Distillation

🔴 (10:09) User directed that when creating workflows and actions, always consider whether code might execute untrusted input from possible attackers; attacker-controlled GitHub contexts must be treated as untrusted input.

🔴 (10:09) GitHub Actions contexts documented in the supplied reference are: github, env, vars, job, jobs (reusable workflows only), steps, runner, secrets, strategy, matrix, needs, and inputs. Context values support index syntax such as github['sha'] and property syntax such as github.sha; dereferencing a nonexistent property evaluates to an empty string.

🔴 (10:09) The supplied GitHub Actions reference warns that the full github context includes sensitive data such as github.token; secrets are masked in logs, but exporting or printing the whole context still requires caution. toJSON/toJson can serialize context objects for debugging.

🔴 (10:09) GitHub Actions distinguishes contexts, which can often be evaluated before runner assignment, from default environment variables, which exist only on the runner. Example: job-level if: ${{ github.ref == 'refs/heads/main' }} is processed before routing the job, while a subsequent shell step can use $GITHUB_REF.

🔴 (10:09) Relevant github context behavior from the supplied reference: github.actor identifies the initial triggering actor and determines rerun privileges, while github.triggering_actor can identify a different person who initiated a rerun; github.event contains the full triggering webhook payload; github.event_path points to that payload on the runner; github.ref is the fully formed triggering ref; github.job is only populated within job execution steps; github.action_ref and github.action_repository should not be used directly in run and should instead be passed through env in composite actions.

🔴 (10:09) A command produced SHA-256-like output 2c4c77d1cafa8d792ab4a9d449799221baf95176a47692ad9a0b350b0a2618ed -.

🔴 (10:09) An attempted GitHub CLI/base64 operation failed with gh: Not Found (HTTP 404) followed by base64: invalid input.

🔴 (10:09) The inspected external action repository tree contains root files/directories .github, .gitignore, .release-please-manifest.json, CHANGELOG.md, CONTRIBUTING.md, LICENSE, README.md, action.yml, dist, lib, main.js, package-lock.json, package.json, post.js, release-please-config.beta.json, release-please-config.json, scripts, and tests.

🔴 (10:09) The inspected external action repository’s .github contents include .github/CODEOWNERS, .github/dependabot.yml, and workflows .github/workflows/release.yml, .github/workflows/stale.yml, .github/workflows/test.yml, and .github/workflows/update-permission-inputs.yml.

🔴 (10:09) The inspected external action repository’s implementation/build artifacts include dist/main.cjs, dist/post.cjs, lib/get-permissions-from-inputs.js, lib/main.js, lib/post.js, lib/request.js, main.js, post.js, scripts/update-permission-inputs.js, and generated file scripts/generated/app-permissions.json.

🔴 (10:09) The inspected external action repository’s tests include tests/README.md, tests/action-deprecated-inputs.test.js, tests/index.js, tests/index.js.snapshot, tests/main-app-id-fallback.test.js, tests/main-client-id-precedence.test.js, tests/main-custom-github-api-url.test.js, tests/main-enterprise-fail-response.test.js, tests/main-enterprise-installation-not-found.test.js, tests/main-enterprise-mutual-exclusivity-owner.test.js, tests/main-enterprise-mutual-exclusivity-repositories.test.js, tests/main-enterprise-only-success.test.js, tests/main-enterprise-token-permissions-set.test.js, tests/main-missing-client-and-app-id.test.js, tests/main-missing-owner.test.js, tests/main-missing-private-key.test.js, tests/main-missing-repository.test.js, tests/main-private-key-with-escaped-newlines.test.js, tests/main-proxy-requires-native-support.test.js, tests/main-repo-skew.test.js, tests/main-token-get-owner-set-client-error.test.js, tests/main-token-get-owner-set-fail-response.test.js, tests/main-token-get-owner-set-repo-fail-response.test.js, tests/main-token-get-owner-set-repo-full-name.test.js, tests/main-token-get-owner-set-repo-invalid-format.test.js, tests/main-token-get-owner-set-repo-network-error.test.js, tests/main-token-get-owner-set-repo-non-current-full-name.test.js, tests/main-token-get-owner-set-repo-owner-mismatch.test.js, tests/main-token-get-owner-set-repo-set-to-many-newline.test.js, tests/main-token-get-owner-set-repo-set-to-many.test.js, tests/main-token-get-owner-set-repo-set-to-one.test.js, tests/main-token-get-owner-set-repo-unset.test.js, tests/main-token-get-owner-unset-repo-full-name-and-bare.test.js, tests/main-token-get-owner-unset-repo-owner-mismatch.test.js, tests/main-token-get-owner-unset-repo-set.test.js, tests/main-token-get-owner-unset-repo-unset.test.js, tests/main-token-permissions-set.test.js, tests/main.js, tests/mock-agent.js, tests/post-proxy-requires-native-support.test.js, tests/post-revoke-token-fail-response.test.js, tests/post-token-expired.test.js, tests/post-token-set.test.js, tests/post-token-skipped.test.js, and tests/post-token-unset.test.js.