GitHub Actions: development features and setup

Overview

You can define what happens after a code change and keep the process definition alongside the project. This makes changes to automation infrastructure testable and reviewable like regular code. Before connecting to a production environment, separate checks that can run on every change from actions that require secrets and permissions. Keep test artifacts from each run so another developer can investigate a failure without rerunning the entire process.

Features

• Define processes in the code repository
• Combine ready-made and custom actions
• Testing and building as part of CI/CD

Business uses

• Run tests for an API connector on every change request
• Deploy a website after tests and version approval

Getting started

• Create a workflow that runs just one check
• Run it on a test branch and inspect the run log
• Add deployment only after the environment and appropriate permissions are configured

What to check

• Limit permissions for tokens and third-party actions
• Check secrets policies for code from external contributors