GitHub Actions was introduced in 2019 and constitutes an integrated alternative to CI/CD services for GitHub repositories. The deep integration with GitHub allows repositories to easily automate software development workflows. This paper empirically studies the use of GitHub Actions on a dataset comprising 68K repositories on GitHub, of which 43.9% are using GitHub Actions workflows. We analyse which workflows are automated and identify the most frequent automation practices. We show that reuse of actions is a common practice, even if this reuse is concentrated in a limited number of actions. We study which actions are most frequently used and how workflows refer to them. Furthermore, we discuss the related security and versioning aspects. As such, we provide an overview of the use of GitHub Actions, constituting a necessary first step towards a better understanding of this emerging ecosystem and its implications on collaborative software development in the GitHub social coding platform.

1. On the Use of
GitHub Actions in
Software Development
Repositories
Alexandre Decan, Tom Mens,
Pooya Rostami Mazrae, Mehdi Golzadeh
Software Engineering Lab
University of Mons, Belgium
This work is supported by the ARC-21/25 UMONS3 Action de Recherche Concertée financée par le Ministère de la Communauté française – Direction générale de l’Enseignement
non obligatoire et de la Recherche scientifique, as well as by the Fonds de la Recherche Scien4fique - FNRS under grant numbers O.0157.18F-RG43, T.0017.18 and T.0022.13.

2. Collaborative software development
Changes
Changes
Changes
Quality
analysis
Trigger a build Run test Deploy
CI/CD
2

3. Evolution of CI/CD usage in 90K GitHub repositories
On the rise and fall of CI services in GitHub, SANER 2022, 10.1109/SANER53432.2022.00084
3

4. Why is GitHub
Actions so popular?
• deep integration with GitHub
• ease of use
• speed
• reliability
• free tier for open source projects
• large marketplace of reusable
Actions
• support for major operating systems
4

5. GitHub Actions 5

6. GitHub
marketplace
6

7. Research
Questions
What are the
characteristics of
repositories using
workflows?
Which kinds of
workflows are
automated?
What are the
most frequent
jobs in
workflows?
What are the
automation
practices?
Which types of
Actions are
reused?
7

8. Data extraction
• Repositories active in 2021
• At least 100 commits and 100 stars
Dataset
• 29,778 repositories use GHA (out of 67,870)
• 70,278 workflow files
• 108,500 jobs
• 567,352 steps
More than 4 out of 10 GitHub repos use workflows
doi.org/10.5281/zenodo.6634682
8

9. Quantification of jobs in workflows
a repository can define multiple
workflows
average of 2.4 workflows per repository
single workflow (49.3%)
more than one workflow (50.7%)
Jobs in workflows
average of 1.5 jobs per workflows
single job (77.8%)
more than one job (22.2%)
9

10. Breakdown of GHA usage per language
10
Python;
19,0%
JavaScript;
15,9%
TypeScript;
12,5%
Go; 9,6%
Java; 8,0%
C++; 7,8%
PHP; 6,5%
C; 5,2%
C#; 4,2%
other; 15,5%
% GHA usage in workflows
45,90%
34,90%
58,50% 57,20%
39,20%
40,90%
48,20%
36,10% 34,60%
0,00%
10,00%
20,00%
30,00%
40,00%
50,00%
60,00%
70,00%
Python JavaScript TypeScript Go Java C++ PHP C C#
% usage of GHA w.r.t. main repository
programming language

11. Characteristics of
GitHub repositories
using GHA
Median Effect size
Characteristic
With
workflows
Without
workflows
Interpretation
Pull Requests 124 41 medium
Contributors 20 11 small
Commits 598 344 small
Issues 105 59 small
Repos with GHA workflows tend to have
more contributors, pull requests,
commits, and issues
11

12. Most frequent event types triggering workflows
12
63,4
56,3
16,1 15,4
6,2
8,6
0
10
20
30
40
50
60
70
push PR schedule workflow_dispatch release others
TOP 5 EVENT TYPES IN GITHUB REPOSITORIES.

13. Different ways of executing code
Step type Action target % of steps % of repositories
run:
(command)
-- 49,9% 93,5%
uses:
(Action)
Local path 0,8% 2,0%
Docker image 0,1% 1,8%
Same repository 0,2% 0,4%
Same owner 0,7% 4,3%
Other public repository 48,3% 99,3%
Reusing Actions in steps is a common practice
13

14. Which category of Actions are reused?
14
Actions category
% of
steps
% of
repos
Utilities 88.2% 99.4%
Continuous
integration
4.9% 12.9%
Publishing 0.7% 2.9%
Deployment 0.2% 0.6%
Code quality 0.3% 1.0%

15. Which Actions are reused?
35,50%
7,20% 6,60% 5,90% 5,80%
98%
22%
26%
19% 21%
0,00%
10,00%
20,00%
30,00%
40,00%
50,00%
60,00%
70,00%
80,00%
90,00%
100,00%
actions/checkout actions/cache actions/setup-node actions/upload-artifact actions/setup-python
Top 5 most frequent Actions in steps and repositories
steps repositories
• A few Actions concentrate
most of the reuse
• Most of them being
developed by GitHub
15

16. The GitHub Actions
software ecosystem
16

17. The GitHub Actions Ecosystem
17
Many similarities with software packaging ecosystems (e.g. npm, PyPI, Cargo)
Exposed to (and already suffering from) similar issues à call for further studies
Continuous growth and evolution Outdatenedness
At least 16% of steps are referring
to an older major Actions
Security issues
- CVE-2020-15228
- CVE-2021-22862
- CVE-2021-32074
- CVE-2022-39217
Breaking changes
Around 90% of workflows assume
semantic versionning for reusable
Actions
Dependency issues,
abandonment, quality, …

18. The GitHub Actions Ecosystem
18
software
packages
Actions
software
repositories
developed in
depend on
depending on
packaging ecosystem
publish
workflows
use
rely on

19. Thank you for your
attention!
Questions?
19