GitHub Actions

📘What it really is

• GitHub Actions runs workflows written in YAML files in .github/workflows/. A workflow has:
• triggers (on:): a push, a pull request, a schedule, or a manual button;
• jobs that run on fresh virtual machines (runners);

• steps inside each job: ready-made actions (uses:) or shell commands (run:).

• A CI workflow for your API:

# .github/workflows/ci.yml
name: CI
on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_PASSWORD: ci-only-password
          POSTGRES_DB: crm_test
        ports: ["5432:5432"]
        options: >-
          --health-cmd "pg_isready"
          --health-interval 5s
    env:
      DATABASE_URL: postgresql://postgres:ci-only-password@localhost:5432/crm_test
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run typecheck
      - run: npm run lint
      - run: npm run migrate
      - run: npm test
      - run: npm run build

• The services: block starts a real PostgreSQL just for the job, so your integration tests (Module 59) run against a real database. The password is throwaway, used only inside this temporary machine.

• Secrets: real secrets (registry tokens, deploy keys) go in the repository's Settings → Secrets and variables → Actions, used as ${{ secrets.NAME }}. GitHub hides them in logs. Never write them into workflow files.

• Least privilege: permissions: contents: read gives the workflow only what it needs (more in Module 78).

• Pin actions to a version (@v4), or for extra safety to a full commit SHA, because an action is someone else's code running with your secrets.

• Results show on every pull request as a green tick or red cross, with logs for each step.

• Public repositories get free Actions minutes; private repositories get a monthly allowance, so check your plan.