# GitHub Marketplace Apps & Actions Tracker (`signalscope-data/github-marketplace-tracker`) Actor

Scrape & monitor GitHub Marketplace apps and Actions (installs, plans, permissions, stars, trust check) and audit any public repo's workflows for outdated, unpinned or node20 Actions. $1 / 1,000 rows.

- **URL**: https://apify.com/signalscope-data/github-marketplace-tracker.md
- **Developed by:** [Bin](https://apify.com/signalscope-data) (community)
- **Categories:** Developer tools, Lead generation, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 listing results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## GitHub Marketplace Apps & Actions Tracker

Scrape and **monitor GitHub Marketplace**: both **apps** (GitHub Apps and OAuth apps such as CodeRabbit, Codecov, Linear) and **GitHub Actions** (33,000+ workflow actions). Apps come back with their **exact install count**, pricing plans and the repository permissions they request. Actions come back with **repository stars, latest release, `uses:` reference, contributors and open issues**.

Choosing which Actions to trust in your workflows? Every Action with details gets a **trust & maintenance check**: its runtime (node24, node20 end-of-life, deprecated node12 / node16, docker, composite), when it was last released, a **pin-ready `uses:` line with the release's commit SHA**, nested actions that are not pinned, and a 0–100 `trustScore` with plain-English reasons.

**New: audit a repository's workflows.** Give it any public repo (`"repositories": ["vercel/next.js"]`) and it reads every file in `.github/workflows`, then checks each Action and reusable workflow it uses against that Action's own repo: **the version you use vs the latest release (majors behind)**, the **Node.js runtime of the exact version you use** (node12 / node16 deprecated, node20 end-of-life), SHA pinning, branch refs, **archived or deleted action repos**, and gives a ready-to-paste `recommendedUses` line. One `workflow-audit` row per repo adds a 0–100 score, grade and the top fixes. Think Dependabot for Actions plus a node20 deprecation check, without installing anything or giving a token.

In monitor mode each run is compared with the previous one, so a daily schedule becomes an alert feed: **new listings, install growth, star growth, new releases, rank moves, pricing changes and permission changes**.

No login, no API key, no browser. It reads the same public JSON the GitHub Marketplace website loads, so it is fast and cheap.

### Why this one?

- **Apps and Actions in one schema.** One run can cover a keyword or category across both listing types, with a `type` field (`app` / `action`) and the marketplace rank.
- **Exact installs.** App pages carry the exact installation count (e.g. `337267` for CodeRabbit). You also get `installsChange` / `installsChangePct` between runs, the best public traction signal for devtools that sell through GitHub.
- **Pricing plans.** Every plan with monthly / yearly price, per-unit pricing (per user, per seat), free plan and free trial flags, plus `minPaidMonthlyUsd` for quick comparisons.
- **Permissions audit.** Each app's requested permissions (`repository:write:pull requests`, `organization:read:members`…) and a short `writePermissions` list. Get alerted when an app asks for more access.
- **Action health.** Stars, latest release tag, ready-to-paste `usesRef` (e.g. `hashicorp/setup-terraform@v4.0.1`), contributors, open issues / PRs, security policy flag.
- **Action trust & maintenance check (new).** For each Action we read its `action.yml`, release feed and git tags (public sources, no token): `runtime` + `runtimeStatus` (`deprecated` for node12/node16, `end-of-life` for node20, `current`), `latestReleaseAt` / `daysSinceLatestRelease`, `latestReleaseSha` and **`pinnedUsesRef`** (e.g. `actions/setup-node@8207627… # v7.0.0`, the supply-chain best practice GitHub recommends), `nestedActions` / `unpinnedNestedActions` for composite actions, `dockerImagePinned`, then a `trustScore` (0–100), `trustLevel` and `trustIssues`. Filter with `minTrustScore`, and get `runtime-changed` / `trust-down` alerts. Other marketplace scrapers stop at stars; workflow auditors need your YAML first. This tells you before you add the Action.
- **Workflow audit for any public repo (new).** `repositories: ["owner/repo"]` → one `workflow-action` row per Action / reusable workflow / docker image used, with `usedVersion` (also resolved for SHA pins, including annotated-tag SHAs), `latestVersion`, `majorsBehind`, `isLatestVersion`, `runtime` of the version you use and `latestRuntime`, `pinnedToSha`, `refType` (sha / tag / major-tag / branch / not-found), `archived`, `severity`, plain-English `issues`, `recommendedUses` and the `workflowFiles` it appears in. The `workflow-audit` row adds `auditScore` + `grade`, `outdatedActions`, `deprecatedRuntimeActions`, `eolRuntimeActions`, `archivedActions`, `brokenReferences`, `unpinnedThirdPartyActions`, `workflowsWithoutPermissions`, `pullRequestTargetWorkflows`, `possibleScriptInjection` (untrusted `${{ github.event.* }}` inside `run:`) and `topFixes`. Workflow security auditors on the Store make you paste YAML and stop at pinning; this one reads the repo and tells you **what to upgrade to**.
- **Publisher (vendor) view.** `outputLevel: "publishers"` turns any search, category or watchlist into one row per company / account: how many apps and Actions it publishes, total installs and stars, top listing, best rank, categories, website domain, verified domain, cheapest paid plan, and the full list of its listings. Monitor it to get alerted when a vendor ships a **new listing** or its installs jump.
- **New-listing feed.** `sortBy: "newest"` + `outputMode: "new"` returns only listings published since the last run.
- **Monitor mode built in.** `outputMode: "changed"` adds `installs-up/down`, `stars-up/down` (with a % threshold), `rank-up/down`, `entered-list`, `new-release`, `pricing-change`, `permissions-change`, `renamed` and `became-verified`.
- **No contact harvesting.** Support emails and trader addresses are not exported. You get the owner account, verified domain and public links.

### Use cases

- **Devtool companies & DevRel:** track your app or Action and competitors daily: install and star growth, new releases, your rank for your main keywords and categories, and alerts when a new competitor appears.
- **Sales & partnerships (vendor map):** list every company selling CI, security or AI code review tools on GitHub with their website domain, install base and price point, one row per vendor (`outputLevel: "publishers"`).
- **Product & partnerships teams:** map every app in AI-assisted code review, CI, deployment or security, with plans and prices.
- **Security teams:** audit what repository and organization permissions marketplace apps request before approving them, and get alerted on permission changes.
- **Platform & DevSecOps teams:** vet Actions before allowing them: shortlist alternatives for a task (`searchTerms: ["deploy to s3"]`, `minTrustScore: 70`), copy the SHA-pinned `uses:` line, and schedule a watchlist of the Actions you already use to catch abandoned ones and runtime deprecations.
- **Engineering managers & consultants (workflow audit):** audit your own repos, or a client's / prospect's public repos, before GitHub's node20 cutoff breaks them. Schedule it with `outputMode: "changed"` to get only **new issues** (a newly deprecated runtime, an action that got archived, a new unpinned third-party action) and `resolvedIssues` after fixes.
- **Investors & market research:** size categories by installs, spot fast-growing apps and Actions, and follow the newest launches.
- **Newsletters & content creators:** a weekly feed of new and trending GitHub apps and Actions.

### Input

| Field | Description |
|---|---|
| `listingTypes` | `apps`, `actions` or both (default both) |
| `searchTerms` | Keywords, e.g. `"terraform"`, `"code review"`, `"deploy"`, `"ai"` |
| `categories` | e.g. `ai-assisted`, `code-review`, `security`, `continuous-integration`, `deployment`, `testing` (34 options) |
| `listingUrls` | Watchlist: `https://github.com/marketplace/<app>` or `https://github.com/marketplace/actions/<action>` |
| `sortBy` | `popularity` (default) or `newest` |
| `maxResultsPerQuery` | Max listings per search / category and type (up to 10,000) |
| `verifiedOnly` | Only listings from GitHub-verified creators |
| `includeDetails` | Add installs, plans, permissions (apps) or stars, releases, repo stats (actions) |
| `includeTrustCheck` | Action trust & maintenance check (default on, no extra charge; runs wherever Action pages are opened) |
| `minTrustScore` | Keep Actions with at least this trust score (0–100, needs details) |
| `outputLevel` | `listings` (default) or `publishers` (one row per owner with totals and all its listings) |
| `owners` | Only listings from these GitHub accounts, e.g. `"hashicorp"` (needs details) |
| `minInstalls`, `minStars` | Size filters (need details) |
| `outputMode` | `all`, `new` (never seen before) or `changed` (new + any change) |
| `trackChanges` | Add change fields in `all` mode too |
| `minGrowthPct`, `minRankChange` | Alert thresholds (default 1% and 5 positions) |
| `stateKey` | Monitor name: use one per schedule |

Example: AI code review apps with installs, plans and permissions:

```json
{
  "listingTypes": ["apps"],
  "categories": ["code-review", "ai-assisted"],
  "includeDetails": true
}
```

Example: daily feed of newly published apps and Actions:

```json
{
  "sortBy": "newest",
  "maxResultsPerQuery": 200,
  "outputMode": "new",
  "stateKey": "new-listings"
}
```

Example: vendor map of security and CI tools, one row per publisher:

```json
{
  "listingTypes": ["apps", "actions"],
  "categories": ["security", "continuous-integration"],
  "maxResultsPerQuery": 200,
  "outputLevel": "publishers"
}
```

Example: watch your listings and competitors (installs, stars, releases, pricing):

```json
{
  "listingUrls": [
    "https://github.com/marketplace/codecov",
    "https://github.com/marketplace/coderabbitai",
    "https://github.com/marketplace/actions/trufflehog-oss"
  ],
  "outputMode": "changed",
  "stateKey": "competitors"
}
```

### Output

App (with `includeDetails`):

```json
{
  "id": 9254,
  "type": "app",
  "slug": "spacelift-io",
  "name": "spacelift.io",
  "description": "Spacelift is a sophisticated and compliant infrastructure delivery platform for infrastructure as code",
  "isVerifiedOwner": true,
  "url": "https://github.com/marketplace/spacelift-io",
  "owner": "spacelift-io",
  "ownerName": "Spacelift",
  "ownerType": "Organization",
  "installs": 6710,
  "categories": ["Continuous integration", "Deployment"],
  "appKind": "github-app",
  "verifiedDomain": "spacelift.io",
  "plans": [{ "name": "Free. Free for both open source and private projects", "monthlyPriceUsd": 0, "yearlyPriceUsd": 0, "perUnit": false, "hasFreeTrial": false, "isPaid": false }],
  "hasFreePlan": true,
  "hasPaidPlans": false,
  "minPaidMonthlyUsd": null,
  "freeTrial": "14 days",
  "permissions": ["repository:read:code", "repository:write:checks", "repository:write:pull requests", "organization:read:members", "..."],
  "permissionCount": 10,
  "writePermissions": ["checks", "commit statuses", "deployments", "pull requests"],
  "supportedLanguages": ["JavaScript", "Python", "Go", "HCL", "..."],
  "documentationUrl": "https://docs.spacelift.io/",
  "rank": 1,
  "query": "apps:search:terraform",
  "scrapedAt": "2026-10-06T08:12:00.000Z"
}
```

Action (with `includeDetails`, monitor mode):

```json
{
  "id": 468277,
  "type": "action",
  "slug": "trufflehog-oss",
  "name": "TruffleHog OSS",
  "description": "Find and verify leaked credentials in your source code",
  "isVerifiedOwner": true,
  "url": "https://github.com/marketplace/actions/trufflehog-oss",
  "owner": "trufflesecurity",
  "stars": 28290,
  "categories": ["Continuous integration", "Security"],
  "repository": "trufflesecurity/trufflehog",
  "usesRef": "trufflesecurity/trufflehog@v3.98.0",
  "latestRelease": "v3.98.0",
  "contributorsCount": 214,
  "openIssues": 274,
  "openPullRequests": 287,
  "hasSecurityPolicy": true,
  "isNew": false,
  "previousStars": 27790,
  "starsChange": 500,
  "starsChangePct": 1.8,
  "previousRelease": "v3.97.9",
  "changeTypes": ["stars-up", "new-release"],
  "query": "watchlist"
}
```

Publisher row (`outputLevel: "publishers"`, listings list shortened):

```json
{
  "recordType": "publisher",
  "owner": "infracost",
  "ownerName": "Infracost",
  "ownerType": "Organization",
  "githubUrl": "https://github.com/infracost",
  "isVerifiedOwner": true,
  "verifiedDomain": "infracost.io",
  "websiteDomains": ["infracost.io"],
  "listingCount": 2,
  "appCount": 1,
  "actionCount": 1,
  "totalInstalls": 5968,
  "totalStars": 279,
  "topListing": { "name": "Infracost", "type": "app", "url": "https://github.com/marketplace/infracost", "installs": 5968 },
  "bestRank": 2,
  "categories": ["Continuous integration", "Code quality"],
  "hasPaidPlans": false,
  "minPaidMonthlyUsd": null,
  "copilotExtensions": 0,
  "listings": [{ "type": "app", "name": "Infracost", "installs": 5968, "rank": 2 }, { "type": "action", "name": "Infracost Actions", "stars": 279, "rank": 9 }],
  "changeTypes": ["new-listing", "installs-up"],
  "newListings": ["Infracost Actions"],
  "previousTotalInstalls": 5000,
  "totalInstallsChange": 968,
  "totalInstallsChangePct": 19.36
}
```

Apps with details also include `isCopilotExtension`, `screenshotCount`, `sourceRepositoryUrl` and plan `description` / `features`; Actions include `recentReleases` (last 10 tags) and `discussionsEnabled`.

Without `includeDetails` you get the fast list fields: `id`, `type`, `slug`, `name`, `description`, `isVerifiedOwner`, `logoUrl`, `url`, `rank`, `query`. Change fields appear when `outputMode` is `new` / `changed` or `trackChanges` is on. A run summary (including the total number of listings on the marketplace for each query) is saved to the `SUMMARY` record in the key-value store.

#### Action trust check example

Input `{"listingTypes": ["actions"], "searchTerms": ["deploy to s3"], "includeDetails": true}` (October 2026). The most-starred result:

```json
{
  "name": "S3 Deploy",
  "stars": 272,
  "latestRelease": "v4.0.0",
  "runtime": "node16",
  "runtimeStatus": "deprecated",
  "latestReleaseAt": "2023-02-21T…",
  "daysSinceLatestRelease": 1233,
  "pinnedUsesRef": "Reggionick/s3-deploy@04c48f45adfd7a34c66348cf9cd1b6cd117cc467 # v4.0.0",
  "trustScore": 20,
  "trustLevel": "very-low",
  "trustIssues": [
    "Runs on node16, deprecated by GitHub (runners force a newer Node.js, so behavior can break)",
    "No release for 3 years",
    "Creator is not verified by GitHub",
    "No security policy (SECURITY.md)",
    "Owned by a personal account, not an organization"
  ]
}
```

Popular is not the same as maintained: in that search 4 of the top 12 Actions run on a deprecated or end-of-life Node.js runtime. A composite Action shows what it calls, e.g. `"unpinnedNestedActions": ["actions/checkout@v4", "aws-actions/configure-aws-credentials@v4", "hashicorp/setup-terraform@v3"]`. `actions/setup-node` and `actions/checkout` score 100.

How the score works: start at 100 and subtract for a deprecated runtime (−30) or node20 (−10), no release for over 1 / 2 years (−15 / −25) or no releases at all (−15), unpinned nested actions (−5 each, max −20), a docker image pulled by tag (−10), a pre-release as latest (−5), an unverified creator (−10), no security policy (−10), a single contributor (−5), a personal (non-organization) owner (−5), or no `action.yml` at the release (−10). 80+ = `high`, 60+ = `medium`, 40+ = `low`, below = `very-low`. Publisher rows add `averageActionTrustScore`, `actionsOnDeprecatedRuntime` and `actionsOnEolRuntime`.

#### Workflow audit example

Input `{"repositories": ["vercel/next.js", "nvbn/thefuck"], "onlyActionsWithIssues": true}` (October 2026). An older repo still on `@v2`:

```json
{
  "recordType": "workflow-action",
  "repository": "nvbn/thefuck",
  "uses": "actions/checkout@v2",
  "refType": "major-tag",
  "usedVersion": "v2",
  "latestVersion": "v7.0.1",
  "majorsBehind": 5,
  "runtime": "node12",
  "latestRuntime": "node24",
  "severity": "high",
  "issues": [
    "Runs on node12, deprecated by GitHub — v7.0.1 runs on node24",
    "5 major versions behind (uses v2, latest v7.0.1)",
    "Not pinned to a commit SHA (GitHub-owned action)"
  ],
  "recommendedUses": "actions/checkout@v7",
  "workflowFiles": [".github/workflows/test.yml"]
}
```

Even a well-kept repo has findings: `vercel/next.js` (29 workflows, 22 Actions, all third-party ones SHA-pinned) scores **42 / D** — one SHA points at `vercel/gh-sts-action`, which is not public (`brokenReferences`), `slackapi/slack-github-action` v1.25.0 and `ast-grep/action` still run on node20, five `actions/*` pins are a major version behind, 6 workflows have no `permissions:` block and 2 use `pull_request_target`.

How the audit score works: start at 100; −10 per Action with a high issue (deleted repo / missing ref, archived repo, node12/node16 runtime, third-party branch ref; max −40), −3 per medium (node20, outdated major version, unpinned third-party tag; max −30), −1 per low (unpinned GitHub-owned action, untagged SHA; max −10), −10 per workflow with possible script injection (max −20), −2 per workflow without `permissions:` (max −10), −5 per `pull_request_target` workflow (max −10). 90+ = A, 75+ = B, 60+ = C, 40+ = D, below = F. The script-injection and `pull_request_target` checks are pattern-based hints, not a full security scan — pair with a dedicated scanner such as zizmor for that.

### Pricing

Pay per result, no subscription:

- **$1 per 1,000 listings** returned
- **+$2 per 1,000 listings** with `includeDetails` (one extra page per listing). Watchlist listings always include details. The Action trust check is included at no extra cost.

Workflow audit: each `workflow-action` row is one listing result ($1 / 1,000) and each repository's `workflow-audit` row is **$0.02**. A typical repo with 10–20 Actions costs about $0.03–0.04.

With `outputLevel: "publishers"` every listing page is opened ($2 / 1,000 listings) and each publisher row is one result ($1 / 1,000 publishers): a 200-listing category grouped into ~150 vendors costs about $0.55.

A 100-listing category costs $0.10 ($0.30 with installs, plans and permissions). In `new` / `changed` mode you pay only for listings that are new or changed, so a daily monitor usually costs cents per month.

### Scheduling a monitor

1. Set `outputMode` to `changed` (or `new`) and give the monitor a `stateKey`.
2. Run it once. The first run is the baseline and returns everything.
3. Create an Apify Schedule (e.g. daily). Later runs return only what changed. Connect a webhook, Slack or email integration to get alerts.

### FAQ

**Does the workflow audit need a GitHub token or access to my repo?**
No. It reads public pages only (the workflow folder listing, raw workflow files, each Action's git tags, `action.yml` and release feed). Private repositories are not supported: you get a clear "Repository not found or private" message and no charge.

**How is the version of a SHA-pinned Action found?**
From the Action's git tags (git protocol, no API rate limit). Both commit SHAs and annotated-tag object SHAs are matched, so `actions/github-script@d746ffe… # v9.0.0` resolves to v9.0.0. A SHA that is not any tag is reported as `sha-not-tagged` (low).

**Can it alert me when an Action I use gets deprecated or archived?**
Yes. Run it on a schedule with `outputMode: "changed"` and a `stateKey`. After the baseline run you only get Actions with new issues, plus the repo row with `newIssues`, `resolvedIssues` and `auditScoreChange`.

**Can I get a list of companies instead of listings?**
Yes. Set `outputLevel` to `publishers`. Listings are grouped by their GitHub owner account, so a vendor with an app and three Actions is one row with `appCount: 1`, `actionCount: 3`, total installs and stars and all four listings inside.

**Does the publisher view include emails or addresses?**
No. You get the owner account, GitHub URL, verified domain, website domains taken from the vendor's own docs / support / status links, and public listing data. Support emails and trader addresses are not exported.

**Is a low trust score proof that an Action is unsafe?**
No. It's a maintenance and supply-chain hygiene signal from public metadata: runtime, release recency, pinning, verification, security policy. It does not scan the code. Use it to shortlist and to spot abandoned Actions, then pin by SHA (`pinnedUsesRef`) whatever you choose.

**Where does the commit SHA come from?**
From the repository's public git tags (the same data `git ls-remote` shows), resolved to the commit the release tag points to. Pinning to it means a moved or re-tagged release can't change what runs in your workflow.

**How do publisher alerts work?**
With `outputMode: "changed"` and a `stateKey`, each publisher row carries `changeTypes`: `new` (vendor not seen before), `new-listing` (with `newListings` names), `installs-up/down`, `stars-up/down`, `pricing-change` and `new-release`. Use the same search / category input on every run so totals stay comparable.

### More tools from the same developer

- [Chrome, Firefox & VS Code Extensions Tracker](https://apify.com/signalscope-data/extension-marketplaces-tracker) — installs, ratings, versions and change alerts across three extension marketplaces.
- [Atlassian, Zoom & Zendesk Marketplace Apps Tracker](https://apify.com/signalscope-data/saas-marketplaces-tracker) — installs, ratings, versions and change alerts across three SaaS integration marketplaces.
- [Google Workspace Marketplace Scraper & App Tracker](https://apify.com/signalscope-data/workspace-marketplace-tracker) — exact installs, OAuth permissions and change alerts for Gmail, Docs and Sheets add-ons.
- [Microsoft Marketplace & AppSource Offers Tracker](https://apify.com/signalscope-data/microsoft-marketplace-tracker) — 28k Azure Marketplace & AppSource offers with plans and new/changed/removed alerts.
- [Salesforce AppExchange Scraper & Listing Monitor](https://apify.com/signalscope-data/appexchange-tracker) — AppExchange apps & Agentforce agents with ratings, pricing and change alerts.
- [Company Jobs Scraper](https://apify.com/signalscope-data/ats-jobs-scraper) — every open job from Workday, Greenhouse, Lever, Ashby & more, with new-job alerts.

# Actor input Schema

## `listingTypes` (type: `array`):

Which kind of Marketplace listings to scrape. Each search term / category is run once per type.

## `searchTerms` (type: `array`):

Keywords to search on GitHub Marketplace, e.g. "terraform", "code review", "deploy", "ai". Each term is a separate ranked list.

## `categories` (type: `array`):

Marketplace categories to scrape in marketplace order. Leave search terms, categories and listing URLs empty to get the most popular (or newest) listings.

## `listingUrls` (type: `array`):

Specific listings to track, e.g. "https://github.com/marketplace/codecov" (app) or "https://github.com/marketplace/actions/trufflehog-oss" (action). Watchlist listings always include details (installs / stars) and are charged as listing + details.

## `repositories` (type: `array`):

Public GitHub repositories, e.g. "vercel/next.js" or "https://github.com/psf/requests". Reads every workflow in .github/workflows and checks each Action / reusable workflow it uses: version used vs latest release (majors behind), Node.js runtime of the exact version used (node12/16 deprecated, node20 end-of-life), SHA pinning, branch refs, archived or missing action repos — with a ready-to-paste recommendedUses line. Adds one workflow-audit row per repo (score 0-100, grade, top fixes, workflows without permissions:, pull_request_target, possible script injection). No GitHub token needed. Can be used alone (leave search terms and categories empty).

## `maxWorkflowsPerRepo` (type: `integer`):

Workflow files read per audited repository (in folder order).

## `onlyActionsWithIssues` (type: `boolean`):

Skip workflow-action rows that have no issues (the repo's workflow-audit row still counts everything).

## `sortBy` (type: `string`):

Order of the ranked lists. "newest" + outputMode "new" gives a feed of newly published apps and Actions.

## `maxResultsPerQuery` (type: `integer`):

Max listings per search term or category and type (GitHub serves up to 10,000 per list).

## `verifiedOnly` (type: `boolean`):

Keep only listings from GitHub-verified creators (the blue verified badge).

## `includeDetails` (type: `boolean`):

Open each listing page. Apps get exact installs, pricing plans, permissions, owner, categories, verified domain and links. Actions get repository stars, owner, repo, latest release, contributors and open issues. One extra request per listing, charged as an extra listing-details event.

## `includeTrustCheck` (type: `boolean`):

For every GitHub Action whose listing page is opened (includeDetails, watchlist or publishers level): read its action.yml, release feed and git tags to add runtime (node24 / node20 end-of-life / node12-16 deprecated / docker / composite), latest release date, a pin-ready `uses:` reference with the release's commit SHA, nested actions not pinned to a SHA (composite), docker image pinning, and a 0-100 trustScore with plain-English trustIssues. No extra charge.

## `minTrustScore` (type: `integer`):

Keep only Actions with at least this trustScore (0-100; 80+ = high, 60+ = medium). Apps are not affected. Needs includeDetails.

## `outputLevel` (type: `string`):

"publishers" groups every matched listing by its GitHub owner: listing, app and Action counts, total installs and stars, top listing, categories, website domains, verified domain, cheapest paid plan and the full listing list. Opens every listing page (charged as listing-details); each publisher row is one listing event. In "new" / "changed" modes the alerts are per publisher: new publisher, new-listing, installs-up/down, stars-up/down, pricing-change, new-release.

## `owners` (type: `array`):

Keep only listings published by these GitHub accounts or organizations, e.g. "aws-actions", "hashicorp". Needs includeDetails.

## `minInstalls` (type: `integer`):

Skip apps with fewer installs than this. Needs includeDetails.

## `minStars` (type: `integer`):

Skip Actions whose repository has fewer stars than this. Needs includeDetails.

## `outputMode` (type: `string`):

"new" and "changed" compare with the previous run that used the same stateKey. The first run is the baseline and returns everything.

## `trackChanges` (type: `boolean`):

Also compute installsChange, starsChange, rankChange, changeTypes etc. when outputMode is "all" (saves a snapshot for the next run).

## `minGrowthPct` (type: `number`):

An installs-up/down or stars-up/down change is reported only when the number moved at least this many percent since the last run.

## `minRankChange` (type: `integer`):

A rank-up / rank-down change is reported only when the listing moved at least this many positions in a search or category list.

## `stateKey` (type: `string`):

Name of the saved snapshot used by "new" / "changed" modes. Use a different name for each schedule or watchlist.

## Actor input object example

```json
{
  "listingTypes": [
    "apps",
    "actions"
  ],
  "searchTerms": [
    "terraform"
  ],
  "maxWorkflowsPerRepo": 50,
  "onlyActionsWithIssues": false,
  "sortBy": "popularity",
  "maxResultsPerQuery": 100,
  "verifiedOnly": false,
  "includeDetails": false,
  "includeTrustCheck": true,
  "minTrustScore": 0,
  "outputLevel": "listings",
  "minInstalls": 0,
  "minStars": 0,
  "outputMode": "all",
  "trackChanges": false,
  "minGrowthPct": 1,
  "minRankChange": 5,
  "stateKey": "default"
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "listingTypes": [
        "apps",
        "actions"
    ],
    "searchTerms": [
        "terraform"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("signalscope-data/github-marketplace-tracker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "listingTypes": [
        "apps",
        "actions",
    ],
    "searchTerms": ["terraform"],
}

# Run the Actor and wait for it to finish
run = client.actor("signalscope-data/github-marketplace-tracker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "listingTypes": [
    "apps",
    "actions"
  ],
  "searchTerms": [
    "terraform"
  ]
}' |
apify call signalscope-data/github-marketplace-tracker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,signalscope-data/github-marketplace-tracker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/JXLU8AAYALsn9IejQ/builds/WPbOjeS6g29bqtY2X/openapi.json