Free course · 10 lessons · Beginner
GitHub Actions: CI/CD Workflows From First Run to Secure Deployments
Learn GitHub Actions the practical way: workflows, events and filters, a real CI workflow with caching, build matrices, variables, secrets and expressions, then pipelines with outputs and artifacts, protected environments and OIDC cloud deploys, Docker images and releases, reusable workflows and composite actions, and security hardening. Every workflow in the course is checked with actionlint and shown with a summary of what it does.
1. GitHub Actions Workflows: Triggers, CI and Matrices
Write workflows that run on the right events, build and test a project with cached dependencies, and fan out across versions and operating systems.
- Your First Workflow: Events, Jobs and Steps — Create a workflow file, understand how events, jobs, runners and steps fit together, and read a run in the Actions tab.
- Triggers and Filters: Choosing When Workflows Run — Control which pushes, pull requests, schedules and manual runs start a workflow, using branch, tag and path filters.
- A Real CI Workflow: Checkout, Setup, Cache and Test — Build a continuous integration workflow for a Node.js project with dependency caching, a lint step and a timeout.
- Build Matrices: Many Versions and Operating Systems — Run the same job across several runtimes and operating systems with strategy.matrix, include, exclude and fail-fast.
- Variables, Secrets, Expressions and Outputs — Configure workflows with env, vars and secrets, use ${{ }} expressions and if conditions, and pass values between steps.
2. Pipelines, Deployments and Security
Chain jobs into a pipeline, deploy through protected environments and OIDC, publish images and releases, share logic with reusable workflows, and harden your workflows.
- Pipelines: Job Dependencies, Outputs and Artifacts — Order jobs with needs, pass values with job outputs, and move build files between jobs with artifacts.
- Deployments: Environments, Approvals and OIDC — Deploy through protected environments with required reviewers, and authenticate to the cloud with short-lived OIDC tokens instead of stored keys.
- Containers and Releases: Publish Images and Tagged Versions — Build and push a Docker image to GitHub Container Registry, and create a GitHub release when a version tag is pushed.
- Reusable Workflows and Composite Actions — Remove duplication with workflow_call reusable workflows and your own composite actions.
- Security Hardening: Permissions, Injection and Pinned Actions — Apply least-privilege permissions, avoid script injection, pin third-party actions, and handle pull requests from forks safely.