We scored 1,136 popular GitHub Actions. 42% are abandoned — including one with 17,000 stars.

TL;DR: We analyzed 1,136 GitHub Actions with 50 or more stars across security, maintenance, popularity and reliability. 474 of them (41.7%) are abandoned — archived, or without a single commit or release in over a year. Another 186 (16.4%) are stale. Nearly six in ten popular actions are coasting without active maintenance, while the workflows that depend on them keep running every day.

Why this matters

In March 2025, the tj-actions/changed-files supply-chain attack (CVE-2025-30066, CVSS 8.6) compromised CI secrets across more than 23,000 repositories by rewriting the git tags of a widely-used action. Only workflows that pinned a full commit SHA were immune. GitHub responded with SHA-pinning enforcement policies and immutable releases — but neither of those tells you whether the action you depend on is still alive.

An abandoned action never gets a security patch. It is a supply-chain incident waiting for an owner change, a compromised maintainer account, or a typosquat. And because a workflow that works keeps working, nothing in your CI will ever tell you that the code you are running has not been touched in six years.

The ten most popular abandoned actions

Ranked by stars. “Archived” means the maintainer explicitly froze the repository; “inactive” means no commit or release in over 365 days. Every action below has a detail page with its score, its security signals and maintained alternatives.

lowlighter/metrics is the headline case. It has 17,001 stars, it is not archived, and its repository still shows recent pushes — but every one of those is an automated dependency-bot branch. The default branch has not received a commit since December 2023, the last release shipped in September 2023, and 67 issues are open. By any measure a user would care about, nobody is home.

jakejarvis/s3-sync-action deserves a mention too: over a thousand stars, deployed in countless workflows that push artifacts to S3 with repository credentials — and not a single commit in six years.

Every one of these has maintained alternatives, listed on its ActionRank detail page. The clearest case is actions/create-release, whose replacement softprops/action-gh-release is actively maintained, grades B, and has 5,720 stars of its own.

Where the rot concentrates

Abandonment is not evenly spread. The categories that rot fastest are the ones people write once and forget: release-tagging wrappers, small repo-automation helpers, notification webhooks. The healthiest are setup actions and security actions, both at 25% — the ones with vendor backing and a version treadmill that forces maintenance.

Full breakdowns for all twelve categories are on the categories index.

The fix GitHub shipped, and almost nobody turned on

Immutable releases are the direct answer to the tag-rewriting attack: once published, the tag can never be repointed. Ten months after the feature went GA, only 102 of the 1,136 actions we track (9%) have it enabled. For the other 91%, a tag is still a mutable pointer, and uses: owner/repo@v4 is still a promise rather than a guarantee.

What you should do

1. Inventory your workflows. Run grep -r "uses:" .github/workflows/ and check each action’s maintenance status — every action in this dataset has a page on ActionRank.
2. Pin to full commit SHAs, not tags. uses: owner/repo@<40-char-sha> # v4 is the only reference GitHub guarantees is immutable. Every ActionRank detail page gives you the pinned line to copy.
3. Replace abandoned actions — especially ones that touch credentials. Archived means no security patches, ever. An action with your cloud keys and no maintainer is the worst combination in the dataset.
4. Prefer actions with immutable releases and a SECURITY.md. Both signal a maintainer who has thought about supply-chain risk, and both feed into our score.

Methodology

Dataset: 1,136 repositories containing an action.yml, discovered via GitHub’s search API (topics github-actions, github-action, actions and continuous-integration, ≥50 stars) plus curated seeds, crawled August 2026. A repository counts as abandoned on its default branch only — automated dependency-bot branches do not reset the clock, because they do not indicate a maintainer is present.

Signals: GitHub REST and GraphQL APIs (commits, releases, tags, archived status), the OpenSSF Scorecard API for security health, and OSV.dev for advisories.

Status rules:

• Active — a commit or release within the last 90 days.
• Stale — last commit or release 91–365 days ago.
• Abandoned — the repository is archived, or more than 365 days have passed without a commit or a release.

The full scoring model — security 35%, maintenance 30%, popularity 20%, reliability 15% — is documented on our methodology page, including how missing data is handled. Corrections are welcome via report an issue; maintainers can appeal any classification, and we annotate disputed data points rather than quietly dropping them.

ActionRank is an independent project and is not affiliated with, endorsed by, or sponsored by GitHub, Inc.