Run dcode in GitHub workflows
26,074starsnot yet scoredActive
workflow.ymlSHA-pinned
uses: langchain-ai/deepagents@7e70065200007896336f38fe905803e6763e8f85 # deepagents==0.6.12
tags can be moved; commit SHAs can't. why a SHA?
An infographics generator with 40+ plugins and 300+ options to display stats about your GitHub account!
16,907starsnot yet scoredStale
workflow.ymlSHA-pinned
uses: lowlighter/metrics@65836723097537a54cd8eb90f61839426b4266b6 # v3.34
tags can be moved; commit SHAs can't. why a SHA?
Run Prowler cloud security scanner using the official Docker image
14,126starsnot yet scoredActive
workflow.ymlSHA-pinned
uses: prowler-cloud/prowler@7345e051cf5a54e1bf5ac47e1055f9afe28a919b # 5.33.1
tags can be moved; commit SHAs can't. why a SHA?
Scan React codebases for security, performance, and correctness issues
13,516starsnot yet scoredActive
workflow.ymlSHA-pinned
uses: millionco/react-doctor@dfccac44e4468dd971e2a4fe8e44a49ba91f498a # deslop-cli@0.7.4
tags can be moved; commit SHAs can't. why a SHA?
AI-powered GitHub PR review with inline comments, sticky summary, and incremental non-destructive posting.
10,364starsnot yet scoredActive
workflow.ymlSHA-pinned
uses: alibaba/open-code-review@802af6b461d17408856fac0d07a18f9b17d6d38c # v1.7.7
tags can be moved; commit SHAs can't. why a SHA?
Runs end-to-end tests against a self-hosted instance built from the current branch. You can optionally specify a custom image to test against as well.
9,439starsnot yet scoredActive
workflow.ymlSHA-pinned
uses: getsentry/self-hosted@4c9ceba8d80dbb5d20f2fee72c49f0d93508edfe # 26.6.0
tags can be moved; commit SHAs can't. why a SHA?
Support Amlogic, Rockchip and Allwinner boxes.
9,434starsScorecard 2–4scored Jul 6, 2026Active
workflow.ymlSHA-pinned
uses: ophub/amlogic-s9xxx-armbian@87c6e6f170a3098b514c9a141db11e43caa060e8 # Armbian_noble_arm64_server_2026.07
tags can be moved; commit SHAs can't. why a SHA?
Checkout a Git repository at a particular version
8,418starsnot yet scoredActive
workflow.ymlSHA-pinned
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
tags can be moved; commit SHAs can't. why a SHA?
Flexible GitHub automation platform with Claude. Auto-detects mode based on event type: PR reviews, @claude mentions, or custom automation.
8,322starsnot yet scoredActive
workflow.ymlSHA-pinned
uses: anthropics/claude-code-action@536f2c32a39763739000b0e1ac69ca2647d97ce9 # v1
tags can be moved; commit SHAs can't. why a SHA?
Executing remote ssh commands
6,142starsScorecard 2–4scored Jul 6, 2026Active
workflow.ymlSHA-pinned
uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
tags can be moved; commit SHAs can't. why a SHA?
AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities
5,516starsnot yet scoredMaintained
workflow.ymlSHA-pinned
uses: anthropics/claude-code-security-review@0c6a49f1fa56a1d472575da86a94dbc1edb78eda # no releases — HEAD as of 2026-07-10
tags can be moved; commit SHAs can't. why a SHA?
Cache artifacts like dependencies and build outputs to improve workflow execution time
5,466starsScorecard 6–8scored Jul 6, 2026Active
workflow.ymlSHA-pinned
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
tags can be moved; commit SHAs can't. why a SHA?
Build Armbian Linux
5,301starsnot yet scoredActive
workflow.ymlSHA-pinned
uses: armbian/build@a7f3a943d30769d5657354e9660329171ca5c39d # v26.8.0-trunk.343
tags can be moved; commit SHAs can't. why a SHA?
Manage terraform collaboration
4,989starsnot yet scoredActive
workflow.ymlSHA-pinned
uses: diggerhq/digger@6baf84cd9cd7c6522b98504f4a2258474d6c2de3 # v0.6.147
tags can be moved; commit SHAs can't. why a SHA?
Run simple scripts using the GitHub client
4,984starsnot yet scoredActive
workflow.ymlSHA-pinned
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
tags can be moved; commit SHAs can't. why a SHA?
Setup a Node.js environment by adding problem matchers and optionally downloading and adding it to the PATH.
4,865starsScorecard 6–8scored Jul 13, 2026Active
workflow.ymlSHA-pinned
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
tags can be moved; commit SHAs can't. why a SHA?
This action will handle the deployment process of your project to GitHub Pages.
4,586starsnot yet scoredActive
workflow.ymlSHA-pinned
uses: jamesives/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
tags can be moved; commit SHAs can't. why a SHA?
Deterministic codebase intelligence for TypeScript/JavaScript in CI: quality, PR risk, hotspots, duplication, architecture.
4,071starsnot yet scoredActive
workflow.ymlSHA-pinned
uses: fallow-rs/fallow@c9326d9395c0b46f4077290473060b3e950b6e8c # v3.3.0
tags can be moved; commit SHAs can't. why a SHA?
Run typos to check spelling in GitHub actions
4,042starsnot yet scoredActive
workflow.ymlSHA-pinned
uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
tags can be moved; commit SHAs can't. why a SHA?
Draft release notes when pull requests merge into a branch.
3,898starsScorecard 4–6scored Jul 6, 2026Active
workflow.ymlSHA-pinned
uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7.5.1
tags can be moved; commit SHAs can't. why a SHA?