Stop 17 · CI/CD & DeploymentTopics · 2/9

GitHub Actions

In short

GitHub Actions is a free robot living inside your repo. Push code and it spins up a fresh machine, runs your tests and can even deploy, all from one YAML file.

GitHub's built-in CI/CD system — YAML-defined workflows that run on events like pushes and pull requests, commonly used to test, build and deploy backend services.

The purple blob dressed as a watchman ticks a checklist as a parcel arrives at the gate.

Think of it like this

The society watchman's duty chart

The watchman has a chart: when a parcel arrives, check the name, sign the register, call the flat. He doesn't improvise, he follows the chart. A workflow file is that chart: on this event, run these steps, in this order.

Watch it happen

What happens after git push

You

GitHub

Runner VM

git push origin main

1/6You push. GitHub reads .github/workflows/ci.yml and sees it should run on pushes to main.

The big ideas

What you need to know

Workflow, job, step

A workflow file has jobs. Each job runs on its own runner and is a list of steps, run top to bottom.

Triggers start it

The on: key decides when: push, pull_request, a cron schedule, or a manual button with workflow_dispatch.

Reusable actions

uses: pulls in ready-made actions like actions/checkout or actions/setup-node, so you don't script everything yourself.

Secrets stay secret

Store tokens in the repo's Secrets settings and read them as ${{ secrets.NAME }}. They are masked in logs.

See it in code

Walk through the code

yaml

1name: CI2on:3  push:4    branches: [main]5  pull_request:6jobs:7  test:8    runs-on: ubuntu-latest9    steps:10      - uses: actions/checkout@v411      - uses: actions/setup-node@v412        with:13          node-version: 2214          cache: npm15      - run: npm ci16      - run: npm test

1/4Run on every push to main and on every pull request.

Save this as .github/workflows/ci.yml and push. Open the Actions tab to watch each step's logs live.

Save yourself the pain

Common mistakes

Oops

Pasting an API key straight into the workflow YAML.

Do this instead

Anyone who can read the repo can read the YAML. Put it in Secrets and use ${{ secrets.API_KEY }}.

Oops

Using npm install in CI and getting slightly different versions each run.

Do this instead

Use npm ci. It installs exactly what package-lock.json says and fails if the lock file is out of date.

Your mission

Your first green tick

~20 min

Quick check

Your workflow needs a file that an earlier run created, but the file is missing. Why?

Go deeper

1Write a workflow that runs your test suite on every push.
2Add a deployment job that only runs after tests pass, and only on the main branch.
3Use GitHub Actions secrets to store deployment credentials safely.