Stream helps developers build engaging apps that scale to millions with performant and flexible Chat, Feeds, Moderation, and Video APIs and SDKs powered by a global edge network and enterprise-grade infrastructure. Learn more →
Checkout Alternatives
Similar projects and alternatives to checkout
-
pages-gem
A simple Ruby Gem to bootstrap dependencies for setting up and maintaining a local Jekyll environment in sync with GitHub Pages
-
SurveyJS
JavaScript Form Builder with No-Code UI & Built-In JSON Schema Editor. Keep full control over the data you collect and tailor the form builder’s entire look and feel to your users’ needs. SurveyJS works with React, Angular, Vue 3, and is compatible with any backend or auth system. Learn more.
-
-
-
-
-
-
-
Stream
Stream - Scalable APIs for Chat, Feeds, Moderation, & Video. Stream helps developers build engaging apps that scale to millions with performant and flexible Chat, Feeds, Moderation, and Video APIs and SDKs powered by a global edge network and enterprise-grade infrastructure.
-
setup-php
GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and various tools.
-
changed-files
:octocat: Github action to retrieve all (added, copied, modified, deleted, renamed, type changed, unmerged, unknown) files and directories.
-
-
-
github-pages-deploy-action
🚀 Automatically deploy your project to GitHub Pages using GitHub Actions. This action can be configured to push your production-ready code into any branch you'd like.
-
-
-
-
jacoco-badge-generator
Coverage badges, and pull request coverage checks, from JaCoCo reports in GitHub Actions
-
-
ytmdl-web-v2
Web version of ytmdl. Allows downloading songs with metadata embedded from various sources like itunes, gaana, LastFM etc.
-
-
InfluxDB
InfluxDB – Built for High-Performance Time Series Workloads. InfluxDB 3 OSS is now GA. Transform, enrich, and act on time series data directly in the database. Automate critical tasks and eliminate the need to move data externally. Download now.
NOTE:
The number of mentions on this list indicates mentions on common posts plus user suggested alternatives.
Hence, a higher number means a better checkout alternative or higher similarity.
checkout discussion
checkout reviews and mentions
Posts with mentions or reviews of checkout.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2025-06-11.
-
Bypassing GitHub Actions policies in the dumbest way possible
what with actions/checkout@v4, hows that documented?
https://github.com/actions/checkout/issues/567#issuecomment-...
GH has a `permissions:` entry and this mechanism already for internal repo action sharing. And thousands of our dollars per month.
- GitHub's checkout action is halting contributions
-
How to Harden GitHub Actions: The Unofficial Guide
Here is an example in the wild: https://github.com/actions/checkout/actions/workflows/publis...
-
Using Checkout Action in GitHub Actions Workflow
The snippet above creates a step called "Checkout repository", which uses the actions/checkout action. The @ character allows you to pin the version of the action - in this case, version v4. You can see previous and future versions in the checkout releases on GitHub.
-
Popular GitHub Action tj-actions/changed-files is compromised
I think a big part of the problem is the way one typically "installs" a GH action: by copy-pasting something from README of the action.
Let's have a look at a random official GH provided action:
https://github.com/actions/checkout
It lists the following snippet:
`uses: actions/checkout@v4`
Everyone will just copy paste this snippet and call it a day.
In case of npm/yarn deps, one would often do the same, and copy paste `yarn install foobar`, but then when installing, npm/yarn would create a lockfile and pin the version. Whereas there's no "installer" CLI for GH actions that would pin the version for you, you just copy-paste and git push.
To make things better, ideally, the owners of actions would update the workflows which release a new version of the GH action, to make it update README snippet with the sha256 of the most recent release.
-
Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
It seems pretty awful that the de-facto way to use GitHub Actions is using git tags which are not immutable. For example to checkout code [1]:
- uses: actions/checkout@v4
Github does advise people to harden their actions by referring to git commit hashes [2] but Github currently only supports SHA-1 as hashing algorithm. Creating collisions with this hashing algo will be more and more affordable and I'm afraid that we will see attacks using the hash collisions during my lifetime.
I wish that they will add support for SHA-256 soon and wrote product feedback regarding it here: https://github.com/orgs/community/discussions/154056
If this resonates with you please go and give it a thumbs up :)
[1]: https://github.com/actions/checkout?tab=readme-ov-file#usage
[2]: https://docs.github.com/en/actions/security-for-github-actio...
-
Asynchronous Server: Building and Rigorously Testing a WebSocket and HTTP Server
GitHub Actions uses .yaml or .yml files to define workflows, similar to docker-compose.yml. In this case, we're using the latest Ubuntu distribution as the environment. We use version 4 of the actions/checkout action to check out our repository. We also install system dependencies required by some of the Python packages, such as poppler-utils for pdf2image and tesseract-ocr and libtesseract-dev for pytesseract. Since our project doesn't have database interaction, we don't need a services section. The remaining steps are self-explanatory. We then execute our bash script to check the codebase against our defined standards. We also supply environment variables and run the tests (which we'll write later). This CI/CD pipeline runs on every pull request or push to the utility branch.
-
How to Set Up Automated Tests with a QA Coding Agent for Flutter
GitAuto used v2, while v4 is the latest available according to the official GitHub Actions Checkout documentation. Another area for potential improvement.
-
Tell HN: GitHub doesn't cleanup spam in their own repos
I was checking out the actions/checkout repository, which is something most GitHub actions are bound to use, and navigated to the issues:
https://github.com/actions/checkout/issues
On the first page aline I found cryptocurrency scams, no effort issues, and outright spam, from days to months old. It is an official GitHub repository for one of their most popular actions in a major feature, with hundreds of watchers and thousands of forks and stars. Yet it looks completely abandoned. No wonder the state of spam on GitHub.
-
Lock Mechanism on GitHub Actions
Manage branches via GitHub API without git command. You don't have to checkout repositories by actions/checkout
-
A note from our sponsor - Stream
getstream.io | 11 Jul 2025
Stats
Basic checkout repo stats
81
6,693
5.2
about 1 month ago
actions/checkout is an open source project licensed under MIT License which is an OSI approved license.
The primary programming language of checkout is TypeScript.
Popular Comparisons
Sponsored
JavaScript Form Builder with No-Code UI & Built-In JSON Schema Editor
Keep full control over the data you collect and tailor the form builder’s entire look and feel to your users’ needs. SurveyJS works with React, Angular, Vue 3, and is compatible with any backend or auth system. Learn more.
surveyjs.io