Gathering detailed insights and metrics for @actions/core
Gathering detailed insights and metrics for @actions/core
Gathering detailed insights and metrics for @actions/core
Gathering detailed insights and metrics for @actions/core
@segment/actions-core
Core runtime for Destinations Actions.
@lowdefy/actions-core
Core Lowdefy actions
@memberjunction/core-actions
Library of generated and custom actions for the core MemberJunction framework. This library is maintained by MemberJunction and includes actions for use within the framework itself.
@unlike/github-actions-core
Actions core lib
npm install @actions/core
Typescript
Module System
Node Version
NPM Version
95.5
Supply Chain
99.6
Quality
83.5
Maintenance
100
Vulnerability
100
License
TypeScript (98.8%)
JavaScript (0.75%)
PowerShell (0.29%)
Shell (0.06%)
Batchfile (0.05%)
C# (0.04%)
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
MIT License
5,373 Stars
1,507 Commits
1,584 Forks
143 Watchers
196 Branches
157 Contributors
Updated on Jul 11, 2025
Latest Version
1.11.1
Package Id
@actions/core@1.11.1
Unpacked Size
88.75 kB
Size
22.53 kB
File Count
27
NPM Version
10.8.2
Node Version
20.17.0
Published on
Oct 04, 2024
Cumulative downloads
Total Downloads
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
2
1
@actions/core
Core functions for setting results, logging, registering secrets and exporting variables across actions
1// javascript 2const core = require('@actions/core'); 3 4// typescript 5import * as core from '@actions/core';
Action inputs can be read with getInput
which returns a string
or getBooleanInput
which parses a boolean based on the yaml 1.2 specification. If required
set to be false, the input should have a default value in action.yml
.
Outputs can be set with setOutput
which makes them available to be mapped into inputs of other actions to ensure they are decoupled.
1const myInput = core.getInput('inputName', { required: true }); 2const myBooleanInput = core.getBooleanInput('booleanInputName', { required: true }); 3const myMultilineInput = core.getMultilineInput('multilineInputName', { required: true }); 4core.setOutput('outputKey', 'outputVal');
Since each step runs in a separate process, you can use exportVariable
to add it to this step and future steps environment blocks.
1core.exportVariable('envVar', 'Val');
Setting a secret registers the secret with the runner to ensure it is masked in logs.
1core.setSecret('myPassword');
To make a tool's path available in the path for the remainder of the job (without altering the machine or containers state), use addPath
. The runner will prepend the path given to the jobs PATH.
1core.addPath('/path/to/mytool');
You should use this library to set the failing exit code for your action. If status is not set and the script runs to completion, that will lead to a success.
1const core = require('@actions/core'); 2 3try { 4 // Do stuff 5} 6catch (err) { 7 // setFailed logs the message and sets a failing exit code 8 core.setFailed(`Action failed with error ${err}`); 9}
Note that setNeutral
is not yet implemented in actions V2 but equivalent functionality is being planned.
Finally, this library provides some utilities for logging. Note that debug logging is hidden from the logs by default. This behavior can be toggled by enabling the Step Debug Logs.
1const core = require('@actions/core'); 2 3const myInput = core.getInput('input'); 4try { 5 core.debug('Inside try block'); 6 7 if (!myInput) { 8 core.warning('myInput was not set'); 9 } 10 11 if (core.isDebug()) { 12 // curl -v https://github.com 13 } else { 14 // curl https://github.com 15 } 16 17 // Do stuff 18 core.info('Output to the actions build log') 19 20 core.notice('This is a message that will also emit an annotation') 21} 22catch (err) { 23 core.error(`Error ${err}, action may still succeed though`); 24}
This library can also wrap chunks of output in foldable groups.
1const core = require('@actions/core') 2 3// Manually wrap output 4core.startGroup('Do some function') 5doSomeFunction() 6core.endGroup() 7 8// Wrap an asynchronous function call 9const result = await core.group('Do something async', async () => { 10 const response = await doSomeHTTPRequest() 11 return response 12})
This library has 3 methods that will produce annotations.
1core.error('This is a bad error, action may still succeed though.') 2 3core.warning('Something went wrong, but it\'s not bad enough to fail the build.') 4 5core.notice('Something happened that you might want to know about.')
These will surface to the UI in the Actions page and on Pull Requests. They look something like this:
These annotations can also be attached to particular lines and columns of your source files to show exactly where a problem is occuring.
These options are:
1export interface AnnotationProperties { 2 /** 3 * A title for the annotation. 4 */ 5 title?: string 6 7 /** 8 * The name of the file for which the annotation should be created. 9 */ 10 file?: string 11 12 /** 13 * The start line for the annotation. 14 */ 15 startLine?: number 16 17 /** 18 * The end line for the annotation. Defaults to `startLine` when `startLine` is provided. 19 */ 20 endLine?: number 21 22 /** 23 * The start column for the annotation. Cannot be sent when `startLine` and `endLine` are different values. 24 */ 25 startColumn?: number 26 27 /** 28 * The end column for the annotation. Cannot be sent when `startLine` and `endLine` are different values. 29 * Defaults to `startColumn` when `startColumn` is provided. 30 */ 31 endColumn?: number 32}
Colored output is supported in the Action logs via standard ANSI escape codes. 3/4 bit, 8 bit and 24 bit colors are all supported.
Foreground colors:
1// 3/4 bit 2core.info('\u001b[35mThis foreground will be magenta') 3 4// 8 bit 5core.info('\u001b[38;5;6mThis foreground will be cyan') 6 7// 24 bit 8core.info('\u001b[38;2;255;0;0mThis foreground will be bright red')
Background colors:
1// 3/4 bit 2core.info('\u001b[43mThis background will be yellow'); 3 4// 8 bit 5core.info('\u001b[48;5;6mThis background will be cyan') 6 7// 24 bit 8core.info('\u001b[48;2;255;0;0mThis background will be bright red')
Special styles:
1core.info('\u001b[1mBold text') 2core.info('\u001b[3mItalic text') 3core.info('\u001b[4mUnderlined text')
ANSI escape codes can be combined with one another:
1core.info('\u001b[31;46mRed foreground with a cyan background and \u001b[1mbold text at the end');
Note: Escape codes reset at the start of each line
1core.info('\u001b[35mThis foreground will be magenta') 2core.info('This foreground will reset to the default')
Manually typing escape codes can be a little difficult, but you can use third party modules such as ansi-styles.
1const style = require('ansi-styles'); 2core.info(style.color.ansi16m.hex('#abcdef') + 'Hello world!')
You can use this library to save state and get state for sharing information between a given wrapper action:
action.yml:
1name: 'Wrapper action sample' 2inputs: 3 name: 4 default: 'GitHub' 5runs: 6 using: 'node12' 7 main: 'main.js' 8 post: 'cleanup.js'
In action's main.js
:
1const core = require('@actions/core'); 2 3core.saveState("pidToKill", 12345);
In action's cleanup.js
:
1const core = require('@actions/core'); 2 3var pid = core.getState("pidToKill"); 4 5process.kill(pid);
You can use these methods to interact with the GitHub OIDC provider and get a JWT ID token which would help to get access token from third party cloud providers.
Method Name: getIDToken()
Inputs
audience : optional
Outputs
A JWT ID Token
In action's main.ts
:
1const core = require('@actions/core'); 2async function getIDTokenAction(): Promise<void> { 3 4 const audience = core.getInput('audience', {required: false}) 5 6 const id_token1 = await core.getIDToken() // ID Token with default audience 7 const id_token2 = await core.getIDToken(audience) // ID token with custom audience 8 9 // this id_token can be used to get access token from third party cloud providers 10} 11getIDTokenAction()
In action's actions.yml
:
1name: 'GetIDToken' 2description: 'Get ID token from Github OIDC provider' 3inputs: 4 audience: 5 description: 'Audience for which the ID token is intended for' 6 required: false 7outputs: 8 id_token1: 9 description: 'ID token obtained from OIDC provider' 10 id_token2: 11 description: 'ID token obtained from OIDC provider' 12runs: 13 using: 'node12' 14 main: 'dist/index.js'
You can use these methods to manipulate file paths across operating systems.
The toPosixPath
function converts input paths to Posix-style (Linux) paths.
The toWin32Path
function converts input paths to Windows-style paths. These
functions work independently of the underlying runner operating system.
1toPosixPath('\\foo\\bar') // => /foo/bar
2toWin32Path('/foo/bar') // => \foo\bar
The toPlatformPath
function converts input paths to the expected value on the runner's operating system.
1// On a Windows runner.
2toPlatformPath('/foo/bar') // => \foo\bar
3
4// On a Linux runner.
5toPlatformPath('\\foo\\bar') // => /foo/bar
Provides shorthands for getting information about platform action is running on.
1import { platform } from '@actions/core' 2 3/* equals to a call of os.platform() */ 4platform.platform // 'win32' | 'darwin' | 'linux' | 'freebsd' | 'openbsd' | 'android' | 'cygwin' | 'sunos' 5 6/* equals to a call of os.arch() */ 7platform.arch // 'x64' | 'arm' | 'arm64' | 'ia32' | 'mips' | 'mipsel' | 'ppc' | 'ppc64' | 'riscv64' | 's390' | 's390x' 8 9/* common shorthands for platform-specific logic */ 10platform.isWindows // true 11platform.isMacOS // false 12platform.isLinux // false 13 14/* run platform-specific script to get more details about the exact platform, works on Windows, MacOS and Linux */ 15const { 16 name, // Microsoft Windows 11 Enterprise 17 version, // 10.0.22621 18} = await platform.getDetails()
These methods can be used to populate a job summary. A job summary is a buffer that can be added to throughout your job via core.summary
methods.
Job summaries when complete must be written to the summary buffer file via the core.summary.write()
method.
All methods except addRaw()
utilize the addRaw()
method to append to the buffer, followed by an EOL using the addEOL()
method.
1 2// Write raw text, optionally add an EOL after the content, defaults to false 3core.summary.addRaw('Some content here :speech_balloon:', true) 4// Output: Some content here :speech_balloon:\n 5 6// Add an operating system-specific end-of-line marker 7core.summary.addEOL() 8// Output (POSIX): \n 9// Output (Windows): \r\n 10 11// Add a codeblock with an optional language for syntax highlighting 12core.summary.addCodeBlock('console.log(\'hello world\')', 'javascript') 13// Output: <pre lang="javascript"><code>console.log('hello world')</code></pre> 14 15// Add a list, second parameter indicates if list is ordered, defaults to false 16core.summary.addList(['item1','item2','item3'], true) 17// Output: <ol><li>item1</li><li>item2</li><li>item3</li></ol> 18 19// Add a collapsible HTML details element 20core.summary.addDetails('Label', 'Some detail that will be collapsed') 21// Output: <details><summary>Label</summary>Some detail that will be collapsed</details> 22 23// Add an image, image options parameter is optional, you can supply one of or both width and height in pixels 24core.summary.addImage('example.png', 'alt description of img', {width: '100', height: '100'}) 25// Output: <img src="example.png" alt="alt description of img" width="100" height="100"> 26 27// Add an HTML section heading element, optionally pass a level that translates to 'hX' ie. h2. Defaults to h1 28core.summary.addHeading('My Heading', '2') 29// Output: <h2>My Heading</h2> 30 31// Add an HTML thematic break <hr> 32core.summary.addSeparator() 33// Output: <hr> 34 35// Add an HTML line break <br> 36core.summary.addBreak() 37// Output: <br> 38 39// Add an HTML blockquote with an optional citation 40core.summary.addQuote('To be or not to be', 'Shakespeare') 41// Output: <blockquote cite="Shakespeare">To be or not to be</blockquote> 42 43// Add an HTML anchor tag 44core.summary.addLink('click here', 'https://github.com') 45// Output: <a href="https://github.com">click here</a> 46
Tables are added using the addTable()
method, and an array of SummaryTableRow
.
1 2export type SummaryTableRow = (SummaryTableCell | string)[] 3 4export interface SummaryTableCell { 5 /** 6 * Cell content 7 */ 8 data: string 9 /** 10 * Render cell as header 11 * (optional) default: false 12 */ 13 header?: boolean 14 /** 15 * Number of columns the cell extends 16 * (optional) default: '1' 17 */ 18 colspan?: string 19 /** 20 * Number of rows the cell extends 21 * (optional) default: '1' 22 */ 23 rowspan?: string 24} 25
For example
1 2const tableData = [ 3 {data: 'Header1', header: true}, 4 {data: 'Header2', header: true}, 5 {data: 'Header3', header: true}, 6 {data: 'MyData1'}, 7 {data: 'MyData2'}, 8 {data: 'MyData3'} 9] 10 11// Add an HTML table 12core.summary.addTable([tableData]) 13// Output: <table><tr><th>Header1</th><th>Header2</th><th>Header3</th></tr><tr></tr><td>MyData1</td><td>MyData2</td><td>MyData3</td></tr></table> 14
In addition to job summary content, there are utility functions for interfacing with the buffer.
1 2// Empties the summary buffer AND wipes the summary file on disk 3core.summary.clear() 4 5// Returns the current summary buffer as a string 6core.summary.stringify() 7 8// If the summary buffer is empty 9core.summary.isEmptyBuffer() 10 11// Resets the summary buffer without writing to the summary file on disk 12core.summary.emptyBuffer() 13 14// Writes text in the buffer to the summary buffer file and empties the buffer, optionally overwriting all existing content in the summary file with buffer contents. Defaults to false. 15core.summary.write({overwrite: true})
5/10
Summary
@actions/core has Delimiter Injection Vulnerability in exportVariable
Affected Versions
<= 1.9.0
Patched Versions
1.9.1
3.5/10
Summary
Environment Variable Injection in GitHub Actions
Affected Versions
< 1.2.6
Patched Versions
1.2.6
Reason
25 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Reason
all changesets reviewed
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
Reason
security policy file detected
Details
Reason
binaries present in source code
Details
Reason
SAST tool detected but not run on all commits
Details
Reason
branch protection is not maximal on development and all release branches
Details
Reason
8 existing vulnerabilities detected
Details
Reason
dependency not pinned by hash detected -- score normalized to 1
Details
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
project is not fuzzed
Details
Score
Last Scanned on 2025-07-07
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More