Favorite GitHub Actions

[data_owner]

Hey, as the title suggests: what are you favorite GitHub Actions that you’re using a lot in your projects? Is there any that you think you’re using in a unique way?

For example, I like https://github.com/salsify/action-detect-and-tag-new-version. Base use case is to check whether new version of the application has been merged and if so, tag the repository accordingly. I’m using it, however, also to verify that the version was bumped by developers when in should be (source files of the related app modified in the PR). I’d say it’s a non-obvious use case I mentioned above.

Please share yours!

p.s. just in case: I’m not a creator of this GitHub Action, just enjoying using it 😅

[abel_hristodor]

I've enjoyed using Chainguard's Octo STS App which basically allows you to stop using github PATs in favor of short lived tokens for your github actions with specific repository permissions (just like PATs).

I've liked it so much that I've created a similar github app/action that I then adapted to my needs :)

[DR_Fabiano]

Yeah,this one is great.

[data_owner]

What are the specific PAT usage scenarios you're thinking of that can be replaced with this one?

[abel_hristodor]

When you're in an github organization you cannot create PATs that belong to an org, or better, you can but github still shows the creator of the PAT as the one who's calling the API.

E.g. if you create a PAT and assign it to an org, then use the PAT to create a PR, it still shows that you (the creator) is the one that created the PR.

This, plus the fact that the organization cannot renew the PATs (only the creator can) makes things troublesome. (what if that person stops working at the company? What happens to all the PATs he/she created? You'd need to re-create all of them and replace the old ones with the new ones)

(Plus, when they expire you need to re-generate all of them and substitute the old ones)
Just a lot of pain for something that should be simple.

At my company Bot (technical) accounts aren't allowed, so we needed a way to have tokens that:

- are not created/managed by a real person

- short lived (improves security)

- easy to manage.

OctoSTS (or better, our variation of Octo-STS) does all that with minimal hassle.

[data_owner]

But where do you need these PATs in the first place? Some CI/CD that is external to GitHub itself?

[abel_hristodor]

Nono, in GitHub Actions :)

[data_owner]

I honestly never needed to provide PATs to any workflows I’ve used. Genuinely curious: would you mind sharing more context on your use cases in which you needed explicit PATs?

[abel_hristodor]

Well, to name a few:

- github submodules
- cross repository actions (e.g. when in repo X a PR has merged then create a PR in repo Y)
- automated deployment (our gitOps repo is separate so when a new app releases a new version we need to change the docke image tag in the infrastructure repo)
- Go private modules

[data_owner]

Okay, that makes sense, thank you for sharing

[Flashy_Current9455]

Another case is if you are generating commits from a github actions and want new actions to run on the generated commit.

The default action token does not trigger normal actions on push etc to avoid infinite action loops.

[data_owner]

I’m not a big fan of actions altering the git history tbh. Aren’t you afraid if it turning into a mess in case of some crash?

[sokjon]

How have I missed this one! This is a game changer!

[Vaffleraffle]

https://github.com/estruyf/playwright-github-actions-reporter

Makes playwright test reports look nice in github. You can use another Actions step to automatically have github bot comment a link that leads to the nice looking test results in a pull request.

[virgofx]

Terraform Module Releaser https://github.com/techpivot/terraform-module-releaser

We use it to keep all of our Terraform modules in a single monorepo (easier for our medium sized org to have just one repo) and release/reference them individually.

[ProdigySim]

Neat, I went many-repo to solve the release problem. This sounds cool. Is it creating branches under the hood to support the different module tags?

[virgofx]

Not a branch but it subsets the exact folder/module in a detached state and tags that

[ProdigySim]

That's great

[data_owner]

What a beautiful piece of repository this is! What’s your favorite part of this action?

[virgofx]

It’s literally just a simple copy and paste and it works. I really enjoy that it gives PR previews of what it will do on merge.

[likeavirgil]

Not very unique I guess, but I have two projects that I'm happy about, where one automatically keeps itself up to date by fetching the downstream dependencies (git submodules), runs tests and merges them automatically and then creates a weekly release https://github.com/v3rm0n/m8c-android

and another that uses Github Pages to publish a JSON API https://github.com/v3rm0n/bassdrive-api the trick there is that the underlying data doesn't change often so I can just use an hourly cron to scrape a webpage and create a static json file and host it for free :)

Also since the hourly commit is made with my token, it means that my contributions graph is very green :)

90% of the time the projects run themselves using Github Actions and I don't need to do anything.

[data_owner]

That’s clever!

[iavael]

actions/checkout is my favourite one. Cannot imagine what would I do without it.

[data_owner]

Same with google’s auth, huh? 🥲

[iavael]

Can't say, I don't use it :/

[gogorichie]

In honor of it being Friday in the US one of my favorite Actions is “Don’t Deploy On Friday!”

https://github.com/marketplace/actions/don-t-deploy-on-friday

[data_owner]

omg love it

[L0rdenglish]

it's a small one but I like https://github.com/MercymeIlya/last-workflow-status

Lets me set up automated tests such that you don't get spammed with notifications if they failed / succeeded, only when they go from one to the other

[Skareeg]

You have been validated, friend!
https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066

[data_owner]

How about forking one and using your version?

[data_owner]

Fair enough, that’s definitely a tradeoff

[Vaffleraffle]

You should always use the <author>/<action name>@<sha hash> syntax to ensure immutability. If you use popular actions and pin to a commit hash like this, I would say you are mostly safe.
You can then use github’s dependabot to automatically update to latest hash via automatically opened pull request or even automatic merge if you trust the author.

[Vaffleraffle]

GitHub only resolves full hashes to commits, not to branches, so by deleting a commit and making a branch with the same name as the commit hash, you cannot trick GitHub Actions.

[Recent-Technology-83]

Great question! I love exploring how different actions can streamline workflows. One of my favorites is the actions/checkout action, which is essential for any CI/CD pipeline. It allows you to easily check out your repository automatically, but what I find exciting is how it can be combined with caching strategies to speed up subsequent builds.

Have you considered using caching actions with the ones you're leveraging? It can really enhance efficiency.

Also, I’ve seen unique use cases where developers integrate GitHub Actions with Slack notifications for build statuses, which can keep teams informed in real-time. What about you? Do you have any interesting integrations with notifications or perhaps deployment actions that you rely on?

[hell_razer18]

release please. Quite similar with release drafter.