# Marketplace Actions — CI/CD

Source: https://www.geekswithgeeks.com/en/cicd/cicd-gha-marketplace

> Reusable steps other people published, instead of writing everything by hand.

## What an action is

An **action** is a packaged, reusable step — like `actions/checkout` (clone the repo) or `actions/setup-node` (install a Node version). The **Marketplace** hosts thousands published by GitHub and the community.

## Using one

You reference an action with `uses: owner/repo@version`, and pass it inputs `with: key: value`. It saves you from re-writing common logic like caching, linting, or publishing to a registry.

## Pin versions

Pin third-party actions to a specific tag or commit SHA (`@v4`, not `@main`). A moving reference can change behavior — or be compromised — without you noticing.

**Quiz:** Why pin a marketplace action to a version tag or commit SHA instead of a branch?

- [ ] It makes the workflow run faster
- [x] A branch reference can change unexpectedly, altering behavior or introducing risk
- [ ] Branches cannot be used inside a workflow file

*Answer:* A branch reference can change unexpectedly, altering behavior or introducing risk. A branch like main keeps moving; pinning to a tag or SHA guarantees the exact code you reviewed keeps running.