About github actions workflow generator
GitHub Actions runs automated jobs in response to events like a push. A workflow is a YAML file in .github/workflows/.
Parts of a workflow
- on: what triggers it (push, pull_request, schedule).
- jobs: units of work that run on a runner.
- steps: the commands and actions inside a job.
Good practice
- Pin actions to a version.
- Cache dependencies to speed up runs.
- Store secrets in repository secrets, never in the file.
A worked example
A Node.js workflow runs on push and pull request. It checks out the code, sets up Node 20, restores the npm cache, runs npm ci, then npm test and npm run build. If any step fails, the commit shows a red cross, so broken code is caught before merging.
Security habits
- Use repository secrets for tokens and keys, never plain text in the file.
- Give the workflow the least permissions it needs.
- Pin third-party actions to a version or commit.
