Skip to content

GitHub Actions

GitHub Actions are pre-defined tasks that can be used within a GitHub Workflow, triggered by events such as committing to a branch or pull request.

GitHub Actions Marketplace contains a wide range of actions that can be used to quickly create a workflow.

Maintenance verses stability and security

The more specific the action version used in a workflow, the more secure the workflow becomes at the cost of additional version maintenance (updates required more frequently).

The full SHA of a release is an immutable reference, creating the most stable and security definition.

Specifying only the major version automatically uses the latest tag, within that major version. Maintenance is reduced as the major version changes far less often.

Method Description Stability/Risk
Major Version actions/name@v5 Fails when tags missing
Tag actions/name@v3.5.2 Stable if Release cannot be republished
Commit SHA actions/name@9e4...f2c3 Most stable, immutable reference

Automate version updates to minimise maintenance

Authentication

GitHub actions have read access to repositories, allowing them to checkout code and configuration. Additional permissions for the GitHub Action requires an authorisation token.

GitHub automatically creates a token that GitHub actions can use to make an authenticated API request, scoped to the current repository.

Use automatically created token
      - uses: actions/name@v2
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

For customised authentication or access to a different GitHub repository, create a developer token and save it as a user or organisation secret.

GitHub - Automatic token authentication

Common GitHub Actions

Action Description
Checkout Checkout repository to enable workflow to access
Cache cache dependencies and build outputs to improve workflow execution time
Changelog Enforcer checks the CHANGELOG.md file has been updated for a pull request
MegaLinter verify code and configuration consistency
Setup reviewdog Setup reviewdog post review comments to pull requests, typically used with lint tools
Clojure lint clj-kondo lint with reviewdog comments added inline to pull request
Setup java jdk setup up Java run-time environment (specify version, distribution, etc)
Setup clojure Setup Clojure environment and common Clojure tools for quality (clj-kondo, cljstyle, unit testing, etc)
Setup go sets up a Go language environment
Setup node setup a version of the Node.js environment, caching npm/yarn /pnpm dependencies
Setup python Provides python or PyPy, optionally cache pip dependencies
GitHub Pages Deploy deploy to GitHub pages, including cross-repository deployments

Actions to investigate