GitHub Actions runs CI/CD pipelines defined as YAML in .github/workflows/. The hierarchy:

• Workflow — a file triggered by events (push, pull_request, schedule)
• Job — runs on a fresh runner; jobs run in parallel unless they needs each other
• Step — a shell command or a reusable action (uses:)

Pass data with secrets (${{ secrets.X }}), cache dependencies, and use a matrix to test across versions. For cloud deploys, use OIDC to assume a role without storing long-lived keys.

name: CI
on:
  push: { branches: [main] }
  pull_request:
jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix: { node: [18, 20] }
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: ${{ matrix.node }} }
      - run: npm ci
      - run: npm test
  deploy:
    needs: test
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh

1. Write a workflow that runs tests on every pull request.
2. Add a matrix to test against two language versions.
3. Make a deploy job depend on a test job with needs.
4. Reference a secret and explain why it’s not hardcoded.

• ↗ GitHub Actions — documentation