The Marketplace

Tens of thousands of actions, varying quality

The GitHub Actions Marketplace lists tens of thousands of actions for every conceivable task: caching, deploying, uploading, scanning, posting Slack messages, generating release notes. The good news: you rarely need to write your own. The bad news: anyone can publish, and you're running their code on your runner with your secrets.

How to vet an action

Source repo activity — last commit recent? Issues responded to?
Stars / users / 'used by' — strong signal of community trust.
Maintainer — official orgs (actions/, docker/, aws-actions/, azure/) are safest. Personal accounts get higher scrutiny.
Verified creator badge — GitHub's own light vetting.
What permissions does it need? Does it ask for the GITHUB_TOKEN? Read the source.
SHA pin it. Always. Even for trusted publishers.

Categories you'll use repeatedly

actions/checkout — clone the repo (every workflow).
actions/setup-* — install Python / Node / Java / Go.
actions/cache — generic caching.
actions/upload-artifact + actions/download-artifact.
docker/login-action, docker/build-push-action.
aws-actions/configure-aws-credentials (OIDC).
peaceiris/actions-gh-pages — GitHub Pages deploy.

Code

Audit one action — bash one-liner per uses: ref·bash

# Look up where actions/checkout@v4 actually points right now
gh api repos/actions/checkout/git/refs/tags/v4 --jq .object.sha
# returns the current SHA the v4 tag points at

# Pin yourself by replacing v4 with that exact SHA
# After:  uses: actions/checkout@<that-sha>

Tens of thousands of actions, varying quality

How to vet an action

Categories you'll use repeatedly

Code

External links

Exercise

Progress

Comments 0