.ns-container { max-width: 900px; margin: 0 auto; padding: 20px; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; line-height: 1.6; color: #1f2937; } .ns-title { font-size: 2rem; margin-bottom: 0.5rem; color: #0f172a; } .ns-desc { font-size: 1.1rem; color: #64748b; margin-bottom: 1.5rem; } .ns-nav { display: flex; flex-wrap: wrap; gap: 8px; padding: 12px 0; border-bottom: 1px solid #e2e8f0; margin-bottom: 2rem; position: sticky; top: 0; background: white; z-index: 10; } .ns-nav-link { padding: 6px 14px; border-radius: 6px; background: #f1f5f9; color: #3b82f6; text-decoration: none; font-size: 14px; font-weight: 500; } .ns-nav-link:hover { background: #3b82f6; color: white; } .ns-section { margin-bottom: 3rem; padding-bottom: 2rem; border-bottom: 1px solid #f1f5f9; } .ns-section-title { font-size: 1.5rem; color: #1e293b; margin-bottom: 1rem; padding-top: 1rem; } .ns-section-content h3 { font-size: 1.2rem; margin-top: 1.5rem; color: #334155; } .ns-section-content p { margin: 0.5rem 0; } .ns-section-content pre { background: #1e293b; color: #e2e8f0; padding: 12px 16px; border-radius: 6px; overflow-x: auto; font-size: 13px; line-height: 1.5; } .ns-section-content code { background: #f1f5f9; padding: 2px 6px; border-radius: 3px; font-size: 0.9em; } .ns-section-content pre code { background: none; padding: 0; } .ns-section-content table { width: 100%; border-collapse: collapse; margin: 1rem 0; } .ns-section-content th, .ns-section-content td { padding: 8px 12px; border: 1px solid #e2e8f0; text-align: left; } .ns-section-content th { background: #f8fafc; font-weight: 600; } .ns-section-content img { max-width: 100%; height: auto; } .ns-back-to-top { font-size: 13px; margin-top: 1.5rem; } .ns-back-to-top a { color: #3b82f6; text-decoration: none; } .ns-footer { margin-top: 3rem; padding-top: 1rem; border-top: 1px solid #e2e8f0; color: #94a3b8; font-size: 13px; text-align: center; } .ns-js-notice { background: #fef3c7; border: 1px solid #f59e0b; border-radius: 6px; padding: 12px 16px; margin-bottom: 1.5rem; font-size: 14px; color: #92400e; }

Asymmetric Effort Actions

Secure, self-contained GitHub Actions. Zero third-party dependencies.

This page works best with JavaScript enabled. You are viewing a static version of the content.

Home

Asymmetric Effort Actions

Version 1.0.9. All actions are pure bash composites with zero third-party dependencies.

Checkout — Check out repository source code with support for submodules, LFS, and shallow clones.
Setup Bun — Install and configure the Bun JavaScript runtime with version pinning and caching.
Setup Go — Install and configure the Go toolchain with module and build caching.
Setup Node.js — Install and configure Node.js with npm/yarn/pnpm caching and LTS support.
Setup Python — Install and configure Python with pip/pipenv/poetry caching.
FOSSA Scan — Run FOSSA license compliance and security scanning in your CI pipeline.
GitHub Release — Create or update GitHub Releases with asset uploads and auto-generated notes.
Go Tooling — Install the complete Go toolchain with govulncheck and intelligent caching.
Build RPM Package — Build RPM packages from a spec file or inline metadata for RHEL, Fedora, and CentOS.
Build DEB Package — Build Debian .deb packages from a control file or inline metadata.
NPM Publish — Publish to npm using OIDC trusted publisher. No NPM_TOKEN secret required.
Release — Full-featured GitHub Release management. Replaces softprops/action-gh-release.
Deploy Pages — Deploy static files to GitHub Pages via branch push. Replaces peaceiris/actions-gh-pages.
Deploy Pages (API) — Deploy to GitHub Pages using the Pages deployment API with OIDC authentication.
Upload Pages Artifact — Package and upload a directory as a GitHub Pages deployment artifact.
CodeQL Init — Initialize CodeQL databases for security analysis.
CodeQL Autobuild — Auto-detect and build the project for CodeQL analysis.
CodeQL Analyze — Run CodeQL analysis and upload SARIF results to GitHub Code Scanning.

Checkout

Check out repository source code with support for submodules, LFS, and shallow clones.

Usage

- uses: asymmetric-effort/actions/actions/checkout@v1

Inputs

repository
ref
token
path
fetch-depth
submodules
lfs
clean
persist-credentials

Outputs

ref
commit

Setup Bun

Install and configure the Bun JavaScript runtime with version pinning and caching.

Usage

- uses: asymmetric-effort/actions/actions/setup-bun@v1

Inputs

bun-version
bun-version-file
no-cache
token

Outputs

bun-version
bun-path
cache-hit

Setup Go

Install and configure the Go toolchain with module and build caching.

Usage

- uses: asymmetric-effort/actions/actions/setup-go@v1

Inputs

go-version
go-version-file
check-latest
cache
cache-dependency-path
token
architecture

Outputs

go-version
cache-hit

Setup Node.js

Install and configure Node.js with npm/yarn/pnpm caching and LTS support.

Usage

- uses: asymmetric-effort/actions/actions/setup-node@v1

Inputs

node-version
node-version-file
cache
registry-url
architecture
token

Outputs

node-version
cache-hit

Setup Python

Install and configure Python with pip/pipenv/poetry caching.

Usage

- uses: asymmetric-effort/actions/actions/setup-python@v1

Inputs

python-version
python-version-file
cache
architecture
token

Outputs

python-version
python-path
cache-hit

FOSSA Scan

Run FOSSA license compliance and security scanning in your CI pipeline.

Usage

- uses: asymmetric-effort/actions/actions/fossa-scan@v1

Inputs

api-key
run-tests
endpoint
project
branch
working-directory
cli-version
debug

Outputs

test-result

GitHub Release

Create or update GitHub Releases with asset uploads and auto-generated notes.

Usage

- uses: asymmetric-effort/actions/actions/gh-release@v1

Inputs

tag_name
name
body
body_path
draft
prerelease
files
working_directory
overwrite_files
fail_on_unmatched_files
target_commitish
generate_release_notes
make_latest
token
repository

Outputs

url
id
upload_url
assets

Go Tooling

Install the complete Go toolchain with govulncheck and intelligent caching.

Usage

- uses: asymmetric-effort/actions/actions/go-tooling@v1

Inputs

go-version
go-version-file
govulncheck-version
no-cache
token
cache-key-suffix

Outputs

go-version
go-path
govulncheck-version
cache-hit

Build RPM Package

Build RPM packages from a spec file or inline metadata for RHEL, Fedora, and CentOS.

Usage

- uses: asymmetric-effort/actions/actions/build-pkg-rpm@v1

Inputs

spec-file
name
version
release
arch
summary
license
source-dir
install-prefix
output-dir
requires
scripts-pre
scripts-post

Outputs

rpm-path
rpm-name

Build DEB Package

Build Debian .deb packages from a control file or inline metadata.

Usage

- uses: asymmetric-effort/actions/actions/build-pkg-deb@v1

Inputs

control-file
name
version
arch
maintainer
summary
section
priority
source-dir
install-prefix
output-dir
depends
scripts-preinst
scripts-postinst

Outputs

deb-path
deb-name

NPM Publish

Publish to npm using OIDC trusted publisher. No NPM_TOKEN secret required.

Usage

- uses: asymmetric-effort/actions/actions/npm-publish@v1

Inputs

package-dir
tag
access
dry-run
registry
provenance

Outputs

version
package
registry-url

Release

Full-featured GitHub Release management. Replaces softprops/action-gh-release.

Usage

- uses: asymmetric-effort/actions/actions/release@v1

Inputs

tag_name
name
body
body_path
append_body
draft
prerelease
files
working_directory
overwrite_files
fail_on_unmatched_files
target_commitish
generate_release_notes
previous_tag
discussion_category_name
make_latest
token
repository

Outputs

url
id
upload_url
assets

Deploy Pages

Deploy static files to GitHub Pages via branch push. Replaces peaceiris/actions-gh-pages.

Usage

- uses: asymmetric-effort/actions/actions/deploy-pages@v1

Inputs

token
deploy_key
publish_dir
publish_branch
destination_dir
external_repository
allow_empty_commit
keep_files
force_orphan
user_name
user_email
commit_message
full_commit_message
tag_name
tag_message
enable_jekyll
cname
exclude_assets

Outputs

deploy_branch
commit_hash

Deploy Pages (API)

Deploy to GitHub Pages using the Pages deployment API with OIDC authentication.

Usage

- uses: asymmetric-effort/actions/actions/deploy-pages-api@v1

Inputs

token
timeout
error_count
reporting_interval
artifact_name

Outputs

page_url

Upload Pages Artifact

Package and upload a directory as a GitHub Pages deployment artifact.

Usage

- uses: asymmetric-effort/actions/actions/upload-pages-artifact@v1

Inputs

path
retention-days

Outputs

artifact-id

CodeQL Init

Initialize CodeQL databases for security analysis.

Usage

- uses: asymmetric-effort/actions/actions/codeql-init@v1

Inputs

languages
config-file
queries
tools
token

Outputs

codeql-path

CodeQL Autobuild

Auto-detect and build the project for CodeQL analysis.

Usage

- uses: asymmetric-effort/actions/actions/codeql-autobuild@v1

Inputs

language
build-command

Outputs

CodeQL Analyze

Run CodeQL analysis and upload SARIF results to GitHub Code Scanning.

Usage

- uses: asymmetric-effort/actions/actions/codeql-analyze@v1

Inputs

category
output
upload
token

Outputs

sarif-output

Security

Best practices for using these actions.

Handling Secrets

Never hardcode API keys or tokens.
Use ${{ secrets.YOUR_SECRET }}.
Rotate secrets regularly.

Reporting Vulnerabilities

Report to security@asymmetric-effort.com.