Repository navigation
github.action_path suggests using cd ${{ ... }} which is against best practices #41779
Description
Code of Conduct
- I have read and agree to the GitHub Docs project's Code of Conduct
What article on docs.github.com is affected?
https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#github-context
What part(s) of the article would you like to see updated?
| Property name | Type | Description |
|---|---|---|
github.action_path |
string |
The path where an action is located. This property is only supported in composite actions. You can use this path to access files located in the same repository as the action, for example by changing directories to the path: cd ${{ github.action_path }}. |
Additional information
run: should not suggest ${{ ... }} as it's often dangerous, instead people should generally use:
env:
something: ${{ ... }}
run:
use "$something"
Activity
jsoref commentedon Dec 10, 2025
The general advice is here: https://docs.github.com/en/actions/reference/security/secure-use#use-an-intermediate-environment-variable
while some
githubcontext items may be safe, many are not, and it's much safer to tell people to never use them inline as a rule than to offer mixed samples -- people will draw the wrong conclusions leading to unsafe outcomes.Sharra-writes commentedon Dec 18, 2025
@jsoref Sorry it took a while to respond. Based on the fact that you're bringing this up and
@yeikelis giving it a thumbs up, I'm guessing it's something we really need to address. I will bring it up for the Actions team, but I'm not confident about it getting picked up until after the holidays.github-actions commentedon Jan 20, 2026
A stale label has been added to this issue, because it has been open for 30 days with no activity. If you think this issue should remain open, please add a new comment.
github-actions commentedon Mar 3, 2026
A stale label has been added to this issue, because it has been open for 30 days with no activity. If you think this issue should remain open, please add a new comment.
jsoref commentedon Mar 3, 2026
@Sharra-writes I'm willing to fix these if you're open to it...
Sharra-writes commentedon Mar 4, 2026
@jsoref I had trouble getting an answer on this one, but if you want to open a PR, I'll try again. And if that doesn't work, I'll see if anyone knows enough on my team to at least say whether it's a safe change to make. I'm half-inclined to just go with it, but if it's a question of something being dangerous or not, I really should get an okay from somewhere.
salmanmkc commentedon Apr 2, 2026
Looks good to me, should we link the docs on intermediary variables there if they get confused by the whole using corresponding environment variable reference?
The variable itself should be fine since it's coming from the client, but I agree we should show best practices if we've indicated it before. In theory if it's a hosted runner it should be 'trusted', but it could technically be running on a self-hosted runner which has been modified.