GitHub Actions

Duration: 1 day

This comprehensive 1-day training provides in-depth knowledge and hands-on experience with GitHub Actions, GitHub's powerful automation platform. Designed for developers, DevOps engineers, and automation specialists, this course covers everything from basic workflow creation to enterprise-scale action management and security best practices.

Who Should Attend

• Software Developers
• DevOps Engineers
• Platform Engineers
• Site Reliability Engineers (SRE)
• Build and Release Engineers
• Automation Specialists
• Technical Leads responsible for CI/CD

Prerequisites

• Good understanding of Git and GitHub
• Basic knowledge of YAML syntax
• Familiarity with CI/CD concepts
• Experience with software development workflows
• Basic understanding of containerization (beneficial)

Learning Goals

By the end of this training, you will be able to:

• Author and manage sophisticated GitHub Actions workflows
• Consume, troubleshoot, and optimize existing workflows
• Create and maintain custom actions (JavaScript, Docker, and composite)
• Manage GitHub Actions at enterprise scale
• Implement security best practices and optimize workflow performance
• Design efficient CI/CD pipelines using GitHub Actions

Course Content

1. Author and Manage Workflows (20-25%)

Configure Workflow Triggers and Events

• Configuring workflows for scheduled, manual, webhook, and repository events
• Choosing appropriate scope, permissions, and events for automation
• Defining and validating workflow_dispatch inputs (types, required, defaults)
• Passing inputs to reusable workflows via workflow_call
• Mapping inputs and secrets between workflows

Design and Implement Workflow Structure

• Using jobs, steps, and conditional logic effectively
• Implementing dependencies between jobs
• Working with workflow commands and environment variables
• Configuring service containers for dependent services (databases, queues)
• Setting up ports, health checks, and container options

Advanced Workflow Patterns

• Using strategy and matrix for job variations (OS, language versions)
• Applying include/exclude patterns in matrices
• Controlling fail-fast and max-parallel settings
• Optimizing matrix size for cost and performance
• Accounting for runner image changes (Ubuntu, Windows migrations)

YAML Best Practices

• Implementing YAML anchors and aliases for code reuse
• Using predefined contexts (github, runner, env, vars, secrets, inputs, matrix, needs)
• Evaluating expressions with ${{ }}
• Understanding static vs runtime evaluation
• Preventing secret leakage in logs and expressions

Editor and Tooling

• Leveraging GitHub Actions VS Code extension
• Using YAML schema completion and validation
• Implementing metadata IntelliSense
• Maintaining workflows efficiently with editor features

Manage Workflow Execution and Outputs

• Configuring caching and artifact management
• Applying retention policies via REST APIs
• Passing data between jobs and steps
• Using artifacts, outputs, and environment files (GITHUB_ENV, GITHUB_OUTPUT)
• Generating job summaries with GITHUB_STEP_SUMMARY
• Creating rich Markdown reports (test results, coverage, links)
• Adding workflow status badges and environment protections

2. Consume and Troubleshoot Workflows (15-20%)

Interpret Workflow Behavior and Results

• Identifying workflow triggers and effects from configuration
• Diagnosing failed workflow runs using logs and run history
• Expanding and interpreting YAML anchors and aliases
• Interpreting matrix expansions and correlating job names to matrix axes
• Analyzing failures across variants
• Selectively rerunning individual matrix jobs

Access Workflow Artifacts and Logs

• Locating workflows, logs, and artifacts in the UI
• Using the GitHub API to access workflow data
• Downloading and managing workflow artifacts
• Implementing artifact retention strategies

Use and Manage Workflow Templates

• Consuming organization-level and reusable workflows
• Working with non-public organization workflow templates
• Using starter workflows (public and private templates)
• Customizing and adapting workflow templates
• Distinguishing starter workflows from reusable workflows and composite actions

Understanding Workflow Types

• Differentiating starter workflows (copy scaffold)
• Understanding reusable workflows (central versioned definition)
• Working with composite actions (encapsulated step logic)
• Contrasting disabling and deleting workflows

3. Author and Maintain Actions (15-20%)

Create and Troubleshoot Custom Actions

• Identifying and implementing action types (JavaScript, Docker, composite)
• Understanding immutable actions rollout on hosted runners
• Implementing version pinning and registry sources
• Troubleshooting action execution and errors
• Debugging action failures

Define Action Structure and Metadata

• Specifying required files and directory structure
• Creating action.yml metadata files
• Implementing workflow commands within actions
• Defining inputs, outputs, and environment variables
• Using branding and descriptions

Distribute and Maintain Actions

• Selecting distribution models (public, private, marketplace)
• Publishing actions to the GitHub Marketplace
• Applying versioning and release strategies
• Implementing semantic versioning for actions
• Managing action dependencies
• Documenting actions effectively

4. Manage GitHub Actions for the Enterprise (20-25%)

Distribute and Govern Actions and Workflows

• Defining and managing reusable components and templates
• Controlling access to actions and workflows within the enterprise
• Configuring organizational use policies
• Implementing organization-wide workflow standards
• Managing workflow template repositories

Manage Runners at Scale

• Configuring and monitoring GitHub-hosted runners
• Deploying and managing self-hosted runners
• Applying IP allow lists and networking settings
• Managing runner groups for organizational structure
• Troubleshooting runner issues at scale

Runner Software Management

• Identifying preinstalled software/tool versions on GitHub-hosted runners
• Using image release notes and toolcache
• Installing additional software at runtime
• Using setup-* actions and package managers
• Implementing caching strategies
• Working with container images and custom self-hosted images

Manage Encrypted Secrets and Variables

• Defining and scoping encrypted secrets at organization level
• Managing repository-level secrets
• Implementing environment-level secrets and variables
• Accessing and using secrets in workflows and actions
• Managing secrets programmatically via REST APIs
• Rotating secrets and managing secret lifecycle

5. Secure and Optimize Automation (10-15%)

Implement Security Best Practices

• Using environment protections and approval gates
• Identifying and using trustworthy actions from the Marketplace
• Mitigating script injection attacks
• Sanitizing and validating inputs
• Implementing least-privilege permissions
• Avoiding untrusted data in run: commands
• Proper shell quoting techniques

Token and Authentication Security

• Understanding GITHUB_TOKEN lifecycle (ephemeral, scoped)
• Configuring granular permissions
• Contrasting GITHUB_TOKEN with Personal Access Tokens (PAT)
• Restricting write scopes appropriately
• Using OIDC token (id-token permission) for cloud provider federation
• Eliminating long-lived cloud secrets

Action Security and Verification

• Pinning third-party actions to full commit SHAs
• Aligning with immutable actions enforcement
• Avoiding floating @main/@v* without justification
• Enforcing action usage policies
• Implementing allow/deny lists for actions
• Requiring reviewers for unverified actions

Artifact Attestations and Provenance

• Generating artifact attestations
• Implementing SLSA provenance
• Adding build metadata to artifacts
• Integrating attestation into deployment verification
• Verifying supply chain security

Optimize Workflow Performance and Cost

• Configuring effective caching strategies
• Optimizing artifact retention
• Applying retention policies programmatically via REST APIs
• Implementing parallelization and job dependencies
• Minimizing workflow execution time
• Reducing GitHub Actions costs
• Scaling workflows efficiently

Training Methodology

• Interactive Presentations: Comprehensive coverage of GitHub Actions concepts
• Live Demonstrations: Real-world CI/CD pipeline examples
• Hands-on Labs: Practical exercises to build automation skills
• Best Practices: Industry-standard patterns and anti-patterns
• Troubleshooting Sessions: Common issues and their solutions
• Q&A Sessions: Addressing specific automation challenges

Certification Preparation

This training aligns with the GH-200: GitHub Actions certification exam and covers all domains tested:

1. Author and manage workflows (20-25%)
2. Consume and troubleshoot workflows (15-20%)
3. Author and maintain actions (15-20%)
4. Manage GitHub Actions for the enterprise (20-25%)
5. Secure and optimize automation (10-15%)

What You'll Receive

• Comprehensive training materials
• Access to hands-on lab environment
• Workflow templates and action examples
• Best practices guide
• Security checklist
• Certificate of attendance
• Post-training support resources

Real-World Scenarios Covered

• CI/CD Pipelines: Building, testing, and deploying applications
• Multi-Platform Builds: Supporting Windows, Linux, and macOS
• Container Workflows: Building and publishing Docker images
• Package Publishing: Publishing to npm, NuGet, Maven, and GitHub Packages
• Cloud Deployments: Deploying to Azure, AWS, and Google Cloud
• Security Scanning: Integrating code scanning and dependency checks
• Release Automation: Automating release processes and versioning
• Infrastructure as Code: Deploying infrastructure with Terraform and Bicep

Follow-up and Next Steps

After completing this training, you will be well-prepared to:

• Implement production-ready CI/CD pipelines with GitHub Actions
• Create reusable actions for your organization
• Manage GitHub Actions at enterprise scale
• Prepare for the GH-200 certification exam
• Optimize automation workflows for performance and cost
• Implement security best practices in automation

Related Trainings

Consider these complementary trainings:

• GitHub Administration - Managing GitHub Enterprise and permissions
• DevOps with Azure and GitHub - Integrating GitHub with Azure services
• Secure Software Development Lifecycle - Comprehensive security practices
• Docker and Kubernetes - Container orchestration for deployments

Hands-on Labs

Throughout this training, you will participate in practical exercises including:

• Creating basic and advanced workflows with multiple triggers
• Implementing matrix strategies for multi-platform builds
• Building custom JavaScript actions
• Creating Docker container actions
• Developing composite actions for code reuse
• Setting up self-hosted runners
• Implementing workflow caching and artifacts
• Configuring environment protections and approval gates
• Integrating with cloud providers using OIDC
• Implementing secure secret management
• Optimizing workflow performance and cost

Outcomes

After completing this course, participants can apply the covered concepts and tooling to implement reliable solutions in real-world projects.