This page describes the current status of GitHub Actions for Apache Software Foundation projects. This page is maintained by the community.

Summary updated: 16.10.2023

If you are a Committer/PMC member of an ASF project and thinking about migrating to GitHub Actions, this is the current status:

  • If you want to use GitHub Actions, consider using your own self-hosted runner, but only if you can afford to build and maintain your own self-hosted infrastructure (this is not an easy task due to security limitations of the official GitHub Actions runners). 
  • If you decide to use GitHub Actions, be very careful to mitigate some of the security problems you might have if you follow the GA setup using the existing examples. There is extra hardening required in your workflows if you want to protect your project from 3rd-party dependencies having WRITE access to your project.


Overall status of GitHub Actions for Apache Software Foundation projects

There are already quite a few projects using GitHub Actions. However, there are vsome potential security implications that you might have to be aware of when starting to use GitHub Actions.

There are a few discussions that you can read at builds@apache.org about these issues:

The issues with GitHub Actions revolve around Billing and Security.

Detailed status

Billing

All public projects, resources, images, etc.  on GitHub are generally free (not only Apache Software Foundation ones). No problem with that. You will not incur any costs as long as you do not create any "private" resources, so there is no way you can create billing consequences.
However there is an important caveat: as more projects use GitHub Actions, the more they all compete for a shared job queue. Apache Software Foundation has an "Enterprise" organization status in GitHub.

Performance/Scalability

No current issues.

Security

There are a number of potential security problems you have to be aware of. See GitHub Actions Security for more information.