Marketplace actions

---

Table of contents

1. Understanding actions
2. Official actions
3. Popular actions
4. Creating an action
5. Best practices
6. Practical exercises

---

1 - Understanding actions

What is an action?

An action is a reusable block of code that performs a specific task.

Types of actions

Type	Language	File	Usage
JavaScript	Node.js	action.yml	Fast, cross-platform
Docker	Any	Dockerfile	Isolated environment
Composite	YAML	action.yml	Assembling steps

uses syntax

steps:
  # Action du Marketplace
  - uses: actions/checkout@v4
  
  # Avec version spécifique
  - uses: actions/setup-[email protected]
  
  # Avec SHA (plus sécurisé)
  - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
  
  # Action locale
  - uses: ./.github/actions/my-action
  
  # Action d'un autre repo
  - uses: owner/repo/path@ref

Versioning

Use tags (@v4) for stability, or SHA for maximum security.

🔝 Back to table of contents

---

2 - Official actions

actions/checkout

- uses: actions/checkout@v4
  with:
    # Branche/ref à checkout
    ref: main
    
    # Profondeur de l'historique (0 = tout)
    fetch-depth: 0
    
    # Token pour repos privés
    token: ${{ secrets.PAT }}
    
    # Submodules
    submodules: recursive
    
    # Autre repo
    repository: owner/repo
    path: other-repo

actions/setup-node

- uses: actions/setup-node@v4
  with:
    node-version: '18'              # Version
    node-version-file: '.nvmrc'     # Depuis fichier
    cache: 'npm'                    # Cache npm/yarn/pnpm
    registry-url: 'https://npm.pkg.github.com'

actions/cache

- uses: actions/cache@v4
  with:
    path: |
      ~/.npm
      node_modules
    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-node-

actions/upload-artifact / download-artifact

# Upload
- uses: actions/upload-artifact@v4
  with:
    name: build-output
    path: dist/
    retention-days: 5

# Download
- uses: actions/download-artifact@v4
  with:
    name: build-output
    path: ./dist

Other official actions

Action	Usage
actions/setup-python	Python
actions/setup-java	Java
actions/setup-go	Go
actions/setup-dotnet	.NET
actions/github-script	GitHub API
actions/labeler	PR auto-labeling

🔝 Back to table of contents

---

3 - Popular actions

Docker

# Login Docker Hub
- uses: docker/login-action@v3
  with:
    username: ${{ secrets.DOCKER_USERNAME }}
    password: ${{ secrets.DOCKER_PASSWORD }}

# Build et push
- uses: docker/build-push-action@v5
  with:
    context: .
    push: true
    tags: user/app:latest
    cache-from: type=gha
    cache-to: type=gha,mode=max

AWS

- uses: aws-actions/configure-aws-credentials@v4
  with:
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    aws-region: us-east-1

- uses: aws-actions/amazon-ecr-login@v2

- uses: aws-actions/amazon-ecs-deploy-task-definition@v1
  with:
    task-definition: task-definition.json
    service: my-service
    cluster: my-cluster

Notifications

# Slack
- uses: slackapi/slack-github-action@v1
  with:
    channel-id: 'C0123456789'
    slack-message: "Build ${{ job.status }}"
  env:
    SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

# Discord
- uses: sarisia/actions-status-discord@v1
  with:
    webhook: ${{ secrets.DISCORD_WEBHOOK }}
    status: ${{ job.status }}

Code Quality

# SonarCloud
- uses: SonarSource/sonarcloud-github-action@master
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

# CodeQL (sécurité)
- uses: github/codeql-action/init@v3
  with:
    languages: javascript, python
    
- uses: github/codeql-action/analyze@v3

Release

# Semantic Release
- uses: cycjimmy/semantic-release-action@v4
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

# Create Release
- uses: softprops/action-gh-release@v1
  with:
    files: dist/*.zip
    generate_release_notes: true

🔝 Back to table of contents

---

4 - Creating an action

Composite action

# .github/actions/setup-project/action.yml
name: 'Setup Project'
description: 'Setup Node.js project with cache'

inputs:
  node-version:
    description: 'Node.js version'
    required: false
    default: '18'

outputs:
  cache-hit:
    description: 'Cache was hit'
    value: ${{ steps.cache.outputs.cache-hit }}

runs:
  using: 'composite'
  steps:
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: ${{ inputs.node-version }}
    
    - name: Cache dependencies
      id: cache
      uses: actions/cache@v4
      with:
        path: node_modules
        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
    
    - name: Install dependencies
      if: steps.cache.outputs.cache-hit != 'true'
      shell: bash
      run: npm ci

Use the local action

# .github/workflows/ci.yml
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Project
        uses: ./.github/actions/setup-project
        with:
          node-version: '20'
      
      - run: npm run build

JavaScript action

// index.js
const core = require('@actions/core');
const github = require('@actions/github');

async function run() {
  try {
    const name = core.getInput('name');
    console.log(`Hello ${name}!`);
    
    core.setOutput('greeting', `Hello ${name}!`);
  } catch (error) {
    core.setFailed(error.message);
  }
}

run();

# action.yml
name: 'Hello Action'
description: 'Say hello'
inputs:
  name:
    description: 'Name to greet'
    required: true
outputs:
  greeting:
    description: 'The greeting'
runs:
  using: 'node20'
  main: 'dist/index.js'

🔝 Back to table of contents

---

5 - Best practices

Security

# ✅ Bon : Version avec SHA
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608

# ⚠️ Acceptable : Tag majeur
- uses: actions/checkout@v4

# ❌ Mauvais : Branche (peut changer)
- uses: actions/checkout@main

Check the permissions

# Minimal permissions
permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

Evaluate an action

Criterion	Check
Author	Verified organization?
Stars	Popularity
Updates	Actively maintained?
Issues	Known problems?
Code	Open source? Readable?

🔝 Back to table of contents

---

6 - Practical exercises

Exercise 1: Setup Node with cache

Create a workflow with setup-node and cache:

Solution

name: Build

on: push

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - uses: actions/setup-node@v4
        with:
          node-version: '18'
          cache: 'npm'
      
      - run: npm ci
      - run: npm run build

Exercise 2: Composite action

Create an action that does checkout + setup-node:

Solution

# .github/actions/setup/action.yml
name: 'Setup'
runs:
  using: 'composite'
  steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version: '18'
        cache: 'npm'
    - run: npm ci
      shell: bash

Quiz

Q1. What is the most secure way to reference an action?

Answer

By commit SHA: uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608

🔝 Back to table of contents

---

Key takeaways

• Marketplace: +15000 actions available
• Official actions: actions/* are maintained by GitHub
• Use tags or SHA for versioning
• Composite actions: easy to create in YAML
• Check the security before using a third-party action
• Minimal permissions: the principle of least privilege

🔝 Back to table of contents

---

← Previous chapter | Next chapter: Variables and secrets →