
Security News
Free Certified Patch for Critical Rails Active Storage Vulnerability
Socket has released a free Certified Patch for a critical Rails Active Storage vulnerability, giving developers time to upgrade to a secure Rails version.
Generic GitHub Action and Workflow YAML generation — single source of truth for webtyp composite actions and workflows.
No domain knowledge of gorelease, goflare or other consumers. Provides typed Go structs Action/Workflow + deterministic Render() + Sync() and optimal Node 24 presets.
go get webtyp.com/ghaction@latest
import "webtyp.com/ghaction"
func GoreleaseAction() ghaction.Action {
return ghaction.Action{
Name: "Create GitHub Release",
Steps: []ghaction.Step{
{Name: "Setup Go", Uses: ghaction.DefaultSetupGo, With: []ghaction.KeyValue{{Key: "go-version-file", Value: "go.mod"}}},
{Name: "Build", Shell: "bash", Run: buildScript},
},
}
}
// in tests/action_sync_test.go
func TestActionYmlIsInSync(t *testing.T) {
a := GoreleaseAction()
changed, _ := ghaction.Sync("../action.yml", a)
if changed { t.Fatal("action.yml out of sync") }
}
func ReleaseWorkflow() ghaction.Workflow {
return ghaction.Workflow{
Name: "Release",
On: ghaction.On{Push: &ghaction.Push{Tags: []string{"v*"}}},
Permissions: map[string]string{"contents": "write"},
Jobs: map[string]ghaction.Job{
"release": {
RunsOn: ghaction.DefaultRunsOn,
Steps: []ghaction.WorkflowStep{
ghaction.CheckoutWithTags(),
ghaction.SetupGoStep(),
{Name: "Build", Shell: "bash", Run: buildScript},
},
},
},
}
}
// in tests/generation_test.go
func TestWorkflowsAreInSync(t *testing.T) {
ghaction.SyncWorkflow("../.github/workflows/release.yml", ReleaseWorkflow())
}
DefaultCheckout = "actions/checkout@v5" (Node 24)DefaultSetupGo = "actions/setup-go@v6" (Node 24)CheckoutStep(), CheckoutWithTags(), SetupGoStep(), GoVetStep(), GoTestStep(), PresetTestWorkflow()Bumping Node versions happens once in presets.go; consumers get it via go get -u + gotest regen.
gorelease owns DefaultTargets, goflare owns TinyGoVersion — ghaction never hardcodes domain strings. Consumers generate bash from their own constants and pass Uses: ghaction.DefaultSetupGo to avoid hardcoding actions/setup-go@v6.
See action.go, workflow.go, presets.go for API.
FAQs
Unknown package

Security News
Socket has released a free Certified Patch for a critical Rails Active Storage vulnerability, giving developers time to upgrade to a secure Rails version.

Security News
/Threat Research
A malicious Ruby gem runs a credential-stealing worm during installation, poisons AI coding tools, and can wipe files when a stolen GitHub token is revoked.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.