React Native GitHub Actions Artifacts

The templates declare contents: read and actions: read permissions and disclose that artifact downloads require authentication, providing partial permission and data-flow transparency. However, third-party actions are referenced only by floating major versions, inputs are interpolated directly into shell, GitHub API tokens are relied upon, and there is no user-confirmation, input-isolation, rollback, or fuller sensitive-data handling guidance, so points are deducted.

The documentation, composite actions, and workflow are broadly consistent on the happy path and include set -euo pipefail, input validation, and missing-artifact failures. There are no committed tests or execution evidence, while repository structure, variant casing, scheme selection, and dependency-environment edge cases remain incompletely covered; failure diagnosis is limited, so the static score is conservative.

The audience, iOS/Android build scenarios, and artifact-download use cases are clear, with some prerequisites and pitfalls documented. Non-fit boundaries, exclusion triggers, and Chinese-language support are not explicit, and the core flow depends on GitHub, macOS runners, and CocoaPods, which may have reachability or environment-fit issues for mainland-China users, so points are deducted.

The main document uses progressive structure with overview, quick reference, problem mapping, and linked references; it includes MIT licensing, Codex metadata, examples, and troubleshooting. The skill lacks its own versioning policy, changelog, explicit maintenance owner, and update path, while installation and dependency guidance is partly externalized to the repository README, so points are deducted.

It supplies copyable iOS/Android composite actions, an end-to-end workflow, artifact naming, and gh/REST download commands that address the core task. The templates still require project-specific changes for schemes, paths, dependencies, and CI policy, and this static review provides no execution verification or strong comparative-benefit evidence, so points are deducted.

Key implementation details are present in repository templates, with source-inspiration links and a compatibility checklist. However, there are no committed tests, CI results covering these skill paths, or independent review evidence, so runtime correctness cannot be confirmed from static material and the score remains conservative.