github-actions-composite

To create reusable GitHub Actions workflows, you define a composite action by structuring an `action.yml` file that orchestrates shell commands and manages inputs and outputs for encapsulated logic.

The best way to interact with the GitHub API inside a composite action is by integrating the `github-script` tool, which allows you to safely execute JavaScript for API interactions within your workflow.

When building GitHub Actions, you manage inputs and outputs by explicitly defining them within your `action.yml` structure, allowing your composite action to receive data and return results to the calling workflow.

Security practices for GitHub Actions composite actions include pinning actions to specific commit SHAs and validating all inputs to prevent unauthorized access or malicious execution within your CI/CD pipelines.

You should use composite actions instead of standard workflows when you need to reuse identical sequences of steps—like checking out code and running tests—across multiple GitHub Actions workflows to avoid duplication.