github-actions

Custom GitHub Actions extend CI/CD workflows using JavaScript, Docker, or Composite formats. Define action metadata in action.yml with inputs and outputs, use @actions/core and @actions/github for logging and API calls, then publish to the Marketplace with proper versioning and security practices for reusable automation across repositories.

Secure GitHub Actions by restricting GITHUB_TOKEN permissions to minimum required scopes, storing sensitive data as repository secrets rather than hardcoding, and validating inputs. Use @actions/core masking for sensitive logs and follow least-privilege principles to prevent unauthorized access or credential exposure.

Yes, publish custom actions to the GitHub Marketplace by creating a public repository with action.yml metadata, semantic versioning tags, comprehensive documentation, and security best practices. Marketplace distribution enables other developers to discover and reuse your action across their workflows.

No, GitHub Actions support three formats: JavaScript actions run directly on runners with @actions/toolkit, Docker actions package dependencies in containers, and Composite actions combine existing actions into reusable workflows. Choose based on performance needs and dependency complexity.

Build a JavaScript or Composite action that uses @actions/github to interact with the GitHub API, define inputs for filtering criteria, and execute labeling logic on workflow triggers like issue creation. Secure the GITHUB_TOKEN, test metadata in action.yml, and deploy to your repository or Marketplace.

Avoid hardcoding secrets, validate all user inputs to prevent injection, pin dependencies to specific versions, limit token permissions to necessary scopes, and use approved actions from trusted sources. Regular dependency audits and security scanning prevent supply-chain vulnerabilities in workflows.