World map

 

BM

World 7: Robots: Actions & CI/CD

Marketplace actions and pinning

You will learn: how to borrow actions safely and pin them so they can't change.

The problem

Your job needs Node on the runner. You could write 30 lines of install script. Thousands of people need the same thing. What’s the smart move?

Watch

Tap every line that borrows an action.

0 of 2 found

An action: A ready-made step someone shared. You borrow it with uses:. is a ready-made step, like a Lego brick. uses: owner/name@version borrows one.

Watch

The GitHub Marketplace: GitHub's shop where people share actions and apps. is a shop of shared actions. Anyone can publish there. So check before you borrow. Trust it? Swipe each clue.

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

Made by a creator GitHub verified, used by thousands

Watch

Tap each point on the timeline.

@v7 is a tag: a sticky note on one commit. Sticky notes can be moved. Tap through the story.

Watch

Tap the line that can never change under you.

0 of 1 found

A full commit SHA can never point at other code. Using it is called pinning (an action): Using an action's full commit SHA, so its code can never change under you.. Add the version as a comment, for humans. (That SHA is a made-up example.)

Try it

Can it move, or never? Sort each version.

Drag a card into a box. Or tap the card, then tap the box.

      Predict

      You pinned an action to a SHA. Then version 7.0.2 fixes a bug. What happens?

      You did it!

      You can now pick safe actions and pin them.

      Go deeper (optional)

      Actions under actions/ are made by GitHub. GitHub’s own advice: pin third-party actions to a full SHA. Copy the SHA from the action’s own repo, never from a fork. A branch like @main is the riskiest: you run whatever lands there next.