Wevm Actions

This repository contains GitHub Actions that are shared across repos in the wevm GitHub org.

Warning

These actions are not designed for use outside of the wevm GitHub org.

Releases

Changesets maintains a manually reviewed version PR for the whole repository. Merging it approves an immutable vX.Y.Z tag and GitHub Release with changelog notes, only after full Vendor check success on the merge commit. There is no npm publishing. Consumers should keep full SHA pins and review their update proposals; independent upstream slots and major paths are retained.

github-sts

Exchanges the workflow's GitHub OIDC token for a short-lived GitHub App token, scoped by a trust policy at .github/sts/<policy>.sts.yaml in the scope repository. The token is revoked automatically when the job finishes.

permissions:
  contents: read
  id-token: write

steps:
  - id: sts
    uses: wevm/actions/.github/actions/github-sts@main
    with:
      policy: deploy
      ttl: 15m
      # scope: wevm/viem             # defaults to the current repository
      # host: staging.gh-sts.wevm.run # defaults to gh-sts.wevm.run
      # retry-timeout: 90

  - env:
      GH_TOKEN: ${{ steps.sts.outputs.token }}
    run: gh api "repos/${GITHUB_REPOSITORY}"

The service runs in the isolated Wevm STS account. The default host is gh-sts.wevm.run; select staging.gh-sts.wevm.run explicitly for staging. Callers pinned to an older action revision must update their pin and host before the old .wevm.dev services are retired.

Outputs: token, expires-at.

cloudflare-sts

Exchanges GitHub OIDC for a short-lived, runner-IP-restricted Cloudflare token. Only the wevm application account is supported; the isolated STS hosting account is never a target. Policies are registered centrally in wevm/cloudflare-sts.

permissions:
  contents: read
  id-token: write

steps:
  - id: cloudflare
    uses: wevm/actions/.github/actions/cloudflare-sts@<reviewed-commit-sha>
    with:
      policy: deploy-production
      ttl: 15m
      # host: staging.cf-sts.wevm.run # defaults to cf-sts.wevm.run

  - env:
      CLOUDFLARE_API_TOKEN: ${{ steps.cloudflare.outputs.token }}
      CLOUDFLARE_ACCOUNT_ID: ${{ steps.cloudflare.outputs.account-id }}
    run: pnpm exec wrangler deploy

Mint immediately before deployment, after builds and other preparation. The post-job hook revokes the token with a fresh OIDC assertion, including after a failed deployment. There is no fallback to a stored credential. Network and transient HTTP failures retry within a 90-second budget; authorization denials fail immediately. The service caps ttl at the policy limit (at most one hour) and sweeps expired tokens if a runner disappears before cleanup.

Outputs: token, account-id, expires-at. The client runs directly on Node 24 without installing dependencies. Test it with node --test .github/actions/cloudflare-sts/*.test.mjs.

Vendored actions

Third-party action runtime files are copied at exact upstream commits; GitHub-owned actions remain upstream and SHA-pinned. Consumers use wevm/actions/vendor/<owner>/<repo>/<slot>@<reviewed-sha> with the same inputs as upstream. Older slots preserve compatibility while consumers migrate; the pnpm v6 slot includes the patched bootstrap update. Pin the wevm/actions commit, not the upstream commit listed below.

For consumer upgrades, use these shared entrypoints:

• .github/actions/pnpm: pnpm setup v6.1.0 and Node setup v6.4.0. Each repository's packageManager still selects its pnpm version; skip-cache remains supported.
• vendor/pnpm/action-setup/v6: the same pnpm setup without dependency installation, for callers that need a custom destination or package_json_file.
• .github/workflows/lock-issue.yml: lock-threads v6.0.2 with the existing 14-day policy.

pnpm-v4 is a compatibility alias for .github/actions/pnpm, forwarding node-version and skip-cache. The old vendor/pnpm/action-setup/v4 and viem-wagmi paths retain their original snapshots but no longer track updates; use v6 for new pins. Both shared pnpm entrypoints are smoke-tested with pnpm 12.16.1. Upgrading the setup action does not change a repository's packageManager pin.

The lock-issue-v5.yml and other older vendor paths remain available while consumers migrate. Changesets requires a separate CLI migration: action v2 targets Changesets CLI v3, while action v1 targets CLI v2. Do not unify those slots by changing only the action path or its input names.

Action	Version	Description
Swatinem/rust-cache/v2.8.2	v2.9.3 (d1527c8)	A GitHub Action that implements smart caching for rust/cargo projects with sensible defaults.
Swatinem/rust-cache/v2.9.2	v2.9.3 (d1527c8)	A GitHub Action that implements smart caching for rust/cargo projects with sensible defaults.
Swatinem/rust-cache/v2.9.3	v2.9.3 (d1527c8)	A GitHub Action that implements smart caching for rust/cargo projects with sensible defaults.
andresz1/size-limit-action/v1.8.0	v1.8.0 (94bc357)	size-limit action
astral-sh/setup-uv/rev-d0cc045d04cc	v6.8.0 (d0cc045)	Set up your GitHub Actions workflow with a specific version of uv.
autofix-ci/action/v1.3.2	v1.3.4 (c5b2d67)	Automatically fix formatting/lint issues in pull requests
awalsh128/cache-apt-pkgs-action/rev-553a35bb8ebd	latest (553a35b)	Install APT based packages and cache them for future runs.
benchmark-action/github-action-benchmark/v1.22.2	v1.22.2 (4322e57)	Continuous Benchmark using GitHub pages as dash board for keeping performance
changesets/action/abitype	v2.1.2 (ae32849)	A GitHub action to automate releases with Changesets
changesets/action/ox	v1.5.3 (e0145ed)	A GitHub action to automate releases with Changesets
changesets/action/v1.7.0	v1.7.0 (6a0a831)	A GitHub action to automate releases with Changesets
changesets/action/viem	v1.4.10 (06245a4)	A GitHub action to automate releases with Changesets
changesets/action/wagmi	v1.9.0 (a45c4d5)	A GitHub action to automate releases with Changesets
cloudflare/wrangler-action/rev-9acf94ace14e	v3.15.0 (9acf94a)	Deploy your Cloudflare projects from GitHub using Wrangler
cloudflare/wrangler-action/v3.14.1	v3.15.0 (9acf94a)	Deploy your Cloudflare projects from GitHub using Wrangler
cloudflare/wrangler-action/v4.0.0	v4.0.0 (ebbaa15)	Deploy your Cloudflare projects from GitHub using Wrangler
cloudflare/wrangler-action/v4.1.3	v4.1.3 (953926a)	Deploy your Cloudflare projects from GitHub using Wrangler
codecov/codecov-action/rev-fb8b3582c8e4	v7.1.1 (303a32d)	GitHub Action that uploads coverage reports for your repository to codecov.io
codecov/codecov-action/v4.6.0	v4.6.0 (b9fd7d1)	GitHub Action that uploads coverage reports for your repository to codecov.io
codecov/codecov-action/v5.5.1	v5.5.5 (0fb7174)	GitHub Action that uploads coverage reports for your repository to codecov.io
codecov/codecov-action/v7.1.1	v7.1.1 (303a32d)	GitHub Action that uploads coverage reports for your repository to codecov.io
davelosert/vitest-coverage-report-action/v2.13.1	v2.13.1 (8f86cfb)	Provide a Vitest Test Coverage Report as Step-Summary and comment in Pull Requests
dessant/lock-threads/v5	v5.0.1 (1bf7ec2)	Lock closed issues, pull requests and discussions after a period of inactivity
dessant/lock-threads/v6	v6.0.2 (89ae32b)	Lock closed issues, pull requests and discussions after a period of inactivity
docker/login-action/v4.6.0	v4.7.0 (81c6f93)	GitHub Action to login against a Docker registry
docker/setup-buildx-action/v4.2.0	v4.4.1 (f87e599)	Set up Docker Buildx
dtolnay/rust-toolchain/rev-6c977a6ca407	6c977a6	Install the Rust toolchain
dtolnay/rust-toolchain/rev-b725eda52536	stable (b725eda)	Install the Rust toolchain
foundry-rs/foundry-toolchain/v1.5.0	v1.5.0 (50d5a89)	Install Foundry
foundry-rs/foundry-toolchain/v1.6.0	v1.6.0 (8b0419c)	Install Foundry
foundry-rs/foundry-toolchain/v1.9.2	v1.9.2 (dba66c2)	Install Foundry
jdx/mise-action/v4.2.5	v4.2.5 (3c2e0cf)	Actions for working with mise runtime manager
marocchino/sticky-pull-request-comment/v2.9.4	v2.9.4 (7737449)	Create comment on pull request, if exists update that comment.
nick-fields/retry/rev-ad984534de44	v4.0.0 (ad98453)	Retry a step on failure or timeout
nick-fields/retry/v3.0.2	v3.0.2 (ce71cc2)	Retry a step on failure or timeout
ossf/scorecard-action/v2.4.1	v2.4.1 (f49aabe)	Run OSSF Scorecard checks and output results in SARIF format
ossf/scorecard-action/v2.5.0	v2.5.0 (fa7117d)	Run OSSF Scorecard checks and output results in SARIF, JSON, or in-toto format
oven-sh/setup-bun/v2.2.0	v2.2.0 (0c5077e)	Download, install, and setup Bun to your path.
peter-evans/create-pull-request/v8.1.1	v8.1.1 (5f6978f)	Creates a pull request for changes to your repository in the actions workspace
planetscale/setup-pscale-action/rev-b6a50ee45b4b	v1 (b6a50ee)	Installs the PlanetScale CLI
pnpm/action-setup/v4	a7487c7	Install pnpm package manager
pnpm/action-setup/v6	v6.1.0 (ea17c68)	Install pnpm package manager
pnpm/action-setup/viem-wagmi	b906aff	Install pnpm package manager
preactjs/compressed-size-action/2.8.0	2.8.0 (946a292)	Get compressed size differences for every PR
re-actors/alls-green/v1.2.2	v1.2.2 (05ac938)	GitHub Action for checking that the test matrix jobs are all successful before proceeding. To be used in branch protection
rust-lang/crates-io-auth-action/rev-3268eb413133	v1.0.6 (3268eb4)	Retrieve a temporary crates.io access token using trusted publishing.
stefanzweifel/git-auto-commit-action/v6.0.1	v6.0.1 (778341a)	Automatically commits files which have been changed during the workflow run and push changes back to remote repository.
taiki-e/install-action/v2.86.1	v2.86.1 (288e746)	GitHub Action for installing development tools
zizmorcore/zizmor-action/v0.5.4	v0.5.4 (b572f7b)	Run zizmor from GitHub Actions 🌈
zizmorcore/zizmor-action/v0.7.0	v0.8.0 (53290ba)	Run zizmor from GitHub Actions 🌈

See vendor/README.md for imports, verification, updates, and the STS rollout prerequisites. Vendoring controls when upstream code changes enter our workflows; it does not sandbox actions or eliminate vulnerabilities in a pinned version. Other third-party actions are not yet migrated, so org-wide enforcement must wait. The issue-labeled workflow uses the runner's GitHub CLI to post the reproduction request and close the issue as not_planned, with issues: write permission.