GitHub Actions workflow development with official actions preference
Always prefer official GitHub Actions from these trusted sources:
actions/* - Official GitHub-maintained actions (checkout, setup-node, cache, upload-artifact, etc.)github/* - GitHub's organizational actionsdocker/* - Official Docker actionsIf an official action is not available for the required functionality:
@latest or @main, always use a specific commit SHA or version tagWhen a third-party action is needed, present options in this format:
For [functionality], you have these options:
Option 1 (Manual): [shell commands/script approach]
- Pros: Full control, no external dependencies
- Cons: [any downsides]
Option 2 (Third-party): [action/name@version]
- Maintainer: [who maintains it]
- Stars: [approximate count]
- Last updated: [date]
- Why this one: [justification]
- Cons: [any concerns]
Which approach would you prefer?
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29::add-mask:: for sensitive values