DevOps
GitHub Actions
GitHub Actions is CI/CD built into GitHub: YAML workflows run on repository events such as push or pull request.
What it is
GitHub Actions was announced in 2018 and became generally available in 2019. It is GitHub's CI/CD service: you put YAML files in .github/workflows and GitHub runs them on events (push, pull request, schedule, manual dispatch).
A workflow consists of jobs, each job runs on a runner (GitHub-hosted on Linux, Windows, macOS, or your self-hosted one) and contains steps. Steps either run commands or call ready-made actions from the Marketplace, such as checkout or setup-node.
It has build matrices, dependency caching, artifacts, secrets and environments with manual approval. Minutes are free for public repositories, private ones have a plan quota.
Use it when
- Your code is already on GitHub and you want CI without a separate service.
- You need to run tests, linters and builds on every pull request.
- You automate deploys, releases and package publishing.
- You need a build matrix across versions or OSes.
Avoid it when
- Your code is not on GitHub: GitLab CI or Jenkins are more natural then.
- You need full control of CI infrastructure with no dependence on a service (self-hosted runners or Jenkins can fit).
Key concepts
- Workflow
- A YAML file in .github/workflows that describes when and what to run.
- Job / step
- A job is a set of steps on one runner, jobs run in parallel by default.
- Runner
- The machine that runs a job: GitHub-hosted or your own self-hosted one.
- Action
- A reusable step called through uses.
- Secrets / environments
- Encrypted variables and environments with access rules and approvals.
Example
Cheat sheet
| Command or code | What it does |
|---|---|
on: [push, pull_request] | When the workflow runs |
runs-on: ubuntu-latest | Which runner the job uses |
- uses: actions/checkout@v4 | Check out the repository code |
- uses: actions/setup-node@v4 | Install the Node.js version you need |
- run: pnpm install --frozen-lockfile | Run a shell command |
strategy: { matrix: { node: [20, 22] } } | Matrix: the same job for several versions |
env: { TOKEN: ${{ secrets.TOKEN }} } | Pass a secret as an environment variable |
needs: build | Run a job after another job |
if: github.ref == 'refs/heads/main' | Condition for a step or a job |
- uses: actions/cache@v4 | Cache dependencies between runs |
- uses: actions/upload-artifact@v4 | Save build files as an artifact |
How to learn it
- Create a repo and a first workflow in
.github/workflows/ci.ymlthat printsechoon every push. - Take the GitHub Actions CI and CD course on ShortLesson to see the full cycle from commit to deploy.
- Learn the structure:
on,jobs,runs-on,steps,usesversusrun, and version matrices. - Set up CI for your project: install dependencies, lint, tests and build on pull requests.
- Add dependency caching and artifacts to speed up the pipeline.
- Work with secrets and environment variables (
secrets.*,vars.*) and never print them in logs. - Deploy on push to main with a separate environment and manual approval for production.
- Extract repeated parts into reusable workflows or composite actions and try writing your own action.
Interview questions
1. What is the structure of a workflow?
A workflow has triggers (on), one or more jobs, and each job has a runner and steps. Steps either run a command via run or call an action via uses.
2. How do you pass secrets safely?
Store them in repository or environment Secrets and use them as ${{ secrets.NAME }}. For clouds prefer OIDC to avoid long-lived keys. Secrets are not exposed to forks.
3. How do you speed up a build?
Cache dependencies (actions/cache or cache in setup-*), run jobs in parallel, use a matrix and cancel stale runs through concurrency.
Interview questions from the bank
- What is CI and why does a team need it?JuniorDevOps
- How does Continuous Delivery differ from Continuous Deployment?JuniorDevOps
- Describe a pipeline for a backend service. What are the stages, how does cache differ from artifacts, and how do you protect the deploy?MiddleDevOps
- How do you secure a workflow in GitHub Actions?MiddleDevOps
- How do you organize a fast release rollback?MiddleDevOps
npm auditshows 47 vulnerabilities, the team has ignored them for a long time, and the news is full of attacks through packages. What do you do?SeniorWeb security
Comparisons with this technology
Related technologies
- GitLab CI/CDGitLab CI/CD is the build and delivery system built into GitLab, configured with a .gitlab-ci.yml file.
- JenkinsJenkins is an open source automation server for CI/CD with a huge plugin ecosystem and pipelines as code.
- DockerDocker packages an application with its dependencies into a container that runs the same on a laptop, a server and the cloud.
- Argo CDArgo CD is a GitOps tool for Kubernetes: it watches a Git repository and syncs the cluster to the state described there.
Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).