How does this skill handle GitHub Action security?

The skill prioritizes security by recommending full commit SHA pinning instead of tags and providing patterns for passing untrusted inputs via environment variables to prevent injection attacks.

What is the benefit of using a composite action over a standard workflow?

Composite actions allow you to bundle multiple steps into a single reusable file, reducing duplication across your workflows and making maintenance much easier across different repositories.

Can I use JavaScript inside these composite actions?

Yes, the skill includes specific patterns for using the actions/github-script action to execute JavaScript with pre-authenticated access to the GitHub API and context.

Where should I store the action.yml file?

For private actions within a repository, the standard location is .github/actions/ /action.yml. For published actions, place it in the root of a dedicated repository.

Does this skill help with input validation?

Absolutely. It provides standardized shell script patterns to validate input values at the beginning of the action to ensure only safe and expected data is processed.

GitHub Actions Composite Creator

Name: GitHub Actions Composite Creator
Author: lbussell

bylbussell

デプロイメントとDevOps

Streamlines the creation of secure, reusable GitHub Actions composite actions with built-in best practices and security patterns.

概要

The github-actions-composite skill helps developers architect robust CI/CD components by generating standardized action.yml files. It simplifies the process of bundling multiple workflow steps into reusable units, handling complex input/output mappings, and integrating github-script for JavaScript-based logic. Most importantly, it enforces critical security standards like mandatory commit SHA pinning and safe environment variable handling for untrusted inputs, ensuring your automated workflows are both efficient and secure from supply chain attacks.

主な機能

0 GitHub stars
Standardized action.yml scaffolding for inputs, outputs, and composite runs
Automated enforcement of commit SHA pinning for external actions
Support for conditional steps, multi-line scripts, and custom shell environments
Secure integration patterns for github-script and Octokit API access
Safe input handling patterns to prevent shell and script injection

ユースケース

Refactoring repetitive CI/CD workflow steps into a single reusable internal action
Developing public GitHub Actions with strictly validated inputs and secure defaults
Orchestrating complex automation tasks that require combining shell commands with JavaScript logic

概要

主な機能

0 GitHub stars
Standardized action.yml scaffolding for inputs, outputs, and composite runs
Automated enforcement of commit SHA pinning for external actions
Support for conditional steps, multi-line scripts, and custom shell environments
Secure integration patterns for github-script and Octokit API access
Safe input handling patterns to prevent shell and script injection

ユースケース

Refactoring repetitive CI/CD workflow steps into a single reusable internal action
Developing public GitHub Actions with strictly validated inputs and secure defaults
Orchestrating complex automation tasks that require combining shell commands with JavaScript logic