GitHub Action

A GitHub Action is a reusable executable dependency. Design it like a small public API plus a supply-chain package.

The security boundary includes action.yml, its runtime, bundled/generated files, nested actions, scripts/binaries, dependencies, release tags, and the privileges supplied by the consuming workflow.

Define the action contract first

Specify:

• supported action type/runtime;
• inputs, outputs, defaults, and validation;
• required secrets or credentials;
• minimum GITHUB_TOKEN permissions expected from callers;
• network/filesystem/process side effects;
• supported runner operating systems/architectures;
• behavior on failure, cancellation, and cleanup;
• files generated or modified in the caller workspace.