github-script

Automating GitHub API tasks safely is done by using a pre-authenticated octokit client within workflow scripts. This reduces brittle YAML overhead and custom action complexity by centralizing logic for comments, labels, and repository file updates.

Passing user-controlled values into workflow scripts safely requires using the environment block instead of direct template interpolation. This prevents script injection vulnerabilities by keeping dynamic data out of executable code context.

Running shell commands from within a workflow script is possible using the exec helper. This allows cross-platform command execution directly inside the script when a standard run step alone is insufficient for the task.

Making complex run decisions based on event context involves leveraging built-in workflow context and core helpers inside your script. This allows conditional behavior and polling for changes using payload data without writing custom actions.

Using octokit for issue triage automation requires passing workflow inputs via environment variables to maintain security. Limitations arise if user-controlled values are templated directly into script code, causing script injection risks during API interactions.

GitHub-script works with GitHub Actions by using the pre-authenticated octokit client for repository file management and polling for changes. It centralizes workflow control and secure logic to interact directly with the GitHub API.