Discovering Actions on GitHub Marketplace
Explore the GitHub Marketplace to find hundreds of pre-built actions. Verified badges indicate official partner organizations, while unbadged entries are contributed by the community.Always review an action’s source code before integrating it. Ensure it handles your repository’s content and secrets safely—never exposes secrets to unintended hosts or logs sensitive data.
Pinning Action Versions
For reliable and predictable workflows, define the action version by tag, branch, or commit SHA:| Strategy | Syntax Example | Pros | Cons |
|---|---|---|---|
| Tag | actions/[email protected] | Controlled upgrades between versions | Requires manual version updates |
| Branch | actions/checkout@main | Automatically uses the latest code | May introduce breaking changes |
| Commit SHA | actions/checkout@a824008085750b8e136effc585c3cd6082bd575f | Immutable reference for reproducible builds | Harder to benefit from upstream fixes |
Tags strike a balance between stability and ease of upgrades. Use SHAs when you need fully reproducible builds.