Stop 06 · CI/CD PipelinesTopics · 3/10

GitHub Actions

In short

GitHub Actions is a free robot living inside your repo. Push code and it spins up a fresh machine, runs your tests and can even deploy, all from one YAML file.

GitHub's built-in CI/CD platform, defined via YAML workflow files living alongside your code — the fastest way to get a pipeline running for a project already hosted on GitHub.

The purple blob dressed as a watchman ticks a checklist as a parcel arrives at the gate.

Think of it like this

The society watchman's duty chart

The watchman has a chart: when a parcel arrives, check the name, sign the register, call the flat. He doesn't improvise, he follows the chart. A workflow file is that chart: on this event, run these steps, in this order.

Watch it happen

What happens after git push

You

GitHub

Runner VM

git push origin main

1/6You push. GitHub reads .github/workflows/ci.yml and sees it should run on pushes to main.

The big ideas

What you need to know

Workflow, job, step

A workflow file has jobs. Each job runs on its own runner and is a list of steps, run top to bottom.

Triggers start it

The on: key decides when: push, pull_request, a cron schedule, or a manual button with workflow_dispatch.

Reusable actions

uses: pulls in ready-made actions like actions/checkout or actions/setup-node, so you don't script everything yourself.

Secrets stay secret

Store tokens in the repo's Secrets settings and read them as ${{ secrets.NAME }}. They are masked in logs.

See it in code

Walk through the code

yaml

1name: CI2on:3  push:4    branches: [main]5  pull_request:6jobs:7  test:8    runs-on: ubuntu-latest9    steps:10      - uses: actions/checkout@v411      - uses: actions/setup-node@v412        with:13          node-version: 2214          cache: npm15      - run: npm ci16      - run: npm test

1/4Run on every push to main and on every pull request.

Save this as .github/workflows/ci.yml and push. Open the Actions tab to watch each step's logs live.

Save yourself the pain

Common mistakes

Oops

Pasting an API key straight into the workflow YAML.

Do this instead

Anyone who can read the repo can read the YAML. Put it in Secrets and use ${{ secrets.API_KEY }}.

Oops

Using npm install in CI and getting slightly different versions each run.

Do this instead

Use npm ci. It installs exactly what package-lock.json says and fails if the lock file is out of date.

Your mission

Your first green tick

~20 min

Quick check

Your workflow needs a file that an earlier run created, but the file is missing. Why?

Go deeper

1Write a GitHub Actions workflow that runs tests automatically on every push.
2Learn the basic structure: triggers, jobs, and steps.
3Explore the GitHub Actions marketplace for a pre-built action instead of writing everything from scratch.