GitHub Marketplace Apps & Actions Tracker

Scrape and monitor GitHub Marketplace: both apps (GitHub Apps and OAuth apps such as CodeRabbit, Codecov, Linear) and GitHub Actions (33,000+ workflow actions). Apps come back with their exact install count, pricing plans and the repository permissions they request. Actions come back with repository stars, latest release, uses: reference, contributors and open issues.

Choosing which Actions to trust in your workflows? Every Action with details gets a trust & maintenance check: its runtime (node24, node20 end-of-life, deprecated node12 / node16, docker, composite), when it was last released, a pin-ready uses: line with the release's commit SHA, nested actions that are not pinned, and a 0–100 trustScore with plain-English reasons.

New: audit a repository's workflows. Give it any public repo ("repositories": ["vercel/next.js"]) and it reads every file in .github/workflows, then checks each Action and reusable workflow it uses against that Action's own repo: the version you use vs the latest release (majors behind), the Node.js runtime of the exact version you use (node12 / node16 deprecated, node20 end-of-life), SHA pinning, branch refs, archived or deleted action repos, and gives a ready-to-paste recommendedUses line. One workflow-audit row per repo adds a 0–100 score, grade and the top fixes. Think Dependabot for Actions plus a node20 deprecation check, without installing anything or giving a token.

In monitor mode each run is compared with the previous one, so a daily schedule becomes an alert feed: new listings, install growth, star growth, new releases, rank moves, pricing changes and permission changes.

No login, no API key, no browser. It reads the same public JSON the GitHub Marketplace website loads, so it is fast and cheap.

Why this one?

• Apps and Actions in one schema. One run can cover a keyword or category across both listing types, with a type field (app / action) and the marketplace rank.
• Exact installs. App pages carry the exact installation count (e.g. 337267 for CodeRabbit). You also get installsChange / installsChangePct between runs, the best public traction signal for devtools that sell through GitHub.
• Pricing plans. Every plan with monthly / yearly price, per-unit pricing (per user, per seat), free plan and free trial flags, plus minPaidMonthlyUsd for quick comparisons.
• Permissions audit. Each app's requested permissions (repository:write:pull requests, organization:read:members…) and a short writePermissions list. Get alerted when an app asks for more access.
• Action health. Stars, latest release tag, ready-to-paste usesRef (e.g. hashicorp/setup-terraform@v4.0.1), contributors, open issues / PRs, security policy flag.
• Action trust & maintenance check (new). For each Action we read its action.yml, release feed and git tags (public sources, no token): runtime + runtimeStatus (deprecated for node12/node16, end-of-life for node20, current), latestReleaseAt / daysSinceLatestRelease, latestReleaseSha and pinnedUsesRef (e.g. actions/setup-node@8207627… # v7.0.0, the supply-chain best practice GitHub recommends), nestedActions / unpinnedNestedActions for composite actions, dockerImagePinned, then a trustScore (0–100), trustLevel and trustIssues. Filter with minTrustScore, and get runtime-changed / trust-down alerts. Other marketplace scrapers stop at stars; workflow auditors need your YAML first. This tells you before you add the Action.
• Workflow audit for any public repo (new). repositories: ["owner/repo"] → one workflow-action row per Action / reusable workflow / docker image used, with usedVersion (also resolved for SHA pins, including annotated-tag SHAs), latestVersion, majorsBehind, isLatestVersion, runtime of the version you use and latestRuntime, pinnedToSha, refType (sha / tag / major-tag / branch / not-found), archived, severity, plain-English issues, recommendedUses and the workflowFiles it appears in. The workflow-audit row adds auditScore + grade, outdatedActions, deprecatedRuntimeActions, eolRuntimeActions, archivedActions, brokenReferences, unpinnedThirdPartyActions, workflowsWithoutPermissions, pullRequestTargetWorkflows, possibleScriptInjection (untrusted ${{ github.event.* }} inside run:) and topFixes. Workflow security auditors on the Store make you paste YAML and stop at pinning; this one reads the repo and tells you what to upgrade to.
• Publisher (vendor) view. outputLevel: "publishers" turns any search, category or watchlist into one row per company / account: how many apps and Actions it publishes, total installs and stars, top listing, best rank, categories, website domain, verified domain, cheapest paid plan, and the full list of its listings. Monitor it to get alerted when a vendor ships a new listing or its installs jump.
• New-listing feed. sortBy: "newest" + outputMode: "new" returns only listings published since the last run.
• Monitor mode built in. outputMode: "changed" adds installs-up/down, stars-up/down (with a % threshold), rank-up/down, entered-list, new-release, pricing-change, permissions-change, renamed and became-verified.
• No contact harvesting. Support emails and trader addresses are not exported. You get the owner account, verified domain and public links.

Use cases

• Devtool companies & DevRel: track your app or Action and competitors daily: install and star growth, new releases, your rank for your main keywords and categories, and alerts when a new competitor appears.
• Sales & partnerships (vendor map): list every company selling CI, security or AI code review tools on GitHub with their website domain, install base and price point, one row per vendor (outputLevel: "publishers").
• Product & partnerships teams: map every app in AI-assisted code review, CI, deployment or security, with plans and prices.
• Security teams: audit what repository and organization permissions marketplace apps request before approving them, and get alerted on permission changes.
• Platform & DevSecOps teams: vet Actions before allowing them: shortlist alternatives for a task (searchTerms: ["deploy to s3"], minTrustScore: 70), copy the SHA-pinned uses: line, and schedule a watchlist of the Actions you already use to catch abandoned ones and runtime deprecations.
• Engineering managers & consultants (workflow audit): audit your own repos, or a client's / prospect's public repos, before GitHub's node20 cutoff breaks them. Schedule it with outputMode: "changed" to get only new issues (a newly deprecated runtime, an action that got archived, a new unpinned third-party action) and resolvedIssues after fixes.
• Investors & market research: size categories by installs, spot fast-growing apps and Actions, and follow the newest launches.
• Newsletters & content creators: a weekly feed of new and trending GitHub apps and Actions.

Input

Field	Description
listingTypes	apps, actions or both (default both)
searchTerms	Keywords, e.g. "terraform", "code review", "deploy", "ai"
categories	e.g. ai-assisted, code-review, security, continuous-integration, deployment, testing (34 options)
listingUrls	Watchlist: https://github.com/marketplace/<app> or https://github.com/marketplace/actions/<action>
sortBy	popularity (default) or newest
maxResultsPerQuery	Max listings per search / category and type (up to 10,000)
verifiedOnly	Only listings from GitHub-verified creators
includeDetails	Add installs, plans, permissions (apps) or stars, releases, repo stats (actions)
includeTrustCheck	Action trust & maintenance check (default on, no extra charge; runs wherever Action pages are opened)
minTrustScore	Keep Actions with at least this trust score (0–100, needs details)
outputLevel	listings (default) or publishers (one row per owner with totals and all its listings)
owners	Only listings from these GitHub accounts, e.g. "hashicorp" (needs details)
minInstalls, minStars	Size filters (need details)
outputMode	all, new (never seen before) or changed (new + any change)
trackChanges	Add change fields in all mode too
minGrowthPct, minRankChange	Alert thresholds (default 1% and 5 positions)
stateKey	Monitor name: use one per schedule

Example: AI code review apps with installs, plans and permissions:

{
  "listingTypes": ["apps"],
  "categories": ["code-review", "ai-assisted"],
  "includeDetails": true
}

Example: daily feed of newly published apps and Actions:

{
  "sortBy": "newest",
  "maxResultsPerQuery": 200,
  "outputMode": "new",
  "stateKey": "new-listings"
}

Example: vendor map of security and CI tools, one row per publisher:

{
  "listingTypes": ["apps", "actions"],
  "categories": ["security", "continuous-integration"],
  "maxResultsPerQuery": 200,
  "outputLevel": "publishers"
}

Example: watch your listings and competitors (installs, stars, releases, pricing):

{
  "listingUrls": [
    "https://github.com/marketplace/codecov",
    "https://github.com/marketplace/coderabbitai",
    "https://github.com/marketplace/actions/trufflehog-oss"
  ],
  "outputMode": "changed",
  "stateKey": "competitors"
}

Output

App (with includeDetails):

{
  "id": 9254,
  "type": "app",
  "slug": "spacelift-io",
  "name": "spacelift.io",
  "description": "Spacelift is a sophisticated and compliant infrastructure delivery platform for infrastructure as code",
  "isVerifiedOwner": true,
  "url": "https://github.com/marketplace/spacelift-io",
  "owner": "spacelift-io",
  "ownerName": "Spacelift",
  "ownerType": "Organization",
  "installs": 6710,
  "categories": ["Continuous integration", "Deployment"],
  "appKind": "github-app",
  "verifiedDomain": "spacelift.io",
  "plans": [{ "name": "Free. Free for both open source and private projects", "monthlyPriceUsd": 0, "yearlyPriceUsd": 0, "perUnit": false, "hasFreeTrial": false, "isPaid": false }],
  "hasFreePlan": true,
  "hasPaidPlans": false,
  "minPaidMonthlyUsd": null,
  "freeTrial": "14 days",
  "permissions": ["repository:read:code", "repository:write:checks", "repository:write:pull requests", "organization:read:members", "..."],
  "permissionCount": 10,
  "writePermissions": ["checks", "commit statuses", "deployments", "pull requests"],
  "supportedLanguages": ["JavaScript", "Python", "Go", "HCL", "..."],
  "documentationUrl": "https://docs.spacelift.io/",
  "rank": 1,
  "query": "apps:search:terraform",
  "scrapedAt": "2026-10-06T08:12:00.000Z"
}

Action (with includeDetails, monitor mode):

{
  "id": 468277,
  "type": "action",
  "slug": "trufflehog-oss",
  "name": "TruffleHog OSS",
  "description": "Find and verify leaked credentials in your source code",
  "isVerifiedOwner": true,
  "url": "https://github.com/marketplace/actions/trufflehog-oss",
  "owner": "trufflesecurity",
  "stars": 28290,
  "categories": ["Continuous integration", "Security"],
  "repository": "trufflesecurity/trufflehog",
  "usesRef": "trufflesecurity/trufflehog@v3.98.0",
  "latestRelease": "v3.98.0",
  "contributorsCount": 214,
  "openIssues": 274,
  "openPullRequests": 287,
  "hasSecurityPolicy": true,
  "isNew": false,
  "previousStars": 27790,
  "starsChange": 500,
  "starsChangePct": 1.8,
  "previousRelease": "v3.97.9",
  "changeTypes": ["stars-up", "new-release"],
  "query": "watchlist"
}

Publisher row (outputLevel: "publishers", listings list shortened):

{
  "recordType": "publisher",
  "owner": "infracost",
  "ownerName": "Infracost",
  "ownerType": "Organization",
  "githubUrl": "https://github.com/infracost",
  "isVerifiedOwner": true,
  "verifiedDomain": "infracost.io",
  "websiteDomains": ["infracost.io"],
  "listingCount": 2,
  "appCount": 1,
  "actionCount": 1,
  "totalInstalls": 5968,
  "totalStars": 279,
  "topListing": { "name": "Infracost", "type": "app", "url": "https://github.com/marketplace/infracost", "installs": 5968 },
  "bestRank": 2,
  "categories": ["Continuous integration", "Code quality"],
  "hasPaidPlans": false,
  "minPaidMonthlyUsd": null,
  "copilotExtensions": 0,
  "listings": [{ "type": "app", "name": "Infracost", "installs": 5968, "rank": 2 }, { "type": "action", "name": "Infracost Actions", "stars": 279, "rank": 9 }],
  "changeTypes": ["new-listing", "installs-up"],
  "newListings": ["Infracost Actions"],
  "previousTotalInstalls": 5000,
  "totalInstallsChange": 968,
  "totalInstallsChangePct": 19.36
}

Apps with details also include isCopilotExtension, screenshotCount, sourceRepositoryUrl and plan description / features; Actions include recentReleases (last 10 tags) and discussionsEnabled.

Without includeDetails you get the fast list fields: id, type, slug, name, description, isVerifiedOwner, logoUrl, url, rank, query. Change fields appear when outputMode is new / changed or trackChanges is on. A run summary (including the total number of listings on the marketplace for each query) is saved to the SUMMARY record in the key-value store.

Action trust check example

Input {"listingTypes": ["actions"], "searchTerms": ["deploy to s3"], "includeDetails": true} (October 2026). The most-starred result:

{
  "name": "S3 Deploy",
  "stars": 272,
  "latestRelease": "v4.0.0",
  "runtime": "node16",
  "runtimeStatus": "deprecated",
  "latestReleaseAt": "2023-02-21T…",
  "daysSinceLatestRelease": 1233,
  "pinnedUsesRef": "Reggionick/s3-deploy@04c48f45adfd7a34c66348cf9cd1b6cd117cc467 # v4.0.0",
  "trustScore": 20,
  "trustLevel": "very-low",
  "trustIssues": [
    "Runs on node16, deprecated by GitHub (runners force a newer Node.js, so behavior can break)",
    "No release for 3 years",
    "Creator is not verified by GitHub",
    "No security policy (SECURITY.md)",
    "Owned by a personal account, not an organization"
  ]
}

Popular is not the same as maintained: in that search 4 of the top 12 Actions run on a deprecated or end-of-life Node.js runtime. A composite Action shows what it calls, e.g. "unpinnedNestedActions": ["actions/checkout@v4", "aws-actions/configure-aws-credentials@v4", "hashicorp/setup-terraform@v3"]. actions/setup-node and actions/checkout score 100.

How the score works: start at 100 and subtract for a deprecated runtime (−30) or node20 (−10), no release for over 1 / 2 years (−15 / −25) or no releases at all (−15), unpinned nested actions (−5 each, max −20), a docker image pulled by tag (−10), a pre-release as latest (−5), an unverified creator (−10), no security policy (−10), a single contributor (−5), a personal (non-organization) owner (−5), or no action.yml at the release (−10). 80+ = high, 60+ = medium, 40+ = low, below = very-low. Publisher rows add averageActionTrustScore, actionsOnDeprecatedRuntime and actionsOnEolRuntime.

Workflow audit example

Input {"repositories": ["vercel/next.js", "nvbn/thefuck"], "onlyActionsWithIssues": true} (October 2026). An older repo still on @v2:

{
  "recordType": "workflow-action",
  "repository": "nvbn/thefuck",
  "uses": "actions/checkout@v2",
  "refType": "major-tag",
  "usedVersion": "v2",
  "latestVersion": "v7.0.1",
  "majorsBehind": 5,
  "runtime": "node12",
  "latestRuntime": "node24",
  "severity": "high",
  "issues": [
    "Runs on node12, deprecated by GitHub — v7.0.1 runs on node24",
    "5 major versions behind (uses v2, latest v7.0.1)",
    "Not pinned to a commit SHA (GitHub-owned action)"
  ],
  "recommendedUses": "actions/checkout@v7",
  "workflowFiles": [".github/workflows/test.yml"]
}

Even a well-kept repo has findings: vercel/next.js (29 workflows, 22 Actions, all third-party ones SHA-pinned) scores 42 / D — one SHA points at vercel/gh-sts-action, which is not public (brokenReferences), slackapi/slack-github-action v1.25.0 and ast-grep/action still run on node20, five actions/* pins are a major version behind, 6 workflows have no permissions: block and 2 use pull_request_target.

How the audit score works: start at 100; −10 per Action with a high issue (deleted repo / missing ref, archived repo, node12/node16 runtime, third-party branch ref; max −40), −3 per medium (node20, outdated major version, unpinned third-party tag; max −30), −1 per low (unpinned GitHub-owned action, untagged SHA; max −10), −10 per workflow with possible script injection (max −20), −2 per workflow without permissions: (max −10), −5 per pull_request_target workflow (max −10). 90+ = A, 75+ = B, 60+ = C, 40+ = D, below = F. The script-injection and pull_request_target checks are pattern-based hints, not a full security scan — pair with a dedicated scanner such as zizmor for that.

Pricing

Pay per result, no subscription:

• $1 per 1,000 listings returned
• +$2 per 1,000 listings with includeDetails (one extra page per listing). Watchlist listings always include details. The Action trust check is included at no extra cost.

Workflow audit: each workflow-action row is one listing result ($1 / 1,000) and each repository's workflow-audit row is $0.02. A typical repo with 10–20 Actions costs about $0.03–0.04.

With outputLevel: "publishers" every listing page is opened ($2 / 1,000 listings) and each publisher row is one result ($1 / 1,000 publishers): a 200-listing category grouped into ~150 vendors costs about $0.55.

A 100-listing category costs $0.10 ($0.30 with installs, plans and permissions). In new / changed mode you pay only for listings that are new or changed, so a daily monitor usually costs cents per month.

Scheduling a monitor

1. Set outputMode to changed (or new) and give the monitor a stateKey.
2. Run it once. The first run is the baseline and returns everything.
3. Create an Apify Schedule (e.g. daily). Later runs return only what changed. Connect a webhook, Slack or email integration to get alerts.

FAQ

Does the workflow audit need a GitHub token or access to my repo? No. It reads public pages only (the workflow folder listing, raw workflow files, each Action's git tags, action.yml and release feed). Private repositories are not supported: you get a clear "Repository not found or private" message and no charge.

How is the version of a SHA-pinned Action found? From the Action's git tags (git protocol, no API rate limit). Both commit SHAs and annotated-tag object SHAs are matched, so actions/github-script@d746ffe… # v9.0.0 resolves to v9.0.0. A SHA that is not any tag is reported as sha-not-tagged (low).

Can it alert me when an Action I use gets deprecated or archived? Yes. Run it on a schedule with outputMode: "changed" and a stateKey. After the baseline run you only get Actions with new issues, plus the repo row with newIssues, resolvedIssues and auditScoreChange.

Can I get a list of companies instead of listings? Yes. Set outputLevel to publishers. Listings are grouped by their GitHub owner account, so a vendor with an app and three Actions is one row with appCount: 1, actionCount: 3, total installs and stars and all four listings inside.

Does the publisher view include emails or addresses? No. You get the owner account, GitHub URL, verified domain, website domains taken from the vendor's own docs / support / status links, and public listing data. Support emails and trader addresses are not exported.

Is a low trust score proof that an Action is unsafe? No. It's a maintenance and supply-chain hygiene signal from public metadata: runtime, release recency, pinning, verification, security policy. It does not scan the code. Use it to shortlist and to spot abandoned Actions, then pin by SHA (pinnedUsesRef) whatever you choose.

Where does the commit SHA come from? From the repository's public git tags (the same data git ls-remote shows), resolved to the commit the release tag points to. Pinning to it means a moved or re-tagged release can't change what runs in your workflow.

How do publisher alerts work? With outputMode: "changed" and a stateKey, each publisher row carries changeTypes: new (vendor not seen before), new-listing (with newListings names), installs-up/down, stars-up/down, pricing-change and new-release. Use the same search / category input on every run so totals stay comparable.

More tools from the same developer

• Chrome, Firefox & VS Code Extensions Tracker — installs, ratings, versions and change alerts across three extension marketplaces.
• Atlassian, Zoom & Zendesk Marketplace Apps Tracker — installs, ratings, versions and change alerts across three SaaS integration marketplaces.
• Google Workspace Marketplace Scraper & App Tracker — exact installs, OAuth permissions and change alerts for Gmail, Docs and Sheets add-ons.
• Microsoft Marketplace & AppSource Offers Tracker — 28k Azure Marketplace & AppSource offers with plans and new/changed/removed alerts.
• Salesforce AppExchange Scraper & Listing Monitor — AppExchange apps & Agentforce agents with ratings, pricing and change alerts.
• Company Jobs Scraper — every open job from Workday, Greenhouse, Lever, Ashby & more, with new-job alerts.