Bibliography

[1]

How to use env vars or constants in composite actions? orgs/community#51280, March 2023. Accessed: 2026-08-03.

[2]

Specifying revisions. https://git-scm.com/docs/git-rev-parse#_specifying_revisions, November 2025. Accessed: 2026-08-03.

[3]

Migrate Git from SHA-1 to a stronger hash function. https://git-scm.com/docs/hash-function-transition, June 2026. Accessed: 2026-08-03.

[4]

Python Software Foundation. Status of Python versions. https://devguide.python.org/versions/. Accessed: 2026-08-03.

[5]

GitHub Inc. Creating a composite action. https://docs.github.com/actions/tutorials/create-actions/create-a-composite-action, 2026. Accessed: 2026-08-03.

[6]

GitHub Inc. Running variations of jobs in a workflow. https://docs.github.com/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations, 2026. Accessed: 2026-08-03.

[7]

GitHub Inc. Using third-party actions. https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions, 2026. Accessed: 2026-08-03.

[8]

GitHub Inc. GitHub Actions variables reference. https://docs.github.com/actions/reference/workflows-and-actions/variables, 2026. Accessed: 2026-08-03.

[9]

Greg Mohler and Kitty Chiu. Securing GitHub Actions workflows. https://learn.github.com/well-architected/application-security/recommendations/actions-security/, July 2026. Accessed: 2026-08-03.

[10]

Shreya Pohekar. The right way to handle permissions in GitHub Actions: a practical guide to staying secure. https://shreyapohekar.com/blogs/the-right-way-to-handle-permissions-in-github-actions-a-practical-guide-to-staying-secure/, November 2025. Accessed: 2026-08-03.

[11]

William Woodruff. We should all be using dependency cooldowns. https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns, November 2025. Accessed: 2026-08-03.