Use and write actions — GitHub Actions Chapter 3

$ run as a normal user# run as root (or with sudo)

Use actions with inputs

uses: OWNER/REPO@VERSION runs an action; with: gives its inputs.

.github/workflows/ci.yml

steps:
  - uses: actions/checkout@v4
    with:
      fetch-depth: 0
  - uses: actions/setup-python@v5
    with:
      python-version: "3.12"
      cache: pip
  - uses: hashicorp/setup-terraform@v3
    with:
      terraform_version: "1.12.2"

Common action	Does
`actions/checkout`	Get the repository code
`actions/setup-python`, `setup-node`, `setup-go`	Install a language version, with caching
`actions/cache`	Cache any folder between runs
`actions/upload-artifact`, `download-artifact`	Pass files between jobs, keep reports
`azure/login`	Log in to Azure (with OIDC)
`docker/build-push-action`	Build and push images
`aquasecurity/trivy-action`	Scan images and code

3.2

Pin versions safely

A tag like @v4 can be moved by the action's owner. A full commit SHA can not.

.github/workflows/ci.yml

steps:
  - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

Reference	Safety
`@main`	Worst: any new commit runs in your pipeline
`@v4`	OK for trusted publishers (GitHub, HashiCorp, Microsoft)
`@<full SHA>`	Best: exactly the code you reviewed

At work

Dependabot can update pinned SHAs for you (see Secure your pipelines).

3.3

Pass outputs between steps

A step writes name=value into $GITHUB_OUTPUT; later steps read it with steps.ID.outputs.NAME.

.github/workflows/version.yml

steps:
  - id: ver
    run: echo "version=$(date +%Y.%m.%d)-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
  - run: echo "Building ${{ steps.ver.outputs.version }}"

3.4

Write a composite action

A composite action bundles several steps in one action.yml — for example "set up Terraform and run the checks".

.github/actions/tf-checks/action.yml

name: Terraform checks
description: fmt, init, validate and scan
inputs:
  dir:
    description: Working directory
    required: true
runs:
  using: composite
  steps:
    - run: terraform fmt -check -recursive
      shell: bash
      working-directory: ${{ inputs.dir }}
    - run: terraform init -backend=false && terraform validate
      shell: bash
      working-directory: ${{ inputs.dir }}

.github/workflows/ci.yml

steps:
  - uses: actions/checkout@v4
  - uses: ./.github/actions/tf-checks
    with:
      dir: envs/staging

Remember

In composite actions every run step needs shell:.