GitHub Actions

Applies to every workflow — deploys, tests, releases, anything under .github/workflows/.

Rule 1: Prefer established actions over hand-rolled scripts

If a mature, maintained action covers the use case, use it. Hand-roll only when no action covers the case — and say so in the PR. Checking out code, docker login/build/push, cloud auth, uploading artifacts, releases: all covered by first-party or vendor actions (actions/*, docker/*, google-github-actions/*, pulumi/*).

Maturity check for third-party actions: maintained (recent releases), widely used, ideally from the vendor of the tool. Obscure single-maintainer actions holding credentials are worse than a script.

Rule 2: Verify versions at authoring time — never from memory

Your memory of "the current major" is stale. Proof, from a real baseline test (2026-07): a model confidently pinned actions/checkout@v4 and google-github-actions/auth@v2 as "current majors" — the actual latest were v7 and v3. Every version you remember is a version to verify.

The check takes seconds per action:

gh api repos/actions/checkout/releases/latest --jq .tag_name