GitHub Action installs Aster and exposes the cache token only to Aster

.github/workflows/ci.yml

@@ -211,3 +211,18 @@ jobs:
           scripts/build-linux-repositories \
             dist package-repositories https://packages.example.test "${fingerprint}" "${version}"
           scripts/test-linux-repositories "${version}" package-repositories
+
+  action:
+    name: Action
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 24
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+      - name: Test the Aster action
+        working-directory: action
+        run: |
+          npm ci
+          npm test

.gitignore

@@ -1,3 +1,4 @@
 /target
 .aster/
 archdev.local.json
+node_modules/

action/README.md

@@ -0,0 +1,17 @@
+# Aster GitHub Action
+
+Installs a pinned Aster release and runs one command with the GitHub Actions
+cache token scoped to that process.
+
+```yaml
+- uses: ArchAstro/aster/action@v0.21.0
+  with:
+    run: run //app:build
+```
+
+`version` empty installs the latest stable release. `cache-mode` is `auto`
+by default: `rw` on push, schedule, and workflow_dispatch to the default
+branch, otherwise `read`. The runtime token is not exported to later steps.
+
+Build `dist/` with `npm run build` after changing `src/`. Tests are
+`npm test` and do not use the network.

action/action.yml

@@ -0,0 +1,32 @@
+name: Aster
+description: Install Aster and run a command with the GitHub Actions cache token scoped to that process
+author: ArchAstro
+
+inputs:
+  version:
+    description: Aster release to install. Empty installs the latest stable release. A leading v is optional.
+    required: false
+    default: ""
+  run:
+    description: Arguments passed to the aster binary, for example "run //app:build".
+    required: true
+  cache-mode:
+    description: auto writes on push, schedule, and workflow_dispatch to the default branch and reads otherwise. rw, read, and off override that.
+    required: false
+    default: auto
+  working-directory:
+    description: Directory the aster command runs in, relative to GITHUB_WORKSPACE.
+    required: false
+    default: ""
+  aster-path:
+    description: Local aster binary. Skips the release download. Test-only.
+    required: false
+    default: ""
+
+runs:
+  using: node24
+  main: dist/index.js
+
+branding:
+  icon: box
+  color: blue