Josh Gross

`core.getInput` is for action inputs, it doesn't read workflow inputs. I suspect this error is occurring due to the `do_something` input being undefined. You could workaround this in a few...

👋 Thanks for the feature request @jeremy-boschen, this sounds interesting! It might be worth thinking about where we'd save these files and how we could make it easy to reference...

Could you elaborate on how using a temporary directory could lead to vulnerabilities?

Couldn't that malicious action just as easily write files to the current directory? I think if you have a malicious action executing arbitrary code on your machine then there are...

The path is relative to the current working directory, which isn't the same as the directory where the composite action was checked out. I don't know the right path at...

@PaulRBerg `github.action_path` might be what you're looking for: > The path where an action is located. This property is only supported in composite actions. You can use this path to...

@CarlFMateus did you try the suggestion mentioned in https://github.com/sindresorhus/execa/issues/543#issuecomment-1462932802? https://github.com/actions/github-script/issues/249#issuecomment-1085135137

Linking #366, we need to fix our documentation here.

There's also a suggestion in https://github.com/actions/github-script/issues/412#issuecomment-1749364551 to default to the `defaults.run.working-directory`. I'm not sure if the action has access to that information and it could be a breaking change for...

👋 @fiddlermikey, this action is a thin wrapper around Octokit and the GitHub API. The action itself isn't modifying that token or doing anything differently from an authentication perspective. Are...