Make Github Actions Workflow

• Always declare explicit permissions — never rely on defaults
• Use minimal permissions: only request what the workflow needs
• Common patterns:
  • Read-only: permissions: {}
  • PR comments: pull-requests: write
  • Issue management: issues: write
  • Code read: contents: read
• For workflows that need write access to PRs from external contributors, use pull_request_target instead of pull_request
  • Security warning: pull_request_target workflows run in the base repository context with its permissions. Do not check out or execute code from the PR branch in these workflows. Instead, use the event payload and/or GitHub API (actions/github-script, github.rest.*, etc.) to inspect and act on the PR safely.

Scripting

• Use actions/github-script@v8 for complex logic instead of shell scripts
• Write JavaScript with async/await — the github object (Octokit) and context are available
• Use github.rest.* for REST API calls and github.graphql() for GraphQL queries
• Access PR/issue data via context.payload.pull_request, context.repo.owner, context.repo.repo
• Log with console.log() for debugging; use core.setFailed() for errors

Error Handling

• Wrap API calls in try/catch blocks
• Collect errors and report at the end rather than failing on the first error
• Log skipped operations with a reason

Workflow

Step 1: Understand the Requirements

Before writing the workflow, clarify:

• What event(s) should trigger it? (push, pull_request, check_suite, schedule, etc.)
• What permissions are needed?
• What conditions should gate execution? (author, branch, labels, etc.)
• What API calls are needed?
• Are there rate limiting or idempotency concerns?

Step 2: Choose the Trigger Event

Step 3: Write the Workflow

Create the YAML file following this template:

# Description of what this workflow does and why.