This is a product-neutral reference template for the VibeCode QA GitHub Action Package charter. It is not a production service, but the security posture it demonstrates is the point of the repository, so it is stated here in full.

Report vulnerabilities through GitHub security advisories on this repository. Please do not open a public issue for an unfixed vulnerability.

A published action runs inside somebody else's repository, with that repository's token. The consumer picks a version string, grants a set of permissions, and hands over untrusted workflow context. action.yml, the release tag, and the committed bundle are therefore the entire security boundary.

• No secrets. The action declares no secret inputs and reads no environment variable other than the INPUT_* values the runtime sets for its declared inputs. src/main.ts contains no process.env access, and a unit test enforces that.
• No token. It never reads GITHUB_TOKEN and makes no network calls. Documented examples request permissions: {}.
• No shell. Inputs are never interpolated into a shell string. The tag is parsed by an anchored, non-backtracking grammar (src/semver.ts) with a length bound, before anything else looks at it.
• Validation before behaviour. Every input is parsed and range/format checked in src/inputs.ts before the decision core runs. Malformed inputs always fail the step.
• Reproducible artifact. dist/index.js is what actually runs in a consumer's workflow. CI rebuilds it from source with a pinned bundler and fails on any diff.
• Pinned supply chain. Exact dependency versions, a committed lockfile, a pinned package manager, and commit-SHA pins for every third-party action used in this repo's workflows.
• Blocking gates. pnpm audit --audit-level=moderate and a licence allowlist run on every push and pull request as required checks, never as continue-on-error reporting.

Pin this action by immutable vX.Y.Z tag for reproducibility, and by full commit SHA in any workflow that runs with contents: write, id-token: write, or a secret in scope. The v1 tag moves by design and is documented as moving.