Searching the GitHub Marketplace for verified actions published by the cloud provider is the quickest and safest approach. Many cloud providers offer verified GitHub Actions that are maintained and optimized to interact with their services. These actions typically come with the correct configurations and best practices, allowing you to get started quickly without reinventing the wheel.
Note: About GitHub Marketplace for apps
GitHub Marketplace where you can share your apps with everyone.
GitHub Marketplace connects you to developers who want to extend and improve their GitHub workflows. You can list free and paid tools for developers to use in GitHub Marketplace. GitHub Marketplace offers developers two types of tools: GitHub Actions and Apps, and each tool requires different steps for adding it to GitHub Marketplace.
GitHub Actions
Anyone can publish an action in GitHub Marketplace. GitHub verifies some partner organizations and these are shown as verified creators.
Reference:
https://docs.github.com/en/enterprise-cloud@latest/apps/github-marketplace/github-marketplace- overview/about-github-marketplace-for-apps

In a workflow that runs on a pull request comment the event context contains the webhook payload. With github.event you can read the structured fields for the comment text and the pull request number. The comment text is available under the comment body field and the pull request number is available under the issue number for comment events or under the pull request number for pull request events. This makes github.event the direct and convenient source for these values.

Using required reviews in workflows
Jobs that reference an environment configured with required reviewers will wait for an approval before starting. While a job is awaiting approval, it has a status of "Waiting". If a job is not approved within 30 days, it will automatically fail.
Reference:
https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/control- deployments

[A] Internal Actions Marketplace
The reason for having an internal actions marketplace is to have a central location for all the actions that can be used inside our production organization. This is to prevent any actions from the public marketplace from being used in our production organization, without being checked for security risks first.
[B] Allow Marketplace actions by verified creators: You can allow all GitHub Marketplace actions created by verified creators to be used by workflows. When GitHub has verified the creator of the action as a partner organization, the badge is displayed next to the action in GitHub Marketplace.
[C] You can enable specific actions for the organization by identifying them and providing version control, ensuring only trusted versions are used in workflows.
Reference:
https://devopsjournal.io/blog/2021/10/14/GitHub-Actions-Internal-Marketplace
https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-organization- settings/disabling-or-limiting-github-actions-for-your-organization

Use the run: keyword only, not the shell keyword.
Use the special character |.
Note: There are two ways to run commands one after another on Github Actions.
Reference:
https://stackoverflow.com/questions/71047777/how-to-run-two-commands-on-github-actions- instance-one-after-another