Lesson 9 / 21

Marketplace Actions

Reusable steps other people published, instead of writing everything by hand.

What an action is

An action is a packaged, reusable step — like actions/checkout (clone the repo) or actions/setup-node (install a Node version). The Marketplace hosts thousands published by GitHub and the community.

Using one

You reference an action with uses: owner/repo@version, and pass it inputs with: key: value. It saves you from re-writing common logic like caching, linting, or publishing to a registry.

Pin versions

Pin third-party actions to a specific tag or commit SHA (@v4, not @main). A moving reference can change behavior — or be compromised — without you noticing.

Quick check: Why pin a marketplace action to a version tag or commit SHA instead of a branch?

  • It makes the workflow run faster
  • A branch reference can change unexpectedly, altering behavior or introducing risk
  • Branches cannot be used inside a workflow file
Answer

A branch reference can change unexpectedly, altering behavior or introducing risk — A branch like main keeps moving; pinning to a tag or SHA guarantees the exact code you reviewed keeps running.