Publishing actions in GitHub Marketplace doesn't say name should not include :

[jsoref]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/actions/sharing-automations/creating-actions/publishing-actions-in-github-marketplace

What part(s) of the article would you like to see updated?

The sub-bullets under:

• The name in the action's metadata file must be unique.

should include name should not include :

Additional information

https://github.com/marketplace/actions/nowsecure-mobile-sbom is a composite action on the marketplace
it corresponds to:
https://github.com/nowsecure/nowsecure-sbom-action/blob/main/action.yml

Clicking Use latest version yields:

https://github.com/check-spelling-sandbox/stunning-bassoon/actions/runs/13566473746
https://github.com/check-spelling-sandbox/stunning-bassoon/actions/runs/13566473746/workflow

name: Mobile SBOM

on:
  push:

jobs:
  sbom:

    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: NowSecure: Mobile SBOM

❌ Check failure on line 14 in .github/workflows/sbom.yml

GitHub Actions / .github/workflows/sbom.yml
Invalid workflow file

You have an error in your yaml syntax on line 14

        uses: nowsecure/nowsecure-sbom-action@v3

---

Obviously it would be best if the validator rejected this explicitly and the marketplace didn't have entries like this, but the easiest entrypoint I have to feedback is fixing the docs.

[jsoref]

• this isn't really related to Publishing actions in GitHub Marketplace appears to wrongly suggest The action's metadata file (action.yml or action.yaml) must be in the root directory of the repository. #35439.
  Although the action that the referenced composite action uses (nowsecure, see https://github.com/nowsecure/nowsecure-sbom-action/blob/main/action.yml#L17 and https://github.com/nowsecure/nowsecure-sbom-action/blob/e64cb6d8d39d4cb6c58b4491fa4817b7a8ef3c14/action.yml#L24).
  But that action doesn't have a root entry at all as reported by this workflow run and Please remove nowsecure from marketplace nowsecure/nowsecure-action#64 is one of many actions I've asked authors to delist.

[subatoi]

Hi @jsoref

Obviously it would be best if the validator rejected this explicitly and the marketplace didn't have entries like this, but the easiest entrypoint I have to feedback is fixing the docs.

I agree, and I think the best outcome here would be for me to feed back internally about the lack of linting on the Marketplace, as I realise that's frustrating. From a docs perspective, this is a YAML syntax issue above all else and I don't think calling out one specific potential YAML error makes sense, so I'm going to close this out—but please rest assured that I will send that feedback to the Marketplace team. Thank you as ever for your help