github-actionslisted

# GitHub Actions Practical, hard-won guidance for authoring and reviewing GitHub Actions workflows. GitHub is the assumed code host for every project here — PRs and CI live on GitHub — so this skill is installed everywhere. It complements core `gh-cli` (which covers `gh run`, `gh workflow`, `gh secret` from the command line); this skill is about the workflow YAML itself. Each lesson below is something that **looks right but is silently wrong**: it passes review, ships, and then fails open (a gate never runs, a value truncates, an injection lands). Apply the review checklist at the bottom to any workflow PR. ## 1. The `${{ }}` expression language has a tiny function set GitHub Actions expressions are **not JavaScript**. The only built-in functions are: ```text contains startsWith endsWith format join toJSON fromJSON hashFiles ``` There is **no** `toLower`, `toUpper`, `trim`, or `replace`. Typing one does not error — the expression evaluates to an empty string **silently**, so a condition that was meant to exclude something fails open and never excludes it. ```yaml # ❌ WRONG — toLower() does not exist; the whole expression is "" and the guard never fires if: ${{ !contains(toLower(github.event.pull_request.title), 'release') }} ``` Workaround A — enumerate the case variants with the functions that do exist: ```yaml # ✅ Cover the common cases explicitly if: | !startsWith(github.event.pull_request.title, 'Release') && !startsWith(github.event.pull_request.title