Introduction to
GitHub Actions

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

env:
  PIP_DISABLE_PIP_VERSION_CHECK: "1"

defaults:
  run:
    shell: bash

jobs:
  gate:
    name: Demo gate
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - run: pip install -r demo/requirements.txt
      - name: Tests (report skips with -rs)
        run: pytest -rs demo

.github/workflows/ci.yml in this repo: the check that guards main (slide 20). A check is the pass/fail mark GitHub shows on a commit or pull request; each job reports one. Green on push to main, run 37216325824.

on:
  push:
    branches: [main, "release/**"]
    paths-ignore: ["**.md"]
  pull_request:
    types: [opened, synchronize, reopened]
  schedule:
    - cron: "17 3 * * 1-5"      # 03:17 UTC on weekdays
  workflow_dispatch:
    inputs:
      level:
        type: choice
        options: [quick, full]
  workflow_call:
    inputs:
      python-version:
        type: string
        default: "3.12"

demo/lint_examples/triggers.yml: every common trigger in one file, checked with actionlint (clean). Each trigger also ran for real in a workflow of its own (right).

The Actions tab: every run, filterable by workflow, event, status, branch and actor.

An expression is ${{ … }}: GitHub evaluates it before the step runs. A context is a named object it can read.

status:
  needs: [prepare, service]
  runs-on: ubuntu-24.04
  steps:
    - id: flaky
      name: A step allowed to fail
      continue-on-error: true
      run: exit 3
    - name: Runs only because the step above failed
      if: steps.flaky.outcome == 'failure'
      run: echo "outcome=${{ steps.flaky.outcome }} conclusion=${{ steps.flaky.conclusion }}"
    - name: Skipped, because the job has not failed
      if: failure()
      run: echo "never printed"
    - name: Always runs (clean-up)
      if: always()
      run: echo "event=${{ github.event_name }} actor=${{ github.actor }} ref=${{ github.ref_name }}"

outcome=failure conclusion=success
##[debug]Evaluating: failure()
##[debug]=> false
##[debug]Evaluating: always()
##[debug]=> true
event=push actor=BrendanJamesLynskey ref=main

run 37214324637 (debug re-run, attempt 2). continue-on-error makes a failed step's outcome failure but its conclusion success, so the job stays green and failure() is false.

test:
  name: test (py${{ matrix.python }}, ${{ matrix.os }})
  runs-on: ${{ matrix.os }}
  timeout-minutes: 10
  strategy:
    fail-fast: false
    max-parallel: 3
    matrix:
      os: [ubuntu-24.04, ubuntu-22.04]
      python: ["3.10", "3.12", "3.13"]
      exclude:
        - os: ubuntu-22.04
          python: "3.13"
      include:
        - os: ubuntu-24.04
          python: "3.13"
          coverage: true

run 37214874461: five legs, then report, which needs them. The notice comes from the coverage leg's ::notice (slide 09). Screenshot as a logged-out visitor sees it.

jobs:
  prepare:
    runs-on: ubuntu-24.04
    outputs:
      stamp: ${{ steps.s.outputs.stamp }}
    steps:
      - id: s
        run: echo "stamp=$(date -u +%Y%m%dT%H%M%S)-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"

  service:
    needs: prepare
    runs-on: ubuntu-24.04
    services:
      redis:
        image: redis:7-alpine
        ports: ["6379:6379"]
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 5
    steps:
      - name: Talk to the service container
        run: |
          python3 - <<'PY'
          import socket
          s = socket.create_connection(("localhost", 6379), timeout=5)
          s.sendall(b"PING\r\n")
          reply = s.recv(64)
          print("redis replied", reply)
          assert reply == b"+PONG\r\n"
          PY
      - run: echo "stamp from prepare = ${{ needs.prepare.outputs.stamp }}"

- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
  with:
    python-version: ${{ matrix.python }}
    cache: pip
    cache-dependency-path: demo/requirements.txt
- name: Cache the generated dataset
  id: data
  uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
  with:
    path: .cache/data
    key: data-${{ runner.os }}-${{ hashFiles('demo/make_data.py') }}
- name: Build the dataset (only on a cache miss)
  if: steps.data.outputs.cache-hit != 'true'
  run: python demo/make_data.py .cache/data

Cache not found for input keys: data-Linux-f0fb67ba…
Failed to save: Unable to reserve cache with key data-Linux-f0fb67ba…,
  another job may be creating this cache.
…
Cache restored from key: data-Linux-f0fb67ba…

The first run's legs raced to save the same key; the losers' "Failed to save" is a warning, not a failure. The key uses runner.os (Linux), so both Ubuntu versions share it.

    - name: Annotate
      if: matrix.coverage
      run: echo "::notice file=demo/stats.py,line=4::coverage leg ran on Python ${{ matrix.python }}"
    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: junit-${{ matrix.python }}-${{ matrix.os }}
        path: report-*.xml
        retention-days: 5
    - name: Job summary
      run: |
        {
          echo "### Python ${{ matrix.python }} on ${{ matrix.os }}"
          echo "| dataset cache hit | tests |"
          echo "|---|---|"
          echo "| ${{ steps.data.outputs.cache-hit == 'true' }} | $(grep -o 'tests=\"[0-9]*\"' report-*.xml) |"
        } >> "$GITHUB_STEP_SUMMARY"
        cat "$GITHUB_STEP_SUMMARY"   # also in the log, for readers without a GitHub login

report:
  needs: test
  if: always()
  runs-on: ubuntu-24.04
  steps:
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        pattern: junit-*
        merge-multiple: true
    - name: Summarise every leg
      run: |
        reports=(report-*.xml)
        echo "### ${#reports[@]} JUnit reports; matrix result: ${{ needs.test.result }}" >> "$GITHUB_STEP_SUMMARY"
        printf -- '- %s\n' "${reports[@]}" >> "$GITHUB_STEP_SUMMARY"
        cat "$GITHUB_STEP_SUMMARY"

name: JS hello
description: A JavaScript action with no dependencies.
inputs:
  who:
    description: Who to greet
    default: world
outputs:
  greeting:
    description: The greeting it made
runs:
  using: node24
  main: index.js

// Inputs arrive as INPUT_<NAME> environment variables; outputs go to the $GITHUB_OUTPUT file.
const fs = require("fs");
const who = process.env.INPUT_WHO || "world";
const greeting = `Hello, ${who}, from Node ${process.version}`;
console.log(greeting);
fs.appendFileSync(process.env.GITHUB_OUTPUT, `greeting=${greeting}\n`);

name: Docker hello
description: A Docker container action (Linux runners only).
inputs:
  who:
    description: Who to greet
    default: world
runs:
  using: docker
  image: Dockerfile
  args: ["${{ inputs.who }}"]

FROM alpine:3.20
COPY entrypoint.sh /entrypoint.sh
ENTRYPOINT ["/bin/sh", "/entrypoint.sh"]

Hello, Actions, from Node v24.19.0
Hello, Actions, from 3.20.10 inside a container
JS action said 'Hello, Actions, from Node v24.19.0'

Both ran in run 37214324885 (job own-actions). A real JavaScript action would normally use the actions/toolkit packages; this one uses only the INPUT_* variables and the $GITHUB_OUTPUT file they wrap.

permissions: {}   # nothing by default; each job asks for what it needs

jobs:
  read-only:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Reading the repo works
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh api "repos/$GITHUB_REPOSITORY/contents/README.md" --jq .name
      - name: Writing (creating an issue label) is refused
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if gh api -X POST "repos/$GITHUB_REPOSITORY/labels" -f name="demo-$GITHUB_RUN_ID" > out.txt 2> err.txt; then
            echo "::error::the token could write, which it should not"; exit 1
          fi
          echo "refused as expected: $(grep -o 'HTTP [0-9]*' err.txt | head -1)"
          echo "Write refused: \`$(grep -o 'HTTP [0-9]*' err.txt | head -1)\`" >> "$GITHUB_STEP_SUMMARY"

README.md
refused as expected: HTTP 403

run 37214432837: reading worked; creating a label got 403 Resource not accessible by integration.

jobs:
  deploy:
    runs-on: ubuntu-24.04
    environment: demo   # a 1-minute wait timer and a main-only branch rule protect it
    steps:
      - name: Use an environment secret
        env:
          DEMO_SECRET: ${{ secrets.DEMO_SECRET }}
        run: |
          echo "the secret is: $DEMO_SECRET"        # the log shows ***
          echo "its length is ${#DEMO_SECRET}"

the secret is: ***
its length is 32

run 37214444150: queued 15:49:23, job started 15:50:27.

OIDC instead of long-lived cloud keys

oidc-claims:
  runs-on: ubuntu-24.04
  permissions:
    id-token: write   # lets the job ask GitHub for a signed OIDC token
  steps:
    - name: Request a token and print its claims (never the token itself)
      run: |
        RESP=$(curl -sS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
               "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sts.example.com")

iss           https://token.actions.githubusercontent.com
aud           sts.example.com
sub           repo:BrendanJamesLynskey@27049659/Introduction_to_GitHub_Actions@1404583061:ref:refs/heads/main
ref           refs/heads/main
event_name    push

run 37214432837 printed the claims, never the token. OIDC (OpenID Connect): the job asks GitHub for a signed, minutes-long identity token; the cloud checks the claims (this repo, this branch) and swaps it for temporary credentials. No cloud key is stored in GitHub. The cloud side (an AWS role trust policy, an Azure federated credential, GCP workload identity) was not run here: no cloud account. See OpenID Connect.

run 37214705396, as a logged-out visitor sees it: the red job and its annotation. Step logs need a signed-in GitHub account; gh run view RUN --log-failed prints just the failing step:

    def test_median_odd_and_even():
>       assert median([3, 1, 2]) == 3  # deliberately wrong: the ruleset demo
E       assert 2 == 3
E        +  where 2 = median([3, 1, 2])
demo/test_stats.py:11: AssertionError
========================= 1 failed, 3 passed in 0.25s ==========================
##[error]Process completed with exit code 1.

on:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  slow:
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - run: sleep 90 && echo "finished (not cancelled)"

Dispatched twice, 22 s apart: run 37214446270 was cancelled, run 37214470039 finished.

This repo's ruleset, viewed logged out: Protect main, active on the default branch.