[BLCCoreStudio]

Summary

Upgrades tool/github-actions from a compact schema-v2 overview into a schema-v3 deep technical reference centered on the real Actions execution and trust model: events, workflow revisions, job graphs, runner selection, permissions, environments, actions, reusable workflows, caches, artifacts, and identity.

Changes

• explain hosted workflow-control-plane versus runner execution responsibilities
• document event/ref trust boundaries for pull_request, pull_request_target, workflow_run, dispatch, schedule, and merge queue
• cover untrusted context/script injection, expression/context phases, matrices, job graphs, outputs, timeouts, and concurrency
• deepen GitHub-hosted, self-hosted, ephemeral runners, runner groups, Actions Runner Controller, ambient cloud identity, persistence, network segmentation, and incident response
• add third-party action SHA pinning, reusable-workflow permission ceilings, GITHUB_TOKEN least privilege, secrets, OIDC federation, and environment protection gates
• distinguish caches from artifacts and document poisoning/untrusted-artifact boundaries across privileged workflows
• cover deployment architecture, immutable artifact promotion, supply-chain integrity, attestations, runner contamination, workflow performance, failure modes, debugging, and organization-scale reusable workflow design
• preserve MIT metadata specifically for the indexed open-source actions/runner repository while documenting the hosted-service licensing boundary
• add Technology Universe coverage metadata and typed relationships to Git and Kubernetes

Quality bar

The module treats workflow YAML as privileged infrastructure code. It makes event/ref selection, checked-out code, credentials, runner trust, third-party executable dependencies, artifact/cache direction, and deployment gates explicit enough to reason about real CI/CD compromise and reliability failure modes.