I published my first GitHub Action. Five things I'd tell myself first

说明与用途

作者创建了一个简单的 GitHub Action，并分享了五个经验教训：使用 composite、避免在 run 中嵌入输入、通过 env 传递秘密、固定版本并彻底测试。

问题

Developers often overlook simple but critical practices when creating GitHub Actions, leading to security and reliability issues.

结果

The action now runs securely, reliably, and with clear failure handling, demonstrating best practices for composite actions.

工作流

• Choose composite action for simple command execution
• Define inputs and avoid embedding them directly in run blocks
• Pass secrets via env instead of command line
• Pin npm package and action version to exact releases
• Test action in its own repo, including failure paths
• Address Marketplace gotchas

证据

A composite action is just a list of steps, like a mini-workflow. No build step, no dist/ folder to commit, no container to pull.

来源

Never put ${{ inputs.x }} inside run:

来源

Secrets go in env, not on the command line

来源

Pin two different things, two different ways

来源