Embedded Stdlib Action Reference

on this page

Resolution And Versioning Leaf Actions Grouped Windows Baseline Actions Related Docs

This page describes the embedded actions shipped under the preflight/ namespace. These actions are versioned with the binary and are resolved before project-local or remote actions.

Resolution And Versioning

Embedded stdlib actions use refs such as preflight/windows-machine.
They are bundled into the binary with //go:embed.
They do not have independent versions. Upgrading the binary upgrades the embedded stdlib.

Leaf Actions

`preflight/autologin`

Configure Windows automatic logon.

Input	Type	Meaning
`username`	string	User name for automatic logon
`password`	string	Password or secret reference
`domain`	string	Domain or `.` for local accounts

`preflight/git-sync`

Clone or update a Git repository on a Windows target.

Use become when the checkout should be owned by a kiosk, exhibit, or service account. Authentication values should usually be passed as secret:<name> values. The action passes HTTPS and SSH credentials through environment variables to the PowerShell process instead of putting them in the script text.

By default, the action adds dest to Git’s global safe.directory list before running sync checks. This prevents Git for Windows from rejecting repositories whose files are owned by another account, which is common when setup runs as an administrator but the exhibit app runs as a kiosk user.

Input	Type	Meaning
`repo`	string	Git remote URL
`dest`	path	Destination working tree directory
`ref`	string	Branch, tag, or commit to check out
`remote`	string	Remote name, default `origin`
`local_branch`	string	Local branch to create or reset from `ref`
`detach`	bool	Check out `ref` detached
`fetch`	bool	Fetch remote updates when the repo already exists
`prune`	bool	Prune deleted remote refs during fetch
`fetch_tags`	bool	Fetch tags during sync
`reset`	bool	Hard-reset the working tree to the resolved ref
`clean`	bool	Remove untracked files after checkout
`clean_ignored`	bool	Include ignored files when cleaning
`submodules`	bool	Sync and update submodules recursively
`lfs`	bool	Run Git LFS install and pull
`depth`	int	Shallow clone or fetch depth; `0` means full history
`git_path`	string	Git executable path
`create_parent`	bool	Create the parent directory for `dest`
`set_remote_url`	bool	Ensure `remote` points at `repo`
`safe_directory`	bool	Add `dest` to Git `safe.directory`, default `true`
`http_username`	string	HTTPS askpass username
`http_password`	string	HTTPS askpass password or token
`ssh_private_key`	string	SSH private key content
`ssh_known_hosts`	string	SSH known hosts content
`ssh_strict_host_key_checking`	bool	Require SSH host key verification

Grouped Windows Baseline Actions

`preflight/windows-machine`

Configure machine-level baseline settings.

Input	Type	Meaning
`computer_name`	string	Desired computer name
`timezone`	string	Windows time zone ID
`enable_long_paths`	bool	Enable or disable the long path policy
`ps1_execution_policy`	string	LocalMachine PowerShell execution policy
`disable_new_network_prompt`	bool	Disable the first-connection new network prompt

`preflight/windows-shell`

Configure desktop and Explorer defaults for the current execution identity, or set user to write supported settings for a named Windows account without switching process identity.

When user is set, registry-backed settings, including taskbar auto-hide, are written through the target user’s profile hive. The target hive must already be loaded, such as while that user is signed in or by running with become.load_profile. Desktop shortcut cleanup resolves the target user’s configured Desktop folders, the profile’s normal Desktop folder, OneDrive desktop folders, and the public desktop, then removes .lnk, .url, and .website files. It also hides common shell desktop icons such as This PC, Network, and Control Panel.

Some shell visual changes do not update an already-running Explorer session immediately. Expect them to apply after sign-out, Explorer restart, or reboot.

Input	Type	Meaning
`user`	string	Optional Windows user for user-scoped shell settings
`clear_desktop_background`	bool	Clear the wallpaper
`clear_desktop_shortcuts`	bool	Remove shortcut files from desktop locations and hide common shell desktop icons
`taskbar_auto_hide`	bool	Enable or disable taskbar auto-hide (default: `false`)
`theme_mode`	string	Keep the current theme or set both app and system surfaces to `light` or `dark`
`transparency_effects`	bool	Enable or disable transparency effects (default: `true`)
`hide_recycle_bin`	bool	Hide the Recycle Bin icon
`show_hidden_files`	bool	Show hidden files in Explorer
`show_file_extensions`	bool	Show file extensions in Explorer
`show_empty_drives`	bool	Show empty removable drives in Explorer
`show_sync_provider_notifications`	bool	Show sync provider notifications in Explorer
`aero_shake`	bool	Enable Aero Shake window minimization
`launch_to_this_pc`	bool	Open Explorer to This PC instead of Quick Access
`show_item_check_boxes`	bool	Show item check boxes in Explorer
`taskbar_allow_resize`	bool	Allow taskbar resizing
`taskbar_on_all_displays`	bool	Show taskbar on all displays
`taskbar_allow_multimon`	bool	Allow multi-monitor taskbar behavior
`hide_this_pc_folders`	bool	Hide common library folders from This PC
`disable_network_folder_thumbnails`	bool	Prevent Explorer thumbnail caches on network folders
`show_store_apps_on_taskbar`	bool	Show Microsoft Store apps on the taskbar
`clear_start_pins`	bool	Apply an empty Start pin set
`start_pins_json`	string	Explicit `ConfigureStartPins` JSON payload

`preflight/windows-input`

Configure input, gesture, and text-scale preferences. User-facing preferences apply to the current execution identity, or to user when set. Policy-backed edge-swipe settings apply at machine scope.

User-scoped visual input changes may require sign-out or a new Explorer session before the desktop reflects them.

Input	Type	Meaning
`user`	string	Optional Windows user for user-scoped input preferences
`disable_edge_gestures`	bool	Disable edge swipe gestures
`disable_touch_feedback`	bool	Disable touch contact visualization
`disable_touch_gestures`	bool	Disable gesture visualization
`text_scale_percent`	int	Text scale percentage, typically `100`
`disable_accessibility_shortcuts`	bool	Disable Sticky Keys, Filter Keys, and Toggle Keys shortcuts

`preflight/windows-quiet-mode`

Reduce notifications, prompts, and recovery UI noise with machine-scoped Windows policy settings.

Input	Type	Meaning
`user`	string	Optional Windows user for user-scoped notification and prompt settings
`disable_notifications`	bool	Disable toast and cloud notifications
`disable_news_and_interests`	bool	Disable news and interests with the machine-scoped Windows policy
`disable_error_reporting`	bool	Disable Windows Error Reporting
`disable_windows_setup_prompt`	bool	Disable consumer and cloud-optimized Windows prompts
`disable_app_restore_on_boot`	bool	Disable automatic restart sign-on after update reboots
`disable_app_suggestions`	bool	Disable user-scoped consumer app suggestions and silent app installs

`preflight/windows-update-lockdown`

Reduce background system changes driven by Windows Update and Microsoft Store policy.

Input	Type	Meaning
`disable_windows_update`	bool	Disable automatic Windows Update policy checks
`disable_windows_update_service`	bool	Stop and disable Windows Update, Update Orchestrator, and Windows Update Medic services
`disable_update_auto_reboot`	bool	Prevent Windows Update from rebooting while users are signed in
`disable_store_auto_download`	bool	Disable Store app auto-download and update behavior

`preflight/windows-power`

Manage named power plans and user-scoped screensaver defaults.

When user is set, screen saver registry settings are written through the target user’s profile hive. The target hive must already be loaded, such as while that user is signed in or by running with become.load_profile.

Screen saver changes are persisted immediately but may require sign-out or a new Explorer session before the shell reflects them.

Input	Type	Meaning
`user`	string	Optional Windows user for user-scoped screen saver preferences
`plan_name`	string	Friendly name for the managed power plan
`plan_base`	string	Base plan alias or GUID to clone
`activate_plan`	bool	Activate the managed plan after applying it
`display_timeout_ac`	int	AC display timeout in minutes
`display_timeout_dc`	int	DC display timeout in minutes
`sleep_timeout_ac`	int	AC sleep timeout in minutes
`sleep_timeout_dc`	int	DC sleep timeout in minutes
`disable_screensaver`	bool	Disable the screen saver

Use the scheduled_task module directly when a machine needs a recurring reboot. See Schedule a Windows reboot.

`preflight/debloat`

Remove common built-in Windows apps (Xbox, Cortana, News, Weather, Teams, Skype, OneDrive) and set privacy, Copilot, search, taskbar, and Game DVR policies.

When user is set, user-scoped registry settings are written through the target user’s profile hive. The target hive must already be loaded, such as while that user is signed in or by running with become.load_profile. App removal and machine policy settings are not profile-scoped. Use remove_appx_packages directly if you need a custom app list.

Input	Type	Meaning
`user`	string	Optional Windows user for user-scoped privacy and taskbar settings

Built-in module reference
Playbook and action YAML reference
Execution model — why the stdlib is embedded and how action resolution works