6.2 Publishing Actions to GitHub Marketplace

Publishing Actions to GitHub Marketplace

The GitHub Marketplace is the central discovery catalog for reusable actions, workflow apps, and developer integrations. Publishing an action to the Marketplace allows millions of developers across the global GitHub ecosystem to discover, consume, and integrate your tooling into their CI/CD workflows.

However, publishing to the Marketplace is governed by strict repository structure requirements, schema validation rules, security checks, and identity verification programs tested extensively on the GH-200 examination.

---

1. Marketplace Publishing Prerequisites

Before an action can be listed in the GitHub Marketplace, the repository and its metadata must satisfy five mandatory technical prerequisites:

+-----------------------------------------------------------------------------+
|                  MARKETPLACE PUBLISHING MANDATORY CHECKLIST                 |
|                                                                             |
|   [1. Public Repository]     ─── Private/internal repos cannot be listed    |
|   [2. action.yml at Root]    ─── Must reside in / (not in subdirectories)   |
|   [3. Unique Name]           ─── Must not conflict with existing listings   |
|   [4. Primary Category]      ─── Selected from approved Marketplace topics  |
|   [5. Tagged Git Release]    ─── Must use a valid SemVer tag (e.g., v1.0.0) |
+-----------------------------------------------------------------------------+

Detailed Prerequisite Specifications

---

2. Action Metadata Specification for Marketplace (action.yml)

To pass marketplace schema validation, action.yml must include complete metadata and a properly formatted branding block.

name: 'Super-Linter Advanced'
author: 'Enterprise DevOps Tooling Team'
description: 'Automated polyglot code linting and style enforcement across 40+ languages'

# Branding configuration rendered on GitHub Marketplace
branding:
  icon: 'check-circle' # Valid icon from Feather icons (feathericons.com)
  color: 'blue'        # Valid color from supported palette

inputs:
  github-token:
    description: 'GitHub token for status checks and annotations'
    required: true
    default: '${{ github.token }}'

outputs:
  lint-results:
    description: 'JSON summary of lint execution status'

runs:
  using: 'node20'
  main: 'dist/index.js'

Valid Branding Values

• Icons: Must match an identifier from the open-source Feather Icons library (e.g., shield, terminal, box, cpu, database, lock, play, check-circle, activity, zap, upload-cloud).
• Colors: Must be one of the eight supported GitHub Marketplace colors: white, yellow, blue, green, orange, red, purple, or gray-dark.

---

3. The Marketplace Publishing Workflow

Publishing an action is integrated directly into the GitHub Releases interface within the repository.

+-----------------------------------------------------------------------------+
|                     MARKETPLACE PUBLISHING FLOWCHART                        |
|                                                                             |
|   +---------------------------------------------------------------------+   |
|   | Step 1: Open Repository -> Click 'Releases' -> 'Draft a new release'|   |
|   +---------------------------------------------------------------------+   |
|                                      |                                      |
|                                      v                                      |
|   +---------------------------------------------------------------------+   |
|   | Step 2: Check box: 'Publish this Action to the GitHub Marketplace'  |   |
|   +---------------------------------------------------------------------+   |
|                                      |                                      |
|                                      v                                      |
|   +---------------------------------------------------------------------+   |
|   | Step 3: Automated Validation checks action.yml, branding, & name    |   |
|   +---------------------------------------------------------------------+   |
|                                      |                                      |
|                                      v                                      |
|   +---------------------------------------------------------------------+   |
|   | Step 4: Select Primary & Secondary Categories                       |   |
|   +---------------------------------------------------------------------+   |
|                                      |                                      |
|                                      v                                      |
|   +---------------------------------------------------------------------+   |
|   | Step 5: Choose Tag (e.g., v1.0.0), Title, & click 'Publish Release' |   |
|   +---------------------------------------------------------------------+   |
+-----------------------------------------------------------------------------+

[!IMPORTANT] Repository Banner: When GitHub detects a valid action.yml in the root of a public repository, a special banner appears at the top of the repository: "Draft a release to publish this Action to the GitHub Marketplace." Clicking this banner automatically pre-selects the marketplace publishing options.

---

4. The Verified Creator Badge Program

In enterprise environments, security policies often restrict developers to using only first-party GitHub actions or actions from Verified Creators.

                  ┌─────────────────────────────────────┐
                  │     actions/checkout                │
                  │     By GitHub [✔ Verified Creator]  │
                  │     Category: Utilities             │
                  └─────────────────────────────────────┘

Qualifications for Verified Creator Status

A Verified Creator badge (the official blue checkmark icon on Marketplace listings) indicates that GitHub has verified the authenticity of the organization publishing the action.

• GitHub Organization Requirement: The action must be published by a GitHub Organization, not an individual personal user account.
• Domain Verification: The organization must have completed domain verification via DNS TXT records confirming ownership of the company's official domain name.
• Verified Organization Profile: The organization profile must display the verified domain badge publicly.
• Two-Factor Authentication (2FA): 2FA must be enforced across all members of the organization.
• Partnership / Direct Verification: The organization must be an official GitHub partner or vetted enterprise vendor.

Enterprise Policy Governance

Enterprise administrators can navigate to Organization Settings → Actions → General → Action permissions and enforce:

• "Allow all actions"
• "Allow enterprise actions only"
• "Allow marketplace actions by GitHub and Verified Creators only"
• "Allow specified actions and reusable workflows"

---

5. Action Lifecycle, Unpublishing & Security Advisories

Once an action is published to GitHub Marketplace, maintaining ecosystem stability is paramount.

Unpublishing Constraints

To prevent supply chain disruptions across thousands of independent CI/CD workflows, GitHub restricts unpublishing actions. Once published:

• Maintainers can publish new versions or update descriptions.
• If an action must be permanently sunset, maintainers should add a deprecationMessage: in action.yml, update the README.md, and unlist the action via GitHub Support if necessary.
• Deleting the repository immediately breaks all workflows referencing that action by repository path.

GitHub Security Advisories for Actions (GHSA)

When a vulnerability is discovered in an action (e.g., script injection or vulnerable dependencies):

1. Maintainers open a GitHub Security Advisory (GHSA) in the repository under the Security tab.
2. The maintainer requests a CVE identifier directly through GitHub's CNA (CVE Numbering Authority) workflow.
3. Maintainers collaborate on a patch in a private temporary fork.
4. Once patched, the maintainer publishes the fixed release (e.g., v1.2.1 and updates v1), and publishes the advisory.
5. GitHub automatically notifies all downstream consumers and Dependabot users across the platform.