Title: Github Actions Ci Cd Recipes — LearnCoachAssist

Q: What is GitHub Actions?
A: A CI/CD and workflow automation platform built into GitHub that runs jobs in response to repository events using YAML-defined workflows stored in .github/workflows/.

Q: What file extension do GitHub Actions workflow files use?
A: .yaml or .yml, stored under .github/workflows/ in the repository.

Q: What is a workflow in GitHub Actions?
A: An automated, configurable process defined by a YAML file that runs one or more jobs and is triggered by events.

Q: What is a job in GitHub Actions?
A: A set of steps in a workflow that execute on the same runner; jobs run in parallel by default unless dependencies are declared with needs:.

Q: What is a step in GitHub Actions?
A: An individual task within a job, either a shell command (run:) or an invocation of an action (uses:).

Q: What is a runner in GitHub Actions?
A: The server that executes a workflow job; can be GitHub-hosted (Ubuntu, Windows, macOS) or self-hosted.

Q: What are the two categories of runners GitHub provides by default?
A: GitHub-hosted runners (managed by GitHub) and self-hosted runners (you manage).

Q: What on clause is required to start a workflow block?
A: on: — it lists the events that trigger the workflow.

Q: Name three events that can trigger a workflow.
A: push, pull_request, and workflow_dispatch are common triggers.

Q: What does workflow_dispatch do?
A: Allows a workflow to be triggered manually from the Actions tab, the REST API, or the CLI.

Q: What does on: schedule allow?
A: Runs a workflow on a cron schedule using POSIX cron syntax evaluated against UTC.

Q: Give an example of a cron expression that runs daily at 02:30 UTC.
A: on: schedule: - cron: '30 2 * * *'

Q: What does on: push with branches: [main] do?
A: Triggers the workflow only when commits are pushed to the main branch.

Q: How do you restrict a workflow to run on pull_request targeting specific branches?
A: on: pull_request: branches: [main, develop]

Q: What is the default branch filter for push and pull_request triggers?
A: push runs on all branches by default; pull_request runs on all branches by default unless branches/paths filters are set.

Q: What does paths: filter in on: push do?
A: Limits the trigger to commits that change files matching the given glob patterns.

Q: What does paths-ignore: do in an on: push trigger?
A: Excludes commits that modify files matching the listed patterns from triggering the workflow.

Q: What is the jobs..runs-on key for?
A: Specifies the runner label(s) — e.g., runs-on: ubuntu-latest — on which the job will execute.

Q: Which value is used for the latest stable Ubuntu runner?
A: ubuntu-latest

Q: What matrix strategy allows?
A: Runs a job multiple times in parallel with different variable combinations, defined under jobs..strategy.matrix.

Q: Give an example matrix with two Node versions.
A: strategy: matrix: node-version: [18, 20]

Q: How do you add an extra matrix entry to an existing one?
A: Use strategy.matrix.include to append named combinations alongside generated ones.

Q: How do you fail-fast matrix jobs so all stop on first failure?
A: Set strategy.fail-fast: false to keep all combinations running, or true (default) to cancel on first failure.

Q: How do you reference a matrix variable inside a step?
A: Use ${{ matrix.node-version }} in run scripts or action inputs.

Q: What is concurrency in workflows?
A: A mechanism that cancels or queues in-progress runs of the same workflow to prevent overlapping executions.

Q: What does concurrency: group: ${{ github.workflow }}-${{ github.ref }} do?
A: Groups runs by workflow and ref so duplicate runs on the same branch cancel the latest only.

Q: What does cancel-in-progress: true under concurrency do?
A: Automatically cancels any in-progress run of the same concurrency group when a new one starts.

Q: How do you make jobs run sequentially?
A: Add needs: job_id to a job to declare it depends on another job's success.

Q: By default, when do dependent jobs run?
A: Only after the named needs job completes successfully.

Q: What does if: success() mean on a job or step?
A: Runs the step/job only when all previous steps/jobs in the dependency chain succeeded.

Q: What does if: failure() do?
A: Runs the step/job only when a previous step/job in the dependency chain failed.

Q: What does if: always() do?
A: Runs regardless of success or failure of previous steps/jobs.

Q: What does if: cancelled() do?
A: Runs only when the workflow was cancelled (e.g., by a new push or manual cancel).

Q: How do you set an environment variable for a single step?
A: Use env: KEY: value under the step, or env: in run: like FOO=bar command.

Q: How do you set an environment variable for all steps in a job?
A: Add env: at the job level.

Q: How do you set a workflow-wide environment variable?
A: Use env: at the top level of the workflow, under on: and above jobs:.

Q: What does the default working-directory default to?
A: The repository root (GITHUB_WORKSPACE), unless overridden by working-directory:.

Q: What does actions/checkout@v4 do?
A: Checks out your repository onto the runner so subsequent steps can access the code.

Q: What is the recommended pin pattern for third-party actions?
A: Pin to a full-length commit SHA, e.g. uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11.

Q: What is the difference between actions/checkout@v4 and @main?
A: v4 is a stable major tag/branch; @main tracks the latest commit on the main branch and is less stable.

Q: What is a composite action?
A: An action defined by a YAML file with runs.using: composite, allowing multiple steps to be bundled and reused.

Q: What is the difference between JavaScript and Docker container actions?
A: JS actions run directly on the runner; Docker actions are built into a container and may have slower startup.

Q: How do you pass inputs to an action?
A: Use the with: key, e.g. with: node-version: 20.

Q: How do you reference an output of a step in another step?
A: ${{ steps.step_id.outputs.output_name }}

Q: How do you reference a job output in another job?
A: ${{ needs.job_id.outputs.output_name }} — outputs must be declared under jobs..outputs.

Q: How do you write a multiline run script?
A: Use a pipe | block under run: or a heredoc inside the script.

Q: What shell does run: default to on Linux runners?
A: bash

Q: How do you change the shell for a run step?
A: Add shell: pwsh, shell: sh, shell: python, etc.

Q: How do you set the default shell for all steps in a job?
A: Add defaults.run.shell at the job level.

Q: What does continue-on-error: true do?
A: Allows a step to fail without failing the job, marking the step as failed but continuing.

Q: What is the default timeout for a job?
A: 360 minutes (6 hours) for GitHub-hosted runners.

Q: How do you set a per-job timeout-minutes?
A: Add timeout-minutes: at the job level.

Q: What is the maximum timeout-minutes allowed?
A: 360 minutes for GitHub-hosted runners.

Q: What is the default permissions scope for GITHUB_TOKEN?
A: read-only on most scopes; needs to be elevated explicitly when writing back.

Q: How do you set permissions for a workflow or job?
A: Use the permissions: key, e.g. permissions: contents: read or permissions: write-all.

Q: What does permissions: read-all do?
A: Grants read-only access to all available scopes for GITHUB_TOKEN.

Q: How do you grant only contents: write for a job?
A: permissions: contents: write at job level overrides broader workflow settings.

Q: What is the events: pull_request_target trigger best practice?
A: Use with extreme caution: it runs in the base repo context with write permissions and is a common source of script injection attacks.

Q: What is the peter-evans/create-pull-request action used for?
A: Creates a pull request from a branch after commits are pushed; commonly used in automation workflows.

Q: How do you upload build artifacts in a workflow?
A: Use actions/upload-artifact@v4 with a name: and path: to store files for later download.

Q: How do you download artifacts in a later job?
A: Use actions/download-artifact@v4 with name: and path:.

Q: What is the default artifact retention period?
A: 90 days for repository artifacts, after which they are deleted.

Q: What is the maximum size of a single artifact?
A: 10 GB per artifact (larger files require GitHub Packages or external storage).

Q: What is the size limit for uploading artifacts in a single workflow run?
A: Up to 10 GB total per workflow run across all artifacts.

Q: What is the maximum workflow run time for self-hosted runners?
A: Configurable; no fixed limit like GitHub-hosted runners, but jobs are killed if the runner goes offline.

Q: What does services: in a job do?
A: Spins up additional service containers (e.g., databases) that the job can connect to via localhost and a port.

Q: Give an example of starting a PostgreSQL service.
A: services: postgres: image: postgres:16 env: POSTGRES_PASSWORD: postgres ports: ['5432:5432']

Q: How do you set up a PostgreSQL service with health checks?
A: Add options: --health-cmd="pg_isready" --health-interval=10s --health-timeout=5s --health-retries=5 to the service command.

Q: What is the default network for service containers?
A: The job and services share a custom network; services are reachable by service name as host.

Q: What does the GITHUB_TOKEN environment variable provide?
A: A token automatically provisioned for the workflow, used to authenticate with the GitHub API.

Q: How do you use the default token to commit and push in a workflow?
A: Set permissions: contents: write and use it as the git auth, e.g. git config user.name "github-actions[bot]".

Q: What is the recommended user name for bot commits?
A: github-actions[bot]

Q: What is the recommended user email for bot commits?
A: 41898282+github-actions[bot]@users.noreply.github.com

Q: What does uses: actions/cache@v4 do?
A: Caches dependencies between workflow runs to speed up builds, keyed by paths and a key.

Q: Give an example of caching npm dependencies.
A: uses: actions/cache@v4 with: path: ~/.npm key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}.

Q: How do you restore cache without upload fallback?
A: Use restore-keys: with comma-separated prefix matches as a fallback when the exact key is missing.

Q: What is the difference between key and restore-keys?
A: key is the exact match for upload and download; restore-keys are prefix matches used as fallback when the exact key is missing.

Q: What is the purpose of hashFiles() in cache keys?
A: Generates a hash of the listed file patterns so the cache invalidates when those files change.

Q: What is the actions/setup-node cache: 'npm' example pattern?
A: actions/setup-node@v4 with: node-version: 20 cache: 'npm' — built-in dependency caching.

Q: What is the matrix.max-parallel setting?
A: Limits how many matrix jobs can run concurrently; useful for rate-limited resources.

Q: What does the strategy.matrix.include keyword do?
A: Adds extra matrix combinations to the auto-generated ones, optionally overriding the OS or other axes.

Q: How do you reference the runner operating system in a step?
A: Use ${{ runner.os }} which is Linux, Windows, or macOS.

Q: What does ${{ runner.arch }} return?
A: The architecture of the runner, e.g., X64, ARM64.

Q: What does ${{ github.event.pull_request.number }} return?
A: The number of the pull request that triggered the workflow.

Q: What does ${{ github.sha }} return?
A: The commit SHA that triggered the workflow run.

Q: What does ${{ github.ref }} return?
A: The branch or tag ref that triggered the workflow run, e.g., refs/heads/main.

Q: What does ${{ github.actor }} return?
A: The login of the user or app that initiated the workflow run.

Q: What does ${{ github.workflow }} return?
A: The name of the workflow.

Q: What does ${{ github.run_id }} return?
A: A unique number for the current workflow run.

Q: What does ${{ github.run_number }} return?
A: A number that increments for each run of the workflow in the repository.

Q: What does ${{ github.workspace }} return?
A: The default working directory on the runner, e.g., /home/runner/work/repo/repo.

Q: How do you write a step that runs only on pull_request events?
A: Add if: github.event_name == 'pull_request' to the step.

Q: How do you skip workflow runs based on commit message?
A: Add a step with if: "! contains(github.event.head_commit.message, '[skip ci]')" or use the docs-recommended skip patterns.

Q: What is a reusable workflow?
A: A workflow referenced by another workflow using uses: owner/repo/.github/workflows/file.yml@ref, enabling shared pipelines.

Q: What is a workflow_call trigger?
A: The on: workflow_call: event that lets a workflow be invoked by other workflows as a reusable job.

Q: How do you pass inputs to a reusable workflow?
A: Define on.workflow_call.inputs and reference them in the caller via uses: with: input_name: value.

Q: How do you pass secrets to a reusable workflow?
A: Use secrets: inherit in the caller, or secrets: NAME in the with block of uses:.

Q: What is the difference between uses: at job level and step level?
A: Job-level uses: invokes a reusable workflow; step-level uses: invokes an action.

Q: What is the difference between an action and a reusable workflow?
A: Actions are reusable units within a step; reusable workflows are whole workflows invoked as a job.

Q: What is a self-hosted runner?
A: A machine you set up and register with GitHub to run your workflows, used for custom hardware, OS, or networking.

Q: How do you register a self-hosted runner?
A: Follow Settings -> Actions -> Runners -> New self-hosted runner steps in the repository or org settings.

Q: What label do you assign to a self-hosted runner in a job?
A: runs-on: self-hosted (or runs-on: [self-hosted, linux, x64] for a specific label).

Q: What is a key security risk of self-hosted runners on public repos?
A: Malicious pull requests from forks can run code on the runner; use fork-PR approval or ephemeral runners.

Q: How do you safely run workflows on pull_request from forks?
A: Use pull_request_target with explicit branch filtering, or enable Require approval for first-time contributors.

Q: What is the recommended pattern for first-time contributor PRs?
A: Require manual approval before workflows run, configured in Settings -> Actions -> General.

Q: What is the maximum number of jobs that can run in a workflow?
A: Up to 2,000 jobs per workflow run across all matrix combinations.

Q: What is the maximum number of matrix combinations per axis?
A: 256 in a single matrix axis; total combinations must be reasonable (workflow job cap applies).

Q: What is GitHub-hosted runners' network egress policy?
A: Egress is open to the public internet by default; you must use a self-hosted runner for private networking.

Q: What is a common way to use Actions for deployments?
A: A workflow that runs on push to main builds the artifact, then a job with environment: production deploys after manual approval.

Q: What does environment: in a job enable?
A: Links the job to a deployment environment with its own secrets, protection rules, and URL.

Q: What is a deployment protection rule?
A: A rule that gates deployments to an environment, e.g., requiring manual approval or waiting for a status check.

Q: How do you trigger a deployment when a release is published?
A: Use on: release: types: [published] and deploy in a job with environment: production.

Q: What is the difference between a release and a tag?
A: A release is a GitHub object wrapping a git tag with notes and assets; a tag is just a git reference.

Q: How do you install apt packages on ubuntu-latest?
A: Use sudo apt-get update && sudo apt-get install -y in a run step.

Q: How do you install Python on ubuntu-latest without setup-python?
A: Use actions/setup-python@v5 with python-version: '3.12'.

Q: How do you set up a Java environment?
A: Use actions/setup-java@v4 with distribution: 'temurin' and java-version: '21'.

Q: What does the cache option in actions/setup-go do?
A: Caches Go modules based on go.sum and automatically restores on subsequent runs.

Q: What does the cache option in actions/setup-node do?
A: Caches the user's npm, yarn, or pnpm store based on lockfile hashes.

Q: How do you install a specific Node.js version?
A: actions/setup-node@v4 with: node-version: '20.x' or '20.10.0'.

Q: How do you set up a Go environment?
A: actions/setup-go@v5 with: go-version: '1.22' cache: true — built-in Go module caching.