Distillation

Date: Sep 5, 2026

• 🔴 (01:09) User requires pnpm for all package management and prohibits use of npm and yarn.
• 🔴 (01:09) User stated Node.js is managed through Volta, currently version v22.12.0.
• 🔴 (01:09) User stated dependencies are installed with pnpm install --frozen-lockfile.
• 🔴 (01:09) User stated project configuration is stored in root .craft.yml; its configuration schema is defined in src/schemas/.
• 🟡 (01:09) Composite action validates inputs.path using Node: accepts "." or slash-separated segments matching /^[A-Za-z0-9_.-]+$/, while rejecting ., .., __proto__, and segments beginning with -.
• 🟡 (01:09) Project ESLint enforcement requires: (1) Git access via getGitClient() or createGitClient(), whose mutating methods are automatically blocked; (2) GitHub API access via getGitHubClient(), whose create*, update*, delete*, and upload* methods are automatically blocked; (3) file writes through safeFs.writeFile(), safeFs.unlink(), etc., rather than raw fs; and (4) custom operations wrapped with safeExec(action, description).