Stop 03 · Git & GitHubTopics · 11/11

GitHub Actions basics

In short

Every time you push, a robot can install your packages, run tests and lint for you. That robot is GitHub Actions, and it catches bugs before your teammates do.

GitHub's built-in CI/CD system — YAML workflow files that automatically run tests, builds or deployments on events like pushes and pull requests.

The mascot drops clothes into a washing machine and presses a single button.

Think of it like this

The washing machine programme

You drop clothes in and press one button. The machine fills, washes, rinses and spins on its own, in order, and beeps if something goes wrong. A GitHub Actions workflow runs your steps the same way whenever you push.

Watch it happen

One workflow run on a push

Push

Runner

npm ci

Tests

Status

1/5You push to a PR. GitHub sees a workflow file in .github/workflows that listens for this event.

The big ideas

What you need to know

Workflows are YAML files

They live in .github/workflows/. Each one says when to run (on) and what to do (jobs and steps).

Triggers start them

push, pull_request, a schedule, or a manual button. You choose which events wake the workflow.

Reuse actions

uses: pulls in ready-made steps like actions/checkout. run: executes your own shell commands.

Secrets stay secret

Store API keys in repo Settings, Secrets, then read them as secrets.NAME. Never hard-code them in YAML.

See it in code

Walk through the code

yaml

1# .github/workflows/ci.yml2name: CI3on:4  push:5    branches: [main]6  pull_request:7jobs:8  test:9    runs-on: ubuntu-latest10    steps:11      - uses: actions/checkout@v412      - uses: actions/setup-node@v413        with:14          node-version: 2215      - run: npm ci16      - run: npm test

1/4Run on pushes to main and on every pull request.

Commit this file and push. Open the Actions tab on GitHub to watch each step's logs live.

Save yourself the pain

Common mistakes

Oops

Putting a database password straight into the workflow YAML.

Do this instead

Add it as a repository secret and reference it with ${{ secrets.DB_PASSWORD }}.

Oops

Using npm install in CI, so versions drift between runs.

Do this instead

Use npm ci. It installs exactly what package-lock.json says and fails if the lock file is out of date.

Your mission

Add CI to a repo

~30 min

Quick check

Where must a GitHub Actions workflow file live for GitHub to find it?

Go deeper

1Add a simple workflow that runs `npm test` on every push.
2Learn the basic YAML structure: triggers, jobs, and steps.
3Explore the GitHub Actions marketplace for prebuilt actions (deploy, lint, etc.).