v2.0.0

Highlights

Modernized rewrite of the action — same inputs, new runtime and safety features.

Breaking / runtime

• Runtime upgraded node16 → node24 (requires a current runner; all GitHub-hosted runners qualify)
• Invalid or empty base64-encoded-secret now fails the step with a clear error instead of silently writing a broken file
• filename values escaping working-directory (e.g. ../escape.txt) are now rejected

New

• file-path output: absolute path of the created file, usable in later steps
• Nested filenames like sub/file.txt now work — parent directories are created automatically

Internal

• Rewritten in TypeScript, bundled with esbuild to dist/ — node_modules no longer tracked in the repo
• @actions/core v3, unused @actions/github removed
• Unit tests (Vitest), ESLint + Prettier, CI with check-dist gate and e2e matrix on macOS + Ubuntu
• Post step deletes exactly the file the main step created (state-based cleanup)

Usage

- uses: mobiledevops/secret-to-file-action@v2
  with:
    base64-encoded-secret: ${{ secrets.FILE_CONTENT }}
    filename: "hello-world.sh"
    is-executable: true
    working-directory: "./a/b/c"

Full Changelog: v1.0.0...v2.0.0