Does a (node) github reusable action require node_modules to be committed?

Question

I have a very basic reusable workflow, written in node, and saved in a public repo. Works fine. But currently the node_modules directory is committed to the repo. The team decided this is a better than the actions.yml including a run.pre script of npm install. (i.e. it's quicker to straight download 7megs of committed dependencies from the one repo, than npm install to traverse and fetch the package.json dependency graph.)

Is there any way for the invoking action (steps.uses) to cache this reusable action, or for the reusable action's dependencies to be cached? Is convention to simply commit the dependencies, possibly minified a la vercel/ncc?

Answer 1

The recommendation is to just commit the contents into repo. You can't assume your runner can even talk to the outside world and your action's behavior might morph over time as npm install might pick up different version s of some dependencies.

This is also what users expect your action to do and it's probably also faster, since the runner will only have to do a bare clone of the repo, won't need to fetch the package.json nor the package-lock.json and could just work against a webpacked or otherwise optimized version of the distribution of your action.

It's why I like using pwsh or bash in a composite action so much. It carries none of the dependency nightmares of the js based actions and generally results in an action of a few KB at most and very little overhead.

There is an actions/cache action which you could use to cache the npm cache for the machine to speed up an npm install.

      - name: Cache dependencies
        uses: actions/cache@v2
        with:
          path: ~/.npm
          key: npm-${{ hashFiles('package-lock.json') }}
          restore-keys: npm-

Getting the cache key right might be a challenge, as you're now mixing the repo contents and the individually downloaded actions,. but both are cached in the .npm folder.