Load used actions from an entire organization, by calling the REST API with a Personal Access Token and loop through all workflows in all repositories in the user account or organization.

The output is stored with the name actions, which can be retrieved in another action with ${{ steps.<step id>.outputs.actions }}.

Used for inserting data into the internal actions marketplace.

Minimal uses expression to use this action:

uses: devops-actions/load-used-actions@v1.3.7
with: 
    PAT: ${{ secrets.GITHUB_TOKEN }} # use an Access Token with correct permissions to view private repos if you need to

Note: the default GITHUB_TOKEN might only have read access to the current repository but can read the public repositories for any organization, depending on the specific setup of the GITHUB_TOKEN. Create a new access token (PAT or use a GitHub App) with repo scope to have full read-only access to the organization and use that as a parameter. To learn more about these types of tokens, read this blogpost.

Using a GitHub App is preferred over a Personal Access Token (PAT) because:

• Scoped permissions: A GitHub App can be granted only the permissions it needs, rather than broad repo scope.
• No user dependency: Tokens are not tied to a personal account, so they won't break if someone leaves the organization.
• Higher rate limits: GitHub Apps have higher API rate limits than PATs.

You can use an action like actions/create-github-app-token to generate a short-lived token from your GitHub App:

jobs:
  load-all-used-actions:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ vars.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}

      - uses: devops-actions/load-used-actions@v1.3.7
        name: Load used actions        
        id: load-actions
        with: 
          PAT: ${{ steps.app-token.outputs.token }}

      - name: Upload result file as artefact
        uses: actions/upload-artifact@v4
        with: 
          name: actions-file
          path: ${{ steps.load-actions.outputs.actions-file }}

This example shows how to use the action to get a json file with all the used actions in an organization. The json file is uploaded as an artefact in the third step.

jobs:
  load-all-used-actions:
    runs-on: ubuntu-latest
    steps: 
      - uses: devops-actions/load-used-actions@v1.3.7
        name: Load used actions        
        id: load-actions
        with: 
          PAT: ${{ secrets.GITHUB_TOKEN }} # use an Access Token with correct permissions to view private repos if you need to

      - shell: pwsh        
        name: Show json file
        run: cat ${{ steps.load-actions.outputs.actions-file }}
            
      - name: Upload result file as artefact
        uses: actions/upload-artifact@v4
        with: 
          name: actions-file
          path: ${{ steps.load-actions.outputs.actions-file }}

actions-file: path to file containing compressed json string with all the actions used in the workflows in the organization. The json is in the format:

[
    "actionLink": "actions/checkout",
    "count": 50,
    "workflows": [
        {
            "repo": "rajbos/actions-marketplace",
            "workflowFileName": "build-image.yml",
            "actionRef": "v3" # the 'version' of the reference being used, if any
            "actionVersionComment": null # the comment after the version, if any
        },
        {
            "repo": "rajbos/actions-marketplace",
            "workflowFileName": "build-image.yml",
            "actionRef": "6167776d96bd5da05da534aa9cea6d7c786c1c5a", # the 'version' of the reference being used, if any
            "actionVersionComment": "v3" # the comment after the 'version', if any
        },
        { "etc" : "--" }
    ]
]

Properties:

The workflow object has the following properties:

container-images-file: path to a JSON file listing all container images referenced in workflows. This includes:

• Job-level container images
• Service/sidecar container images
• Steps using docker:// references

The JSON format is the same as the actions file, with type set to "container-image" and actionLink containing the image reference.

To run this code locally, execute the entrypoint.ps1 script in the Src/PowerShell folder, and sent in the PAT and organization you want to use.