Actions

~11 min · actions, marketplace, uses

Level 0Apprentice

0 XP0/101 lessons0/10 achievements

0/120 XP to next level120 XP to go0% complete

Reusable units of work

An action is a reusable, parameterized unit of work invoked from a step. There are three flavors:

JavaScript actions — Node.js code in a repo. Runs directly on the runner. Fast, cross-platform.
Docker actions — packaged as a Docker image. Linux runners only. Slower start, fully isolated env.
Composite actions — a YAML 'mini-workflow' of steps that can be called like a single step. (Covered later in the reuse track.)

How you reference an action

Public action: uses: actions/checkout@v4
Pinned to a tag (immutable in practice): uses: actions/checkout@v4.2.0
Pinned to a SHA (truly immutable): uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
From your own repo: uses: ./.github/actions/setup-node
From another repo: uses: my-org/my-action@v1

Inputs and outputs

Pass values in via with:. Read values out via steps.<id>.outputs.<name>. Action authors document both in the action's README.

Code

Three pinning styles, escalating safety·yaml

steps:
  # 1) loose tag — auto-updates within the major version. risky.
  - uses: actions/checkout@v4

  # 2) full version — locked to a specific release. better.
  - uses: actions/checkout@v4.2.2

  # 3) full SHA — bit-for-bit identical run. best for security-critical workflows.
  - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

External links

Exercise

Take one of your workflows. For every uses: reference, look up the action in its repo and switch the tag pin to a SHA pin. Note any actions that don't expose a release tag (red flag — investigate).