5.4. Reflection Checkpoint

Key Takeaways

• action.yml at the referenced path is the action; runs.using picks the model: node20/node24 (cross-platform, fastest, needs bundled dependencies), docker (Linux only, slowest, any language), composite (inlines steps into the caller's job, can call other actions, no implicit secrets).
• JavaScript actions alone support pre:/post: entry points — the correct mechanism for guaranteed cleanup — and saveState/getState is the only channel between main and post.
• Composite actions must map outputs explicitly with value:; JS and Docker actions write $GITHUB_OUTPUT from code. Every output must be declared in action.yml to be readable by the caller.
• The toolkit is a wrapper over workflow commands: setOutput→$GITHUB_OUTPUT, exportVariable→$GITHUB_ENV, setSecret→::add-mask::, setFailed→error + exit 1. ::set-output has been disabled since 2023.
• Immutable actions publish releases as OCI packages so a published version cannot change; syntax is unchanged, but the guarantee behind @v1.2.3 is. Until an action is published that way, only a full commit SHA is truly pinned.
• Marketplace publishing needs a public repository, a single action, action.yml at the root, and 2FA. Private/internal sharing uses the repository's Access setting instead; same-repository actions (uses: ./) require actions/checkout first.
• Failure classification: resolution 404 (access/policy), empty inputs (INPUT_<NAME> mismatch), environment (unbundled deps, Node major, Docker root-vs-runner file ownership), and code (core.setFailed is what actually fails the step).

Connecting Forward

Phase 6 is the smallest domain by weight and the one that ties the rest together: how the GITHUB_TOKEN really works, why interpolating untrusted input into run: is a takeover risk, how OIDC removes cloud secrets entirely, what SHA pinning and attestations defend against — and, on the other side, how to make all of this fast and cheap.

Self-Check Questions

• Given "must run on Windows, must call two existing actions, must guarantee a cleanup step even on failure," explain which action type satisfies which requirement and why no single type satisfies all three cleanly.
• An action's log shows a red ::error:: annotation, yet the job is green and downstream steps ran. Name the exact cause and the one-line fix.
• Contrast what a consumer gains from @v1, @v1.2.3, and a 40-character SHA — then say how immutable actions change the middle row of that comparison.