Wevm Actions

This repository contains GitHub Actions that are shared across repos in the wevm GitHub org.

Warning

These actions are not designed for use outside of the wevm GitHub org.

github-sts

Exchanges the workflow's GitHub OIDC token for a short-lived GitHub App token, scoped by a trust policy at .github/sts/<policy>.sts.yaml in the scope repository. The token is revoked automatically when the job finishes.

permissions:
  contents: read
  id-token: write

steps:
  - id: sts
    uses: wevm/actions/.github/actions/github-sts@main
    with:
      policy: deploy
      ttl: 15m
      # scope: wevm/viem             # defaults to the current repository
      # host: staging.gh-sts.wevm.dev # defaults to gh-sts.wevm.dev
      # retry-timeout: 90

  - env:
      GH_TOKEN: ${{ steps.sts.outputs.token }}
    run: gh api "repos/${GITHUB_REPOSITORY}"

Outputs: token, expires-at.

Vendored actions

Third-party action runtime files are copied at exact upstream commits; GitHub-owned actions remain upstream and SHA-pinned. Consumers use wevm/actions/vendor/<owner>/<repo>/<slot>@<reviewed-sha> with the same inputs as upstream. Older slots preserve compatibility while consumers migrate; the pnpm v6 slot includes the patched bootstrap update. Pin the wevm/actions commit, not the upstream commit listed below.

For consumer upgrades, use these shared entrypoints:

• .github/actions/pnpm: pnpm setup v6.1.0 and Node setup v6.4.0. Each repository's packageManager still selects its pnpm version; skip-cache remains supported.
• vendor/pnpm/action-setup/v6: the same pnpm setup without dependency installation, for callers that need a custom destination or package_json_file.
• .github/workflows/lock-issue.yml: lock-threads v6.0.2 with the existing 14-day policy.

The pnpm-v4, lock-issue-v5.yml, and older vendor paths remain available while consumers migrate. Changesets requires a separate CLI migration: action v2 targets Changesets CLI v3, while action v1 targets CLI v2. Do not unify those slots by changing only the action path or its input names.

Action	Version	Description
changesets/action/abitype	v2.1.2 (ae32849)	A GitHub action to automate releases with Changesets
changesets/action/ox	v1.5.3 (e0145ed)	A GitHub action to automate releases with Changesets
changesets/action/viem	v1.4.10 (06245a4)	A GitHub action to automate releases with Changesets
changesets/action/wagmi	v1.9.0 (a45c4d5)	A GitHub action to automate releases with Changesets
dessant/lock-threads/v5	v5.0.1 (1bf7ec2)	Lock closed issues, pull requests and discussions after a period of inactivity
dessant/lock-threads/v6	v6.0.2 (89ae32b)	Lock closed issues, pull requests and discussions after a period of inactivity
pnpm/action-setup/v4	v4.1.0 (a7487c7)	Install pnpm package manager
pnpm/action-setup/v6	v6.1.0 (ea17c68)	Install pnpm package manager
pnpm/action-setup/viem-wagmi	v4.3.0 (b906aff)	Install pnpm package manager

See vendor/README.md for imports, verification, updates, and the STS rollout prerequisites. Vendoring controls when upstream code changes enter our workflows; it does not sandbox actions or eliminate vulnerabilities in a pinned version. Other third-party actions are not yet migrated, so org-wide enforcement must wait. actions-cool/issues-helper is deferred because GitHub disabled its upstream repository; the existing issue-labeled workflow is unchanged.