56 results available

github-actions

callstackincubator

·

Last changed

Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 3 targeted changes and preserved all other text. Classified findings before hardening: 6. Classified findings closed: 3. Classified findings remaining: 3. Unclassified scanner findings remaining: 0. Review findings closed: 4. Review findings remaining: 13.

Open before hardening

4

Medium

2

Low

Open after hardening

3

Medium

File	Group	Subtype	Severity	Status
references/gha-workflow-and-downloads.md	Supply Chain & Install-Time Trust	—	Medium	Open
references/gha-workflow-and-downloads.md	Sensitive Data & Secret Exposure	Data exfiltration	Medium	Closed
references/gha-android-composite-action.md	Supply Chain & Install-Time Trust	—	Medium	Open
references/gha-ios-composite-action.md	Supply Chain & Install-Time Trust	—	Medium	Open
SKILL.md	Prompt Injection	Third-party content as instructions	Low	Closed
references/gha-workflow-and-downloads.md	Supply Chain & Install-Time Trust	Dependency or plugin compromise	Low	Closed

6 findings

SKILL.md

GitHub Actions Build Artifacts

Overview

Reusable GitHub Actions patterns to build React Native apps for iOS simulators and Android emulators in the cloud, then publish artifacts retrievable via gh CLI or GitHub API.

When to Apply

Use this skill when:

Creating CI workflows that build React Native simulator/emulator artifacts.
Uploading iOS simulator and Android emulator installables from PRs or manual dispatch runs.
Replacing local-only mobile builds with downloadable CI artifacts.
Needing stable artifact IDs/names for scripted retrieval with gh or REST API.

Quick Reference

Add composite actions from gha-ios-composite-action.md and gha-android-composite-action.md.
Wire them into .github/workflows/mobile-build.yml from gha-workflow-and-downloads.md.
Upload with actions/upload-artifact@v4 and capture artifact-id output.
Download with gh run download or GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/{archive_format}.

References

File	Description
gha-ios-composite-action.md	Composite `action.yml` for iOS simulator `.app.tar.gz` builds and artifact upload
gha-android-composite-action.md	Composite `action.yml` for Android emulator `.apk` builds and artifact upload
gha-workflow-and-downloads.md	End-to-end workflow wiring plus `gh` and REST download commands

Problem -> Skill Mapping

Problem	Start With
Need CI iOS simulator `.app.tar.gz` artifact	gha-ios-composite-action.md
Need CI Android emulator `.apk` artifact	gha-android-composite-action.md
Need one workflow to trigger both platform jobs	gha-workflow-and-downloads.md
Need scripted artifact download	gha-workflow-and-downloads.md

Install

Install with chainctl


chainctl skill install public/callstackincubator/github-actions:latest

Get started with chainctl

View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/callstackincubator/agent-skills

Upstream commit405a88877caa993dd19e85803aeb824690beabd9

OCI reference

skills.cgr.dev/public/github.com/callstackincubator/skills/github-actions:latest

License

MIT

Files

HARDENING.md

LICENSE

SKILL.md

agents/openai.yaml

references/gha-android-composite-action.md

references/gha-ios-composite-action.md

references/gha-workflow-and-downloads.md

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.