Theory

Updated

October 30, 2026

Theory: Composite, JS, and Container Actions are Functions

A custom action is a reusable function with inputs/outputs. Releases are Git tags plus bits in GitHub Packages or attached files.

Invariants

  1. Pin by commit SHA, not by moving tag, for third-party actions.
  2. OIDC lets jobs prove identity to clouds without long-lived keys.
  3. Matrix is cartesian expansion of a job.
uses: org/action@<sha>     pinned
uses: org/action@v3         moving tag  (weaker)

What can break

  • pull_request_target with untrusted checkout.

How to read this chapter

Building actions, reuse/matrix/cache, releasing, security notes.