GitHub Actions flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Workflow file location

Workflows live in .github/workflows/ at the repository root. GitHub parses every .yml or .yaml file in that directory, and each file is an independent workflow.

Job identifier rules

A job key must begin with a letter or underscore and may contain letters, digits, hyphens, and underscores. The needs keyword references this key, not the display name.

Expression context syntax

Double curly braces with a dollar sign delimit expressions evaluated by the runner. Contexts such as github, env, secrets, matrix, needs, and steps supply values before the step runs.

Permissions block semantics

Declaring any scope in permissions sets all unlisted scopes to none. List every scope a job needs, such as contents read and id-token write.

Reusable workflow invocation

A job uses owner/repo/.github/workflows/file.yml@ref to call a reusable workflow. Inputs pass through with: and map to on.workflow_call.inputs declarations.

Step isolation

Each run step executes in a separate shell process, so ordinary shell variables do not survive. Persist values through GITHUB_ENV or GITHUB_OUTPUT instead.

Event payload file

The full webhook payload is written to the path in GITHUB_EVENT_PATH as JSON. Read it with jq to access fields not exposed in the github context.

Schedule cron limits

Schedule triggers use UTC POSIX cron with a five-minute minimum interval. Scheduled workflows on inactive public repositories are disabled after sixty days.

Concurrency cancel-in-progress

Setting a concurrency group with cancel-in-progress true cancels an in-progress run in the same group when a new one starts, commonly used to supersede stale branch builds.

GITHUB_TOKEN limitations

The token is scoped to the repository, expires with the job, and cannot trigger new workflow runs. Cross-repository or workflow-triggering operations need a GitHub App or PAT.

workflow_dispatch inputs

Manually triggered workflows declare typed inputs of string, choice, boolean, or environment. Values are read from the inputs context and support required and default settings.

Path filter interaction

Multiple patterns within one filter are ORed; different filter categories such as branches and paths are ANDed. A skipped run can leave required checks pending.

Step summary file

Writing Markdown to the file named by GITHUB_STEP_SUMMARY renders it on the workflow run summary page, which is useful for test or scan reports.

Needs dependency behavior

Jobs listed in needs must complete before the dependent job starts. If a dependency fails, dependents are skipped unless their if condition uses always or failure.

Matrix include and exclude

Exclude removes matching combinations. Include adds new combinations or augments existing ones with extra variables, and fail-fast false lets remaining legs finish after a failure.

Cache immutability

A cache entry cannot be overwritten once saved under a key. Encode a lockfile hash in the key so dependency changes produce a new cache instead of a stale hit.

Artifact retention

Artifacts uploaded during a run are scoped to that run and retained for a configurable period, ninety days by default, then deleted automatically.

Environment protection rules

Environments attach required reviewers, wait timers, and branch policies to deployments. Environment secrets are available only to jobs that declare that environment.

Outcome versus conclusion

A step outcome records the raw result before continue-on-error is applied; conclusion records the final result. Conditions on failure typically check outcome.

Required check name matching

Branch protection matches required status checks by job name. Renaming a job silently breaks the rule until the protection setting is updated.

pull_request_target risk

This trigger runs in the base repository context with secrets available. Checking out and executing fork code under it exposes secrets and the token to untrusted contributors.

Action pinning by SHA

Referencing a third-party action by full commit SHA prevents a mutable tag from being repointed to different code, which mitigates supply-chain tampering.

OIDC cloud federation

Granting id-token write lets a job request a short-lived OIDC token that a cloud provider exchanges for temporary credentials, removing stored long-lived keys.

Checkout fetch depth

actions/checkout fetches a single commit by default. Set fetch-depth to zero when tooling needs full history or tags, and disable persist-credentials when the token must not remain.

Composite action structure

A composite action declares runs.using composite in action.yml and lists steps. Steps may call other actions, but the action itself cannot use a top-level uses.

Service container networking

Service containers in a job share a network with the job, so steps reach a service by its label hostname and declared port, for example postgres colon 5432.

Run conclusion values

A completed run reports success, failure, cancelled, skipped, or timed_out. Workflow conditions and downstream workflow_run triggers can branch on these values.

Job timeout default

timeout-minutes defaults to three hundred sixty minutes per job. A job exceeding the limit is cancelled and reported with a timed_out or cancelled conclusion.

workflow_run chaining

The workflow_run event fires after a named workflow completes. Reading the workflow_run conclusion in a condition gates deployment on the upstream result.

Digest-based rollback

Deploying immutable image digests or versioned artifacts built once lets a rollback redeploy a prior digest without rebuilding or trusting a mutable tag.

GITHUB_OUTPUT file writes

Writing name equals value to the GITHUB_OUTPUT file creates a step output readable as steps.id.outputs.name. Multiline values require a delimiter-based heredoc syntax.

Merge commit SHA

On pull_request events github.sha is the synthetic merge commit. Use github.event.pull_request.head.sha to reference the actual PR head commit.