{"id":18928838,"url":"https://github.com/lightninglabs/gh-actions","last_synced_at":"2026-02-28T10:06:17.709Z","repository":{"id":54851415,"uuid":"327555428","full_name":"lightninglabs/gh-actions","owner":"lightninglabs","description":"Vendored GitHub Action scripts","archived":false,"fork":false,"pushed_at":"2024-07-24T07:21:30.000Z","size":1773,"stargazers_count":4,"open_issues_count":0,"forks_count":2,"subscribers_count":22,"default_branch":"master","last_synced_at":"2025-10-14T07:06:15.449Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lightninglabs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2021-01-07T08:54:17.000Z","updated_at":"2025-09-01T06:46:26.000Z","dependencies_parsed_at":"2024-11-08T11:30:30.616Z","dependency_job_id":"6d6ce792-a818-4b43-a42a-d6f8e7ca56d3","html_url":"https://github.com/lightninglabs/gh-actions","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/lightninglabs/gh-actions","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lightninglabs%2Fgh-actions","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lightninglabs%2Fgh-actions/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lightninglabs%2Fgh-actions/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lightninglabs%2Fgh-actions/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lightninglabs","download_url":"https://codeload.github.com/lightninglabs/gh-actions/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lightninglabs%2Fgh-actions/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29929651,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-28T09:58:13.507Z","status":"ssl_error","status_checked_at":"2026-02-28T09:57:57.047Z","response_time":90,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-08T11:28:13.597Z","updated_at":"2026-02-28T10:06:17.686Z","avatar_url":"https://github.com/lightninglabs.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Vendored GitHub Action scripts\n\nThis repository contains copies of all GitHub Action projects/libraries/scripts\nthat get access to sensitive environment or input variables.\n\nThe purpose of vendoring those actions is:\n - Avoid automatic updates by pinning down an exact commit to use.\n - Put focus on auditability by checking in the full code of all actions.\n - Every version update requires a PR where the full diff can be reviewed.\n\n## How to add/update actions\n\nThere is a shell script (`vendor.sh`) that performs the following steps for each\naction:\n - Download source archive of specified commit from GitHub.\n - Extract source into `@\u003caction-name\u003e` directory.\n - Run `npm install` and `npm build` (or `npm package` for some actions).\n - Copy all files necessary to run the action into the folder `\u003caction-name\u003e`.\n\nTo add a new action, simply add a new line to the bottom of the `vendor.sh`\nscript:\n\n```shell\nvendor \"\u003cgh-org-name\u003e\" \"\u003cgh-repo-name\u003e\" \"\u003ccommit-hash\u003e\" \"\u003cnpm-action-name\u003e\"\n```\n\nTo update an action, simply replace the git commit hash with a new version.\n\n## How to audit an action\n\nWhenever the `vendor.sh` is updated, it should also be executed. That will\nproduce the full diff against what was last used.\n\nThe following steps should then be performed to review the code in the actions\n(these are the absolute minimum steps, more review can always be performed if\ndeemed necessary):\n - Check the `dependencies` section of the `package.json` file. Is there an\n   unreasonable amount of 3rd party dependencies? Do the dependencies have\n   known vulnerabilities?\n - Look through the main code of the action. Does it have hard coded URLs that\n   are used and look suspicious?\n - Look through the diff of the `dist/index.js` file. Any weird changes?\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flightninglabs%2Fgh-actions","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flightninglabs%2Fgh-actions","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flightninglabs%2Fgh-actions/lists"}