Introduction
GitHub Actions allows you to automate your entire development lifecycle directly within GitHub. Instead of relying on external tools, you define workflows as YAML files that run on every push, pull request, or scheduled event. This approach reduces manual errors and speeds up the delivery of quality code. In 2026, GitHub Actions remains the most integrated solution for teams seeking simple yet powerful CI/CD without additional infrastructure.
Prerequisites
- A free GitHub account
- An existing GitHub repository
- Basic knowledge of Git
- A text editor (VS Code recommended)
Create Your First Workflow
name: CI
on: [push]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup Node
uses: actions/setup-node@v4
with:
node-version: '20'
- run: npm install
- run: npm testThis YAML file defines a workflow named CI that triggers on every push. It uses an Ubuntu runner, clones the code, and executes Node.js commands. Place this file in the .github/workflows directory of your repository.
Add Advanced Triggers
on:
push:
branches: [main]
pull_request:
branches: [main]
schedule:
- cron: '0 9 * * 1'You can restrict execution to main branches, pull requests, or schedule recurring runs using cron syntax. This prevents unnecessary executions across all branches.
Use Secrets
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- name: Deploy
env:
API_KEY: ${{ secrets.API_KEY }}
run: echo "Deploying with secret key"Secrets are stored securely in the repository settings. They are injected as environment variables during execution and never appear in the logs.
Reuse Actions
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: '20'
- uses: docker/build-push-action@v5
with:
push: true
tags: myapp:latestReusable actions help avoid rewriting common steps. Always choose official or highly popular actions to minimize security risks.
Add Conditions
steps:
- name: Run only on main
if: github.ref == 'refs/heads/main'
run: echo "Deploying to production"The if directive allows a step to run only under specific conditions. This is useful for separating test and deployment steps based on the branch.
Best Practices
- Always use precise action versions (e.g., @v4)
- Limit workflow permissions with
permissions - Add timeouts to jobs
- Store secrets in the repository settings
- Test your workflows locally with act
Common Errors
- Forgetting to place the file in .github/workflows
- Using overly recent or unstable action versions
- Not protecting branches that trigger workflows
- Ignoring silent errors in shell scripts
Going Further
Discover our complete courses on GitHub Actions and modern DevOps.