
Security News
RubyGems Adds Cooldown Feature to Bundler for Newly Published Gems
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.
@savvy-web/github-action-builder
Advanced tools
A zero-config build tool for creating GitHub Actions from TypeScript. Bundles with rsbuild, validates action.yml against GitHub's schema, and outputs production-ready Node.js 24 actions.
Build a GitHub Action from TypeScript source without writing build config. The builder bundles your code with @rsbuild/core (rspack under the hood) and checks action.yml against GitHub's published metadata schema. The output is a single Node.js 24 file you commit to your repo.
src/main.ts, src/pre.ts, src/post.ts on its ownnode24 GitHub Actions runtimeaction.yml against GitHub's official metadata specificationnode: builtins externalized; user-configured externals and ignore options for optional or native modulesScaffold a new GitHub Action project, then build it:
npx @savvy-web/github-action-builder init my-action
cd my-action
npm install
npm run build
The init command lays down the project:
my-action/
├── src/
│ ├── main.ts # Main action entry point
│ ├── pre.ts # Pre-action hook
│ └── post.ts # Post-action cleanup
├── action.yml # GitHub Action metadata
├── action.config.ts # Build configuration
├── package.json # Dependencies and scripts
└── tsconfig.json # TypeScript configuration
Put your action logic in src/main.ts and run npm run build again. The bundled action lands at dist/main.js — commit that file to your repo.
Create a new GitHub Action project:
npx @savvy-web/github-action-builder init my-action
Bundle all entry points into dist/:
npm run build
# or directly:
npx @savvy-web/github-action-builder build
Check your action.yml and configuration without building:
npm run validate
# or directly:
npx @savvy-web/github-action-builder validate
The builder expects this structure:
my-action/
├── src/
│ ├── main.ts # Required - main action entry point
│ ├── pre.ts # Optional - runs before main
│ └── post.ts # Optional - runs after main (cleanup)
├── action.yml # GitHub Action metadata (runs.using: "node24")
├── action.config.ts # Optional configuration
└── package.json
Customize action.config.ts for your project:
import { GitHubAction } from "@savvy-web/github-action-builder";
export default GitHubAction.create({
entries: {
main: "src/main.ts",
post: "src/cleanup.ts",
},
build: {
minify: true,
sourceMap: false,
},
});
Your action.yml must use Node.js 24:
name: "My Action"
description: "Does something useful"
runs:
using: "node24"
main: "dist/main.js"
post: "dist/post.js" # Optional
Use the builder programmatically in your scripts:
import { GitHubAction } from "@savvy-web/github-action-builder";
const action = GitHubAction.create();
const result = await action.build();
if (result.success) {
console.log(`Built ${result.build?.entries.length} entry points`);
// e.g. "Built 3 entry points"
}
The package exports a base tsconfig.json for GitHub Action projects:
{
"extends": ["@savvy-web/github-action-builder/tsconfig/action.json"]
}
It sets up Node.js 24 ESM actions with strict mode, an ES2022 target and bundler module resolution. Override any of it in your own tsconfig.json.
action.yml with runs.using: "node24"MIT
FAQs
A zero-config build tool for creating GitHub Actions from TypeScript. Bundles with rsbuild, validates action.yml against GitHub's schema, and outputs production-ready Node.js 24 actions.
The npm package @savvy-web/github-action-builder receives a total of 296 weekly downloads. As such, @savvy-web/github-action-builder popularity was classified as not popular.
We found that @savvy-web/github-action-builder demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.