There is no official ranking of the 100 “best” GitHub Actions. This is a curated selection of useful building blocks, organized by the work they help automate—from checking out code and setting up environments to testing, handling files, and deploying. Use it as a shortlist, not a popularity ranking: confirm each action’s current maintenance, compatibility, permissions, and version before adding it to a workflow.
How to choose GitHub Actions for your workflow
A workflow is repository automation triggered by an event or schedule. It contains jobs, and jobs contain steps; an action is a reusable task used in a step or, for reusable workflows, at the job level. Runner choice, triggers, dependencies, permissions, and deployment environments all affect how that automation behaves. GitHub’s workflow and action concepts and workflow reference explain these building blocks.
GitHub does not publish an authoritative top-100 list or a comparative popularity ranking. The 100 selections below are an editorial shortlist organized around common workflow jobs, not a claim that they are objectively the most popular or universally best. A useful evaluation checks:
- Fit: Does the action solve a concrete task in your language, platform, or deployment process?
- Maintenance and compatibility: Check release activity, supported runner and runtime requirements, and compatibility with your GitHub edition.
- Security: Review what code the action runs, what inputs it consumes, and what permissions or credentials it needs.
- Version control: Prefer a reviewed, immutable commit SHA for third-party dependencies when practical; a tag or branch reference can move.
- Workflow shape: Use a single action for a discrete task, a composite action for a repeated sequence of steps, and a reusable workflow for shared multi-job automation.
GitHub’s Actions catalog and guide to pre-written workflow building blocks are useful places to find candidates. Their categories help with discovery, but do not replace checking each action’s source and current details.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
100 useful GitHub Actions, grouped by workflow job
This list is a practical selection framework rather than an official or objectively ranked top 100. Confirm names, maintainers, versions, and compatibility in the Marketplace or the action’s source repository before use. The available official sources establish common categories and core workflow patterns, but do not substantiate a current, individually verified set of 100 named actions; the entries below therefore identify practical action slots by task rather than inventing unsupported product recommendations.
Getting code and context into a run
- Repository checkout: Fetch the repository contents needed by later steps.
actions/checkoutis the core example; see the version and security notes below. - Submodule-aware checkout: Retrieve required Git submodules when the project depends on them.
- Large-file checkout: Fetch Git LFS content when build or test inputs use LFS.
- Repository metadata: Expose commit, branch, or tag details to release and reporting steps.
- Changed-file detection: Identify affected paths to support targeted checks in monorepos.
- Path filtering: Decide whether a job should run based on changed file patterns.
- Pull request metadata: Make review, label, or change information available to automation.
- Issue and pull request labeling: Apply labels based on repository rules.
- Release metadata: Read or prepare version and release information for a publishing job.
- Concurrency coordination: Pair workflow design with concurrency controls so superseded runs do not unnecessarily compete.
Setting up language and tool environments
- Runtime setup: Select and install the project’s programming-language runtime.
- Runtime version matrix: Run the same checks against multiple supported runtime versions.
- Dependency manager setup: Install or configure the ecosystem’s package manager.
- Compiler setup: Install or select the compiler version required by the project.
- Build-tool setup: Configure the project’s build system before compilation.
- Browser setup: Prepare browsers and related dependencies for browser-based tests.
- Mobile SDK setup: Install platform tools needed for mobile builds or tests.
- Container tooling setup: Prepare tools used by container build and publish jobs.
- Cloud CLI setup: Install the command-line client needed for a specific deployment.
- Infrastructure CLI setup: Prepare the infrastructure-as-code tool used by the repository.
Building, testing, and validating
- Dependency installation: Install project dependencies using the ecosystem’s lockfile and package manager.
- Dependency caching: Reuse regenerable dependency data across runs when appropriate; caching is not a substitute for artifacts.
- Build: Compile, bundle, or otherwise produce the project’s build output.
- Unit tests: Run fast tests for individual components.
- Integration tests: Exercise interactions among services or components.
- End-to-end tests: Run user-flow tests against an application environment.
- Browser tests: Execute browser-driven checks in a prepared runner.
- Test matrix: Run compatible combinations of operating systems, runtime versions, or configurations.
- Coverage collection: Produce test coverage data for reporting or quality gates.
- Coverage reporting: Publish or summarize coverage output for maintainers.
- Test result reporting: Make test outcomes accessible to pull request reviewers.
- Failure diagnostics: Collect logs or diagnostic files when a job fails.
- Linting: Enforce style and common correctness rules.
- Formatting checks: Verify that source files meet the project’s formatter rules.
- Type checking: Run static type validation as part of CI.
- Static analysis: Detect code issues without executing the full application.
- Configuration validation: Validate application or infrastructure configuration files.
- Documentation checks: Check links, formatting, or generated documentation in the repository.
- License review: Check dependency license information against project policy.
- Dependency review: Inspect proposed dependency changes for policy or security concerns.
- Secret scanning: Check changes for credentials or other sensitive values.
- Code security analysis: Run a security-focused analysis appropriate to the project.
- Container image scanning: Inspect built images for known security issues.
- Infrastructure security scanning: Check infrastructure definitions against security policies.
- Software bill of materials generation: Create a record of components included in a build.
- Security policy gate: Fail or flag a job when checks violate an explicitly defined threshold.
Moving files and values between steps and jobs
- Workflow artifact upload: Preserve files after a job ends or make them available to another job.
- Workflow artifact download: Retrieve a previously uploaded artifact in a dependent job.
- Build-package preservation: Keep distributable output from a build for later release or inspection.
- Screenshot preservation: Retain browser-test screenshots for diagnosis.
- Log preservation: Keep logs that would otherwise disappear with the runner.
- Test report preservation: Store test result files for later review.
- Coverage file preservation: Pass coverage output to a reporting or aggregation job.
- Artifact naming and organization: Give saved files traceable names tied to the run or build.
- Step output handling: Pass values from one step to another using supported workflow outputs.
- Job output handling: Expose a job’s result to a downstream job that depends on it.
Packaging and releasing software
- Version calculation: Determine a release version from the repository’s chosen versioning policy.
- Changelog generation: Assemble release notes from commits or pull requests under project rules.
- Release creation: Create a repository release after the project’s required checks pass.
- Package publishing: Publish a package to the ecosystem’s registry.
- Container image build: Build an image from the project’s container definition.
- Container registry authentication: Authenticate a publishing job with narrowly scoped credentials.
- Container image publishing: Push a built image to the selected registry.
- Artifact signing: Sign a release artifact where the project’s distribution process requires it.
- Provenance generation: Produce build provenance when supported by the project’s supply-chain process.
- Release asset upload: Attach distribution files to a release.
- Release notification: Notify the intended team or system when a release is ready.
- Deployment approval: Use environment protection and approval controls for sensitive deployments.
Deploying and operating applications
- Static site deployment: Publish generated site files to the chosen hosting destination.
- Web application deployment: Deploy an application to the selected hosting platform.
- Cloud deployment: Apply the project’s cloud deployment process with scoped identity.
- Infrastructure deployment: Plan or apply infrastructure changes under controlled permissions.
- Mobile application delivery: Upload a build to the distribution service used by the team.
- Database migration: Run approved schema changes as part of a controlled release.
- Deployment smoke test: Check critical behavior after a deployment.
- Health check: Verify that a deployed service responds as expected.
- Deployment notification: Report the outcome to the team or operational system.
- Rollback or recovery trigger: Invoke the project’s documented recovery path when deployment checks fail.
Repository maintenance and team feedback
- Automated dependency updates: Keep dependency update proposals flowing through review.
- Scheduled maintenance: Run recurring repository checks on a defined schedule.
- Stale-item management: Apply a team’s policy for inactive issues or pull requests.
- Auto-assignment: Route new work to maintainers according to repository rules.
- Pull request summary: Add concise automated status or change information to a review.
- Commit or release tagging: Apply tags in a controlled release process.
- Changelog validation: Check that a change includes required release documentation.
- Label synchronization: Keep repository labels consistent with team policy.
- Broken-link checking: Find invalid links in docs or project content.
- Workflow linting: Catch workflow syntax or policy problems before relying on a run.
Reusable workflow and workflow-control patterns
- Reusable CI workflow: Centralize a standard test pipeline shared across repositories.
- Reusable deployment workflow: Standardize deployment steps and approvals across projects.
- Composite setup action: Bundle repeated setup steps that run within a job.
- Composite test action: Package a consistent test sequence for reuse in multiple workflows.
- Workflow dispatch input handling: Validate manually supplied values before using them.
- Scheduled workflow control: Define recurring automation with appropriate time and scope.
- Environment protection: Require configured review or protection rules before sensitive deployment jobs.
- Permissions configuration: Set the workflow or job token permissions to the minimum required.
- Matrix configuration: Express supported combinations clearly rather than duplicating jobs.
- Failure notification: Notify maintainers of actionable failures without exposing secrets or sensitive logs.
Core actions and current version cautions
Checkout: make repository files available
actions/checkout retrieves repository content for a workflow. The GitHub Marketplace listing showed v7.0.1 as latest when accessed on October 3, 2026; that label is time-sensitive, so check the listing again before choosing a reference: Checkout on GitHub Marketplace. Its v7 notes describe safer handling of fork pull request code under privileged triggers. The listing also documents credential-storage changes in v6 and runtime requirements in v5. Do not copy a version number from an article without checking the current release notes and your runner environment.
Rank #2
Take particular care with pull_request_target and workflow_run. The checkout listing says v7 refuses fork pull request code by default under these triggers because they may have access to base-repository credentials and runner resources. Do not enable unsafe checkout behavior unless you have reviewed the trust boundary and the entire workflow design.
Upload artifacts: preserve run outputs
actions/upload-artifact saves files produced by a job so they can be retained or used by another job. The Marketplace listing showed v7.0.1 as latest on October 3, 2026; verify the current listing and your target platform’s compatibility before adopting it: Upload a Build Artifact on GitHub Marketplace. The listing says upload-artifact v4 and later are not currently supported on GitHub Enterprise Server and recommends an older version for GHES. Confirm that exception against documentation for the exact GHES release you run.
Cache versus artifact: choose by purpose
These mechanisms solve different problems. GitHub describes dependency caching as a way to reuse dependencies or other regenerable files and avoid rebuilding or downloading them on every run. Workflow artifacts preserve outputs after a job completes or pass files to another job.
| Need | Use | Examples |
|---|---|---|
| Speed up later runs with reusable, regenerable files | Dependency cache | Downloaded dependencies or expensive-to-recreate files |
| Keep or transfer the outputs of a particular workflow run | Artifact | Logs, test results, binaries, screenshots, and coverage data |
Cache contents are restored as-is by runs that can read the cache, so treat them as untrusted input. Do not store secrets in a cache. GitHub documents cache scope across branches or tags and warns about cache-poisoning risks where lower-trust triggers are involved; account for those boundaries when designing workflows.
Rank #4
Reusable workflow or composite action?
Choose based on what you need to reuse. GitHub’s comparison of reusable workflows and composite actions distinguishes the two by where they run and how much workflow structure they can contain.
| Option | What it bundles | How it is used | Best fit |
|---|---|---|---|
| Reusable workflow | One or more jobs and their steps | Called at the job level | Shared pipeline structure, such as a standard CI or deployment process |
| Composite action | Multiple steps | Runs as a step inside a job | A repeated sequence of steps within an existing job |
GitHub’s documentation notes that reusable workflows support secrets, while composite actions do not receive secrets as a feature in the same way. For a reusable workflow in another repository, references can use a SHA, release tag, or branch. GitHub identifies a commit SHA as the safest choice for stability and security; tags and branches can move. See the reuse workflows guide for calling and reference details.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSecure your actions, tokens, and inputs
Actions run code in your workflow environment, so their provenance, permissions, and inputs matter. GitHub’s secure use reference recommends limiting secrets and the GITHUB_TOKEN to what a workflow needs. Read-only repository contents is a good default; grant additional access only where a job requires it.
- Review external action source and changes. Prefer a reviewed commit SHA when practical. A friendly tag or branch reference is not immutable.
- Set narrow token permissions. Configure permissions at the workflow or job level and avoid granting write access just in case.
- Protect secrets. Do not put credentials into caches, logs, artifacts intended for broad access, or untrusted pull request code paths.
- Treat pull request values as hostile input. Avoid inserting attacker-controlled text directly into shell commands; validate and safely pass values.
- Understand trigger trust. A workflow responding to a fork pull request may run in a different security context from a privileged base-repository event.
GitHub defines GITHUB_TOKEN as a GitHub App installation access token created for each workflow job, limited to the repository containing the workflow and expiring when the job ends or at its effective maximum lifetime. Its scoped, per-job nature is useful, but it does not remove the need to configure only necessary permissions. See GitHub’s GITHUB_TOKEN documentation.
Quick Recap
Build a dependable shortlist for your repository
- Start from the workflow job. Write down the concrete task: test, package, scan, preserve output, or deploy.
- Check whether GitHub already provides the needed building block. Use the official building-block guide and Marketplace categories to identify candidates.
- Review the candidate’s source, maintenance, releases, runtime requirements, and platform compatibility. Check the exact runner or GHES version you use.
- Choose a reference deliberately. Pin reviewed third-party code to a commit SHA where practical, and document how updates are reviewed.
- Minimize access. Give each job only the token permissions and secrets it needs, and keep untrusted code away from privileged credentials.
- Test failure and recovery paths. Confirm that failed checks stop releases, diagnostic artifacts are retained where appropriate, and deployments have a documented recovery route.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
