composite action for simple command execution
• Define inputs and avoid embedding them directly in run blocks
• Pass secrets via env instead of command line
• Pin npm package and action version to exact releases
• Test action in its own repo, including failure paths
• Address Marketplace gotchas

Доказательства

A composite action is just a list of steps, like a mini-workflow. No build step, no dist/ folder to commit, no container to pull.

Источник

Never put ${{ inputs.x }} inside run:

Источник

Secrets go in env, not on the command line

Источник

Pin two different things, two different ways

Источник