Time for Actions: A Longitudinal Study of the GitHub Actions Marketplace

GitHub Workflows have emerged as one of the most widely adopted CI/CD platforms, with millions of workflows integrated into modern software development. With the ability to encapsulate a subset of workflow functionality into reusable components known as GitHub Actions, any developer can publish their actions to the GitHub Actions Marketplace. To date, there has been no comprehensive analysis of the GitHub Actions Marketplace in terms of the number of actions, their growth over time, and their susceptibility to supply-chain attacks. In this paper, we present a longitudinal study of GitHub actions, aiming to better understand this important, modern software ecosystem. Over a period of four months, we collected and analyzed over 23K GitHub Actions including their source code as well as metadata about their creators. Our analysis investigates marketplace trends, identifies prevalent security issues in GitHub Actions, and characterizes novel attack vectors, including actions typosquatting and dangling remote references.