Frequently asked questions

What is GitHub?

GitHub is the web platform where most open-source software lives — it hosts Git repositories and the collaboration around them: issues, pull requests, releases, and automation. Every Action Actionaut indexes is a project hosted on GitHub.

What are GitHub Actions?

"GitHub Actions" is GitHub's built-in automation system — it runs jobs like tests, builds, and deploys automatically when something happens in your repo, such as a push or a pull request. The word "Action" on its own also means one reusable, shareable unit of that automation: a pre-built step you drop into your own pipeline instead of scripting it yourself. Actionaut is a search engine for those reusable Actions.

What does "SHA-pinned" mean?

When you add an Action to a workflow, you reference a specific version of it. That reference can point at a version tag like v4, a branch, or a full 40-character commit SHA. A tag like v4 is a label the maintainer can move — so the code you run today may not be the code you reviewed.

A commit SHA names one exact, immutable commit and can never point anywhere else, so every run executes the code you actually vetted. Actionaut always pins to the SHA, and keeps the trailing version comment (# v4.1.7) so tools like Dependabot and Renovate can still offer update pull requests.

More on this: Why a SHA?

What are uses: snippets?

Inside a workflow, each step can pull in a reusable Action with a uses: line that names the Action and the exact version to run:

- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4.1.7

That one line is what Actionaut hands you — already pinned to a commit SHA and ready to paste into your workflow.

What is workflow.yml?

Your automation is defined in YAML files under .github/workflows/ in your repository. There is no single required filename — any .yml file in that folder is a workflow, and workflow.yml is just a common example. Each file describes one workflow: when it runs, and the jobs and steps it runs. Steps are where uses: snippets go.

Is Actionaut official, or affiliated with GitHub?

No. Actionaut is an unofficial, independent index of GitHub Actions. It is not operated by or endorsed by GitHub.

Where does the Scorecard information come from? What are the licenses?

The Scorecard is the OpenSSF Scorecard — an open security-health score from 0 to 10 published by the Open Source Security Foundation, read from the public securityscorecards.dev API. Actionaut groups it into bands, such as Scorecard 6–8, rather than a single number. An Action with no published score honestly reads "not yet scored" — never a zero, never a failure.

The License signal comes from GitHub's own license detection — the SPDX identifier it reports for a repo — which Actionaut groups into families. These are plain-English summaries, not legal advice:

MIT

The most common open-source license. Use it in almost anything, including commercial and closed products; just keep the original license text around. Very few strings attached.

Apache 2.0

Like MIT — free to use almost anywhere — with added legal protection: contributors agree not to come after you with patent claims over their code.

BSD

Another "do almost anything" license, very close in spirit to MIT. It comes in a few variants that differ only in fine print.

ISC

Essentially MIT written in fewer words. The same freedoms, simpler text.

MPL 2.0

A middle ground. You can mix it into a larger closed-source project, but if you change the MPL-licensed files themselves, those specific changes have to stay open.

Public domain

The author has given up all rights. Do anything you like with it, no conditions.

LGPL

Fine to use in closed-source software as long as you link to it rather than copy it in. If you modify the library itself, those modifications must stay open.

GPL 2.0 / GPL 3.0

A "share-alike" license: if you build it into software you distribute, that software has to be open-source under the GPL too. Excellent for keeping things open — a real consideration for a closed product.

AGPL 3.0

The strictest share-alike license. The same idea as GPL, but the obligation also kicks in when people merely use your software over a network, like a hosted web app, not only when you hand out the code.

Other

A real, recognized license that does not fall into the common families above. Worth reading before you rely on it.

None

No license was detected. Unless the author says otherwise, "no license" legally means all rights reserved, so you may not have permission to reuse it. Check with the author first.

What is the difference between "deprecated runtime" and "current runtime"?

JavaScript Actions declare which runtime they run on, for example Node 20. GitHub periodically retires old runtimes — Node 12 and Node 16 have both reached end of life. An Action flagged "Deprecated runtime" still targets one of those retired runtimes, so it emits warnings today and will eventually stop working. "Current runtime" means it is on a supported runtime, or is a composite or docker Action where this does not apply. It is a maintenance signal: a current runtime suggests the Action is being kept up to date.

How fresh is the data?

Actionaut is rebuilt by a background pipeline that re-scans GitHub, and the footer shows when the corpus was last refreshed — and says so plainly if it cannot tell. If you ever see "corpus freshness unknown," it means the freshness timestamp could not be read, not that the data is necessarily old.

What is Searchcraft?

Searchcraft is the search engine powering this entire site — a developer-first search platform you can run as a fully managed cloud service or self-host on your own infrastructure. Everything you do here runs on it: the instant results as you type, the forgiveness when you misspell a query, and the trust-signal filters. Actionaut is, in effect, a live demo of Searchcraft against a real dataset.

What is typo-tolerant search?

It means a small spelling mistake still finds the right result — search "chekout" or "dokcer" and you will still get checkout and docker. Under the hood, Actionaut phrases every text query as a Searchcraft fuzzy match, which tolerates a few wrong, missing, or transposed characters. When a query is close to a known term, you will also see a "did you mean …?" suggestion.

How is search this fast?

Searchcraft is a modern take on proven search technology, built on a more modern tech stack and methodology than the engines it descends from. In practice that means at least 10 times the speed of Elasticsearch, OpenSearch, or Solr, using about a tenth of the resources. That efficiency is what makes search-as-you-type here feel instant instead of laggy.

How do the filters work?

The Scorecard, Maintenance, License, and Runtime filters are facets — structured fields Searchcraft indexes alongside the text. That lets a single query combine a typo-tolerant text search with exact filters (show me docker Actions, MIT-licensed, on a current runtime) and get a count for each option. Faceted filtering like this is built into Searchcraft, not bolted on afterward.

Why do the results feel well-ordered?

Searchcraft returns each match with a relevance score, and Actionaut blends that with real-world signals — how many stars a project has and how recently it was maintained — so the most relevant and trustworthy Actions rise to the top, rather than a raw text match alone.

Can Searchcraft search more than just GitHub Actions?

Yes. Reads here go through a Searchcraft federation — a search surface that multiple indexes can join — so new data sources can be added to the same search box without rebuilding the app. Searchcraft itself is general-purpose: it is just as at home powering product catalogs, documentation, or media libraries as it is a code index.

How is Searchcraft different from Algolia, Elasticsearch, or Meilisearch?

Searchcraft comes from the same lineage as engines like Elasticsearch and Solr, but rethinks how they work under the hood — a modern architecture that is dramatically faster and lighter. It is also built to be developer-friendly: you define your schema in code, ingest your data, and query it through a typed client, and you can run it hosted or self-hosted. Less operational weight, more of your time spent building.

Can I use Searchcraft for my own project?

Yes — Searchcraft is available for your own applications, whether that is a website, a docs site, a store, or an internal tool, and you can run it hosted or self-hosted. If the search on this page feels good to use, that is the pitch.

Learn more at searchcraft.io