steps

`uses:`

Runs a published action inside a step. The reference should include an immutable commit SHA or a version tag; inputs are passed via the `with:` block.

Syntax

- uses: <owner>/<repo>@<ref>
  with:
    <input>: <value>

Common values / subkeys

Value / Subkey	Purpose
@<sha>	Pin to an immutable full 40-char commit SHA (recommended)
@vN	Major version tag — convenient but mutable
./local/path	Reference a local composite action in the same repo
docker://image:tag	Use a container image directly as the action
with	Pass typed inputs declared in the action.yml

Examples

- uses: actions/checkout@v4
  with:
    fetch-depth: 0

Checkout full history

- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: npm

Setup Node with dependency caching

- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

SHA-pinned reference with a version comment

- uses: ./.github/actions/setup-env
  with:
    profile: prod

Local composite action

Gotcha

Version tags like `@v4` are mutable — a compromised tag can point at malicious code; pin third-party actions to a full 40-char SHA for supply-chain safety.

Related keywords

run:

Executes a shell command on the runner. Multi-line scripts run in a single shell invocation; the shell is chosen by `shell:` (or workflow `defaults`) and defaults to bash on Linux/macOS and pwsh on Windows.

uses: <workflow_call>

Reusable workflows are files that declare `on: workflow_call` and can be invoked as a job in another workflow. The caller passes typed `with:` inputs and either inherits or explicitly forwards secrets.

${{ secrets.NAME }}

The `secrets` context exposes repository, environment, and organization secrets to workflow expressions. Values are masked in logs and are not passed to workflows triggered from forked PRs.

← All GitHub Actions syntax · Git commands · Cron syntax