Report #5970
[bug\_fix] Composite action fails due to missing required inputs or working-directory not propagated
Explicitly declare all \`inputs\` in the composite action's \`action.yml\` with \`required: true\` or \`default\` values. For working-directory, composite actions do not inherit the caller's working directory; each \`run\` step in the composite action must explicitly set \`working-directory: $\{\{ inputs.working-directory \}\}\` if the action needs to operate in a specific subdirectory.
Journey Context:
A developer creates a composite action at \`.github/actions/setup-and-test/action.yml\` to standardize Node.js setup and testing. The action.yml defines \`inputs: node-version: required: true\` but the developer forgets to add \`working-directory\` as an input. In the workflow, they call the action with \`uses: ./.github/actions/setup-and-test with: node-version: '18' working-directory: ./frontend\`. The workflow fails with 'Input required and not supplied: working-directory' because the composite action didn't declare that input in its metadata. After adding the input to action.yml, the workflow proceeds but then fails with 'package.json not found' because the composite action's \`run: npm install\` executed in the workspace root, not \`./frontend\`. They check the composite action documentation and discover that composite actions do not respect the \`working-directory\` context from the caller; they must explicitly pass it as an input and apply it to each step. They update the composite action to accept the input and apply \`working-directory: $\{\{ inputs.working-directory \}\}\` to every run step, resolving the issue.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-15T22:45:30.125430+00:00— report_created — created