Free to read ยท Three levels
GitHub Actions: Workflows, Trust, and Delivery Evidence
Read and design Actions workflows through explicit event, execution, data, permission, and release contracts.
Start learningIn this course
Eighteen developed lessons explain GitHub Actions from workflow and process boundaries through matrices, outputs, cache behavior, token scope, reusable automation, containers, federation, attestations, concurrency, and governance. A synthetic Parcel fixture keeps examples concrete without depending on a real repository or operational account. Every lesson includes contextual mistakes, worked exercises, and official primary references.
This is a read-only course resource. No workflow file is created in .github/workflows, no run is enabled or triggered, and no runner, provider, environment, service, API, or deployment is contacted. YAML fragments remain runnable:false. Complete local Python programs model only declared synthetic behavior and are checked in isolated temporary storage; their success does not establish GitHub platform execution.
What you will learn
- Explain events, effective checkout identity, runners, shells, and job state boundaries.
- Design dependency and matrix behavior while preserving required evidence.
- Select outputs, environment files, artifacts, and caches according to scope and lifecycle.
- Review token permissions, untrusted input, environment protection, and reusable interfaces.
- Distinguish identity federation and authenticated provenance from authorization and harmlessness.
- Assess concurrency, canceled work, diagnostics, policy, and maintenance with explicit limitations.
Your learning path
Three levels
Events, execution, and data boundaries
Trace a run from event selection through jobs, matrices, and retained outputs.
- Workflow, job, step, and action boundaries
- YAML, contexts, and expression evaluation
- Events, refs, and checkout identity
- Runners, shells, and working directories
- needs, matrices, and failure behavior
- Outputs, environment files, and file artifacts
Reusable automation and scoped authority
Review caches, tokens, untrusted input, environments, reuse, and services.
- Cache keys, restore paths, and dependency integrity
- GITHUB_TOKEN permissions and secret scope
- Untrusted input and script injection boundaries
- Environment protection and approval boundaries
- Reusable workflows and composite actions
- Job containers, service containers, and network paths
Identity, coordination, and governance
Evaluate federation, provenance, privileged events, cancellation, and maintenance.
- OIDC federation and narrow identity claims
- Action dependency identity and artifact attestations
- Concurrency groups, cancellation, and release freshness
- Privileged events and untrusted source
- Diagnostics, timeouts, and safe retry decisions
- Workflow governance and maintainable automation
Who this is for
- Developers learning to reason about Actions definitions and their failure boundaries.
- Maintainers reviewing reusable workflows, job authority, artifacts, and release coordination.
Before you start
- Basic Git, command-line, YAML, application testing, and environment-variable familiarity.
- Ability to read small Python and JSON examples; no GitHub credential, runner, or cloud account is required.