GitHub Actions

GitHub Actions runs workflows from repository events. Jobs, steps, actions, runners, permissions, environments, and required status checks make it a common CI/CD system for GitHub-hosted code.

					name: ci
on:
  pull_request:
  push:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20, cache: npm }
      - run: npm ci && npm test
				

Key concepts: workflow triggers, reusable workflows, `permissions` least privilege, cache keys, matrix jobs, environment protection rules, and required checks on protected branches.

On interviews: `pull_request` versus `pull_request_target` security, pinning third-party actions, OIDC deploy, and merge gates.

Common pitfalls: third-party actions as supply-chain dependencies; broad `GITHUB_TOKEN` write permissions; unsafe `pull_request_target` exposing secrets to forks.

The trade-off is tight GitHub integration versus YAML complexity and action supply-chain risk.

Checklist:

• Pin or trust actions deliberately.
• Set minimal token permissions.
• Use required checks for merge gates.
• Protect environments for production deploy.