GitHub Actions Tutorial — Marketplace Overview

GitHub Actions Marketplace

The GitHub Actions Marketplace is a catalog of over 20,000 pre-built actions that you can use in your workflows. Instead of writing everything from scratch, you can leverage community and official actions for common tasks.

---

What is the Marketplace?

The Marketplace lives at github.com/marketplace?type=actions. It’s a searchable directory where developers and organizations publish reusable actions.

Each Marketplace listing includes:

• Action name and description
• Input parameters and outputs
• Usage examples
• Version history
• Source code link (every action is a public GitHub repo)

---

Most Popular Actions

Here are the actions you’ll use in almost every workflow:

Action	Purpose	Usage
actions/checkout@v4	Clone your repository	Every workflow needs this
actions/setup-node@v4	Install Node.js	Node.js projects
actions/setup-python@v5	Install Python	Python projects
actions/setup-java@v4	Install Java/JDK	Java/Kotlin/Scala
actions/cache@v4	Cache dependencies	Speed up builds
actions/upload-artifact@v4	Save files between jobs	Build outputs, reports
actions/download-artifact@v4	Retrieve saved files	Multi-job pipelines
docker/build-push-action@v5	Build & push Docker images	Container deployments
aws-actions/configure-aws-credentials@v4	AWS authentication	AWS deployments
azure/login@v2	Azure authentication	Azure deployments

---

How to Use a Marketplace Action

Step 1: Find the Action

Search the Marketplace or browse by category (CI, Deployment, Security, Code Quality, etc.).

Step 2: Check the Version

Always pin to a major version tag for stability:

# ✅ Good — pinned to major version
- uses: actions/checkout@v4

# ⚠️ Risky — uses latest commit on main
- uses: actions/checkout@main

# 🔒 Most secure — pinned to exact commit SHA
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

Step 3: Configure Inputs

Most actions accept with: parameters:

- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'

Step 4: Use Outputs

Some actions produce outputs you can reference in later steps:

- id: setup
  uses: actions/setup-node@v4
  with:
    node-version: 20

- run: echo "Node version is ${{ steps.setup.outputs.node-version }}"

---

Evaluating Marketplace Actions

Before using a third-party action, check:

Check	Why
Stars / Downloads	Indicates community trust
Verified creator badge	Published by a verified organization
Last updated	Actively maintained?
Source code	Review the code for security
Version tags	Uses semantic versioning?

Security tip: For sensitive workflows (deployments, secrets), prefer actions from GitHub (actions/*), verified creators, or pin to a specific commit SHA.

---

Categories

The Marketplace organizes actions into categories:

• Continuous Integration — Build, test, lint
• Deployment — AWS, Azure, GCP, Kubernetes, Heroku
• Security — CodeQL, Snyk, Trivy, Dependabot
• Code Quality — ESLint, Prettier, Black, Flake8
• Monitoring — Slack notifications, Datadog, PagerDuty
• Utilities — Label management, stale issue cleanup, PR automation

---

Quick Reference

Concept	Description
Marketplace URL	github.com/marketplace?type=actions
Version pinning	Use @v4 (major) or @sha (exact)
Inputs	Configured with with:
Outputs	Referenced with ${{ steps.<id>.outputs.<name> }}
Security	Prefer verified creators, review source code

---

← Previous: Pricing & Limits

Next: Practice Exercises →