Wait-for-secrets is a GitHub Action designed to pause workflow execution until a user manually inputs required secrets via a web interface. It leverages GitHub's OIDC tokens to authenticate with the StepSecurity API, which temporarily stores secret metadata and provides a unique URL for user interaction. The action polls the API until secrets are submitted, then makes them available as outputs for subsequent workflow steps. Key features include optional Slack notifications and configurable timeouts. The architecture is straightforward: a TypeScript-based action compiled via ncc into a single JavaScript file, with core logic separated into utility functions for environment parsing, URL generation, and secret handling.
This repository implements a GitHub Action that automates deployment of static content to GitHub Pages. It takes a folder from the workspace, optionally builds it, and pushes the contents to a specified branch (default `gh-pages`) using git worktrees and rsync. The action supports authentication via GitHub token, personal access token, or SSH deploy keys, and offers extensive configuration options including clean deployments, single-commit history, target subfolders, dry runs, tags, and Git LFS. The architecture is modular: `src/main.ts` is the entry point, `src/lib.ts` orchestrates the workflow, `src/git.ts` handles repository initialization and deployment, `src/worktree.ts` manages git worktree creation with retry logic, `src/ssh.ts` configures SSH clients, and `src/execute.ts` provides a reusable command execution wrapper. The action relies on external tools `git`, `rsync`, and `ssh-agent`, and uses the `@actions/*` toolkit for GitHub Actions integration. The codebase is well-structured TypeScript with comprehensive unit and integration tests, and follows modern JavaScript practices with ESLint, Prettier, and Jest.
This is a standalone Rust web server that implements Turborepo's remote caching API. It acts as a sidecar process, typically started inside CI pipelines (GitHub Actions, GitLab, Kubernetes), that forwards artifact storage and retrieval requests to any S3-compatible object store (AWS S3, Cloudflare R2, RustFS). The server exposes a small set of REST endpoints: health check, artifact upload/download/head, event logging, and a team artifact listing stub. Artifacts are streamed directly from the HTTP body to S3 (and vice versa) without buffering into memory. Optional Bearer-token authentication uses constant-time comparison, and the server is instrumented with OpenTelemetry for distributed traces and system-level metrics (CPU, memory) that are exportable via OTLP. The repository also includes a GitHub Action wrapper (Node.js) that manages the binary lifecycle—startup health polling, graceful shutdown, and log collection—and a multi-stage Docker build that produces statically linked Linux binaries and a universal macOS binary. The architecture is a monolith (single binary) built with actix-web, with clear separation into modules for settings, storage, authentication, routes, and telemetry. All artifacts are scoped under a team prefix derived from the Turborepo client's query parameters.
PullPreview is a GitHub Action implemented in Go that provisions ephemeral preview environments for pull requests. It manages cloud instances (AWS Lightsail or Hetzner), installs Docker or Kubernetes (k3s), and deploys applications using Docker Compose or Helm. The action integrates deeply with GitHub PR workflows: it reacts to labels, synchronizes SSH keys from repository collaborators, updates PR comments with deployment status and preview URLs, and performs scheduled cleanup of dangling instances. The codebase is organized around a provider abstraction pattern, with concrete implementations for Lightsail and Hetzner that share common orchestration logic for instance lifecycle, SSH access, and deployment. It is a self-contained CLI binary that runs as a composite action step, bundling all dependencies into a single executable.
This repository provides a GitHub Action that wraps the lychee link checker to validate links in Markdown, HTML, and text files. The action downloads and installs a specified version of lychee, runs it with configurable arguments, and processes the output to set exit codes and generate reports. The core action is well-designed with robust version handling and error processing, but the associated workflow files show signs of technical drift due to outdated action versions (e.g., actions/checkout@v7 which doesn't exist). The action is actively maintained with recent commits and automated version update workflows.