actions / hello-world-javascript-action Goto Github PK

I see node_modules/ included in the project while it's considered bad practice to have it in git repo. Is is the only way to make sure Node runs well in actions with correct dependencies? Can I install the packages during(or before) action is really running?

👋 This issue is to track the move over to using main as the default branch for this repo. We’d love your team's help in completing this transition.

Do not remove your old default branch, customers are going to be using it. We will be sending messages out about these changes, but if you want to message in your repository, that's fine as well.

• Create a main branch.
• You might need to rebase any pull requests you want to merge before changing the default branch.
• Change the default branch in settings to main.
• Update any documentation in this repo to refer to the new branch name, although using the version tag is still preferred.
• Check that this Action works correctly for users who have a repository with a custom default branch name.
• Close this issue and celebrate 🎉

We are aiming to complete this work by August 28th.

This sample project recommends devs to upload the entire node_modules directory. While using such a simple plugin the entire codebase including node_modules is then downloaded and used without any sort of checks.

What is stopping people from uploading malicious stuff inside such node_modules to steal source code or inject exploits while using such actions?

Hi there,

I'm struggling to understand how the check-dist workflow handles dependabot pull requests in a different way as the comment is mentioning =>

Could you explain where the dependabot magic is happening?

I'm trying to test this action locally before creating my own. However the action only echo's hello. When I try to set the environment variable:

export INPUT_WHO-TO-GREET=test
bash: export: `INPUT_WHO-TO-GREET=test': not a valid identifier

It fails? It seems Github Actions allows - in its Environment variables but bash doesn't.

Thank you 🙇‍♀ for wanting to create an issue in this repository. Before you do, please ensure you are filing the issue in the right place. Issues should only be opened on if the issue relates to code in this repository.

• If you have found a security issue please submit it here
• If you have questions about writing workflows or action files, then please visit the GitHub Community Forum's Actions Board
• If you are having an issue or question about GitHub Actions then please contact customer support

If your issue is relevant to this repository, please delete this text and continue to create this issue. Thank you in advance.

I can use this Action without supplying any inputs and the default for who-to-greet input variable is "World". Why is it documented (in action.yml and README.md) as required?

And more generally, why would Metadata syntax for GitHub Actions
specification even allow required: true and default to be specified together?

.