GitHub Actions Cheat Sheet

Reference for GitHub Actions workflow YAML syntax, triggers, jobs, matrix builds, and reusable actions.

2 PagesIntermediateFeb 18, 2026

Basic Workflow

Minimal CI workflow triggered on push and pull_request.

yaml

name: CIon:  push:    branches: [main]  pull_request:    branches: [main]jobs:  build:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - uses: actions/setup-node@v4        with:          node-version: '20'      - run: npm ci      - run: npm test

Matrix Strategy

Run a job across multiple versions/OSes in parallel.

yaml

jobs:  test:    strategy:      matrix:        node: [18, 20, 22]        os: [ubuntu-latest, macos-latest]    runs-on: ${{ matrix.os }}    steps:      - uses: actions/checkout@v4      - uses: actions/setup-node@v4        with:          node-version: ${{ matrix.node }}      - run: npm test

Common Triggers & Contexts

Frequently used event triggers and context expressions.

on.push- Runs when commits are pushed to matching branches/tags
on.pull_request- Runs on PR open, sync, or reopen against target branches
on.workflow_dispatch- Enables manual triggering from the Actions UI with optional inputs
on.schedule- Cron-based trigger, e.g. cron: '0 0 * * *'
${{ github.sha }}- Commit SHA that triggered the workflow
${{ secrets.NAME }}- Access repository or org secrets securely
${{ needs.job_id.outputs.x }}- Reference output from a dependent job

Reusable Workflow

Call a shared workflow from another repo/workflow.

yaml

jobs:  call-shared:    uses: my-org/shared-workflows/.github/workflows/deploy.yml@main    with:      environment: production    secrets:      DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}

Pro Tip

Pin third-party actions to a full commit SHA (not just a version tag) to protect against supply-chain attacks where a tag is force-moved to malicious code.

Was this cheat sheet helpful?

Jenkins Cheat Sheet

GitLab CI/CD Cheat Sheet