📦

github-actions

Name: github-actions
Author: callstackincubator

Révision du contenu r1 Risque moyen ⚙️ Commandes externes📁 Accès au système de fichiers🌐 Accès réseau🔑 Variables d’environnement

Build React Native CI Artifacts with GitHub Actions

Mobile teams need repeatable simulator and emulator builds that testers can download. This skill provides reusable GitHub Actions templates and authenticated artifact retrieval examples.

Prend en charge: Claude Codex Code(CC)

📊 66 Adéquat

Maintain this Skill? Claim it 📊 66 Adéquat

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "github-actions" from https://skillstore.io/skills/callstackincubator-github-actions.md and its manifest at https://skillstore.io/api/skills/callstackincubator-github-actions/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/callstackincubator-github-actions.md manifest signé GET /api/skills/callstackincubator-github-actions/manifest lockfile signé GET /api/skills/callstackincubator-github-actions/lockfile

Tester

Utilisation de « github-actions ». Plan simulator and emulator builds for a React Native pull request.

Résultat attendu:

iOS: use a macOS runner, install dependencies, select the shared Xcode scheme, and package the simulator app as a compressed archive.
Android: use a Linux runner with Java 17, install dependencies, and build the Debug APK through the project Gradle wrapper.
Artifacts: retain uploads for seven days and publish names, IDs, and authenticated URLs in the workflow summary.
Security: transfer dynamic inputs through environment variables instead of inserting them directly into Bash source.

Utilisation de « github-actions ». Explain how QA should retrieve a particular build artifact.

Résultat attendu:

Identify the workflow run and inspect its artifact names, IDs, and expiration status.
Authenticate with GitHub and download by run ID plus artifact name, or use the REST endpoint with the artifact ID.
Confirm the selected artifact matches the intended platform and build configuration before testing.

Utilisation de « github-actions ». Diagnose an Android build that reports an unknown assembledebug task.

Résultat attendu:

The Gradle variant uses incorrect casing.
Use Debug rather than debug so the generated task matches the project variant.
Check the module name reported by React Native configuration before retrying.

Audit de sécurité

Risque moyen

v1 • 30/09/2026 Ouvrir le rapport versionné

Three static findings permit command injection through directly interpolated action inputs; the other 75 matches are legitimate build operations or documentation. A separate semantic finding identifies unchecked multiline values that can overwrite workflow outputs and alter downstream settings. No evidence found of malicious intent, credential exfiltration, or prompt injection.

Fichiers analysés

735

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (1)

Moyen

references/gha-android-composite-action.md:91-93 references/gha-ios-composite-action.md:133-135 references/gha-workflow-and-downloads.md:136-138 references/gha-workflow-and-downloads.md:199-200

Workflow Output Injection Through Unchecked Line Breaks

Unvalidated identifiers and build inputs are written as single-line GITHUB_OUTPUT entries. Embedded newlines can introduce additional keys or overwrite existing outputs, changing downstream project paths, build selectors, or artifact metadata.

The templates append arbitrary strings with echo and do not reject line breaks. GitHub interprets additional key=value lines as separate outputs; exploitation requires control of those strings.

Éléments d’évaluation des capacités (3)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Moyen

references/gha-android-composite-action.md:135

Shell command substitution

VARIANT="$(echo "${{ inputs.variant }}" | tr '[:upper:]' '[:lower:]')"

GitHub substitutes inputs.variant into Bash source before parsing. A caller-supplied command substitution or quote can execute commands; exposure depends on caller input trust.

Moyen

references/gha-ios-composite-action.md:174

Shell command substitution

APP_PATH="$(find "$SEARCH_DIR" -type d -name "${{ inputs.scheme }}.app" | sort | head -n1 || true)"

The scheme input is inserted directly into the find command's Bash source. Shell metacharacters can execute commands if an untrusted caller controls the scheme.

Moyen

references/gha-ios-composite-action.md:205

Shell command substitution

CONFIG="$(echo "${{ inputs.configuration }}" | tr '[:upper:]' '[:lower:]')"

GitHub inserts inputs.configuration directly into Bash before the script runs. Embedded command substitution can execute commands when callers provide untrusted configuration values.

Facteurs de risque

⚙️ Commandes externes (30)

📁 Accès au système de fichiers (10)

references/gha-android-composite-action.md:79 references/gha-android-composite-action.md:80 references/gha-android-composite-action.md:79 references/gha-android-composite-action.md:80 references/gha-ios-composite-action.md:103 references/gha-ios-composite-action.md:103 references/gha-workflow-and-downloads.md:122 references/gha-workflow-and-downloads.md:122 references/gha-workflow-and-downloads.md:147 references/gha-workflow-and-downloads.md:208

🌐 Accès réseau (4)

references/gha-workflow-and-downloads.md:269 references/gha-workflow-and-downloads.md:275 SKILL.md:47 SKILL.md:48

🔑 Variables d’environnement (2)

references/gha-workflow-and-downloads.md:267 references/gha-workflow-and-downloads.md:273

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/callstackincubator-github-actions/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/callstackincubator-github-actions/security.svg)](https://skillstore.io/skills/callstackincubator-github-actions?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/callstackincubator-github-actions?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/callstackincubator-github-actions/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/callstackincubator-github-actions.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

callstackincubator. (2026). github-actions security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/callstackincubator-github-actions/audits/1

Citation BibTeX

@techreport{callstackincubator-callstackincubator-github-actions-2026,
  author = {callstackincubator},
  title = {github-actions security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/callstackincubator-github-actions/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-actions security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "callstackincubator"
date-released: "2026-09-30"
url: "https://skillstore.io/skills/callstackincubator-github-actions/audits/1"
identifiers:
  - type: other
    value: "skillstore:callstackincubator-github-actions:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Create mobile pull request builds

Adapt both composite action templates to produce downloadable iOS simulator apps and Android APKs for pull request validation.

Standardize mobile CI pipelines

Configure runners, dependency installation, build selectors, retention periods, and artifact metadata across both platform jobs.

Retrieve test builds reliably

Use run IDs, artifact names, or artifact IDs to retrieve the correct authenticated build archives for testing.

Essayez ces prompts

Understand the build prerequisites

Use github-actions to identify prerequisites for this React Native repository. List required runners, dependencies, the iOS scheme, and the Android variant.

Create an Android build action

Adapt the Android composite action for this repository using the Debug variant. Expose artifact metadata and pass shell inputs through quoted environment variables.

Connect both platform workflows

Create a two-platform workflow using these references. Add pull request and manual triggers, seven-day artifact retention, read-only permissions, and safe shell input handling.

Review artifact retrieval and security

Review this mobile workflow for input injection and artifact selection errors. Propose fixes and authenticated download steps using run IDs and artifact IDs.

Bonnes pratiques

Pass dynamic shell values through environment variables, quote expansions, validate build selectors, and reject line breaks in single-line workflow outputs.
Use read-only repository permissions and authenticate artifact downloads with appropriately scoped credentials.
Confirm project schemes and variants, package iOS apps as archives, and retain stable artifact names and IDs.

Éviter

Insert untrusted action inputs or job outputs directly into Bash source.
Treat authenticated artifact URLs as public download links or expose tokens in logs.
Assume default schemes, module names, variants, and runner toolchains match every repository.

Foire aux questions

Which AI tools support this skill?

The skill supports Claude, Codex, and Claude Code.

Does this skill run a hosted build service?

No. It provides templates and guidance that you adapt and run through your own GitHub Actions workflows.

Does it produce store-ready mobile releases?

The documented templates target iOS simulator app archives and Android emulator APKs. Store signing and release delivery are not covered.

What runner requirements apply?

iOS requires macOS with Xcode. Android requires a compatible Linux runner, Java 17, the Android SDK, and the project Gradle wrapper.

How can I download a build artifact?

Authenticate with GitHub, then use gh CLI with the run ID and artifact name, or the REST API with the artifact ID.

Can I use the templates unchanged?

Set repository-specific schemes, variants, and dependencies first. Replace direct shell interpolation with environment variables and reject line breaks in single-line outputs.