GitHub Actions

GitHub Actions became generally available in 2019 and turned GitHub into a CI/CD platform. Workflows are YAML files stored in the repository under .github/workflows. Each workflow says when it should run, for example on every push, on pull requests, on a schedule or by hand, and what it should do.

A workflow contains jobs, and each job runs on a runner, a fresh virtual machine with Linux, Windows or macOS that GitHub provides, or a self-hosted machine. A job is a list of steps: shell commands such as npm test, or reusable actions such as actions/checkout to fetch the code. Jobs run in parallel unless one depends on another, and a matrix can run the same job across several versions or operating systems.

Thousands of ready-made actions in the GitHub Marketplace handle common tasks: setting up a language, caching dependencies, publishing packages, deploying to cloud providers or commenting on pull requests. Secrets such as API keys are stored encrypted in the repository settings and passed to the steps that need them.

A common misconception is that GitHub Actions is only for CI. It can automate almost anything triggered by repository events: labeling issues, releasing versions, updating dependencies or publishing documentation. Because third-party actions run with access to your code and secrets, pinning them to a specific version is an important security practice.