Free through lesson 3

GitHub Actions Fundamentals Course

From your first workflow to YAML, triggers and jobs, matrices, caching, linting, Secrets, Environments, permissions, OIDC, Docker images, releases, and deploying to and rolling back a server, all the way to reusable workflows. Over 20 lessons, you'll work up to running everything from push through test, release, and deploy automatically. All output shown was actually run with act and actionlint.

Start from lesson 1 Unlock every course

Curriculum

The 20 lessons are split into 5 chapters. We recommend working through them in order starting from Chapter 1, but feel free to skip around to whatever interests you. * Workflows can't run in the browser, so push to a GitHub repository, or install act (a tool for running workflows on Docker) and actionlint locally to try them. Wherever act's results differ from real GitHub, that's called out in the text.

Chapter 1 — CI/CD Thinking and Your First Workflow (lessons 1–4)

You'll pin down exactly what CI/CD automates, write your first workflow, and check it locally with actionlint and act. You'll get a handle on reading YAML, the on/jobs/steps skeleton, and the nature of the runner a job executes on.

1

CI/CD and Your First Workflow

Hand off the 4 things you used to do by hand before every push — linting, formatting, type-checking, and testing — to a GitHub Actions workflow. Check it locally first with actionlint and act.

Free
2

How to Read a Workflow's YAML

Read a workflow's YAML via 3 building blocks: mappings, sequences, and multi-line strings. Watch for traps like 3.10 becoming 3.1 and NO becoming false, and how actionlint catches mistakes.

Free
3

Reading a Workflow's Skeleton: on, jobs, steps

Read a workflow as on (when it runs), jobs (what runs), and steps (in what order). You'll meet 4 kinds of triggers, how needs and outputs wire jobs together, and check ${{ }} expressions with act.

Free
4

Runners and Passing Data Between Jobs

Print out what's inside the machine (runner) a job runs on, and confirm each job starts on a fresh machine. Pass files between jobs with artifacts, and run a job inside a fixed image with container:.

🔒 Basic

Chapter 2 — Automating Tests and Quality Checks (lessons 5–8)

You'll run the same tests across multiple Python versions, speed them up with caching, and make linting and type-checking gates in CI. You'll finish by surfacing results at a glance with status badges and job summaries.

5

Running Multiple Python Versions with a Matrix

Use strategy.matrix to run the same tests on Python 3.12, 3.13, and 3.14 at once. Fix code that passes locally on 3.14 but hits ImportError only on 3.12, plus fail-fast, include, and exclude.

🔒 Basic
6

Speeding Up the Second Run with Caching

Cache packages uv downloads with setup-uv's enable-cache, and mypy's results with actions/cache, then measure the speedup. Picking key and restore-keys, and the rule that a cache is never overwritten.

🔒 Basic
7

Running Lint and Type-Checking as Separate Jobs

Catch mistakes that survive passing tests with ruff (linting/formatting) and mypy (type-checking). Split into 3 parallel jobs, and annotate a pull request's diff lines with --output-format=github.

🔒 Basic
8

Status Badges and Job Summaries

Put CI results somewhere visible. A status badge in the README, a coverage table written to $GITHUB_STEP_SUMMARY, and a required status check in a ruleset that blocks merging until it passes.

🔒 Basic

Chapter 3 — Secrets and Environments (lessons 9–12)

You'll pass passwords and tokens safely, and put an approval gate in front of production deploys. You'll narrow GITHUB_TOKEN's permissions to prevent command injection, finishing by connecting to the cloud with OIDC — no long-lived keys required.

9

Secrets and Masking Logs

Register secrets like API keys, and pass them as env vars. See how they become *** in logs, why base64 doesn't hide values, masking one with ::add-mask::, and how a typo'd name silently becomes empty.

🔒 Basic
10

Gating Production Behind Approval with Environments

Separate staging/production deploys with Environments: same secret/variable names get different values per environment. Protect it via approvals, wait timers, branch limits — beyond act's reach.

🔒 Basic
11

Narrowing permissions and Command Injection

Narrow a job's GITHUB_TOKEN to exactly what's needed via permissions. Reproduce with act how a PR title in run lets a command execute, how env prevents it, pinning an Action's SHA, and zizmor scans.

🔒 Basic
12

Connecting to AWS with OIDC — No Keys Required

Instead of a years-valid access key in Secrets, get OIDC credentials lasting an hour. Writing id-token: write and configure-aws-credentials, and which runs an IAM role's trust policy sub lets through.

🔒 Basic

Chapter 4 — Build and Deploy (lessons 13–16)

You'll build a Docker image, push it to ghcr.io, and cut a release from a tag. You'll finish by deploying to a practice server over SSH, rolling back to the previous version whenever the health check fails.

13

Building a Docker Image and Pushing to ghcr.io

Build the sample app's Docker image in Actions and push to GitHub Container Registry (ghcr.io). Log in with GITHUB_TOKEN and packages: write, tag via metadata-action, limit PRs to build, cache layers.

🔒 Basic
14

Creating a Release on a Tag Push

Push a tag like v1.2.3 to trigger tests, build a package, and attach it to a release. Confirm the tag matches pyproject.toml's version, use uv build and gh release create with auto notes, by label.

🔒 Basic
15

Deploying to a Server over SSH

Every push to main deploys over SSH after tests pass: rsync files, swap builds via docker compose, and run it on a local practice server checking health/connectivity, plus key storage and concurrency.

🔒 Basic
16

Confirming a Deploy and Rolling Back

When a version passes tests but fails only in production, auto-rollback to the previous version, marking it failed. Confirm keeping greeter:previous before swapping, and redeploy via a chosen tag.

🔒 Basic

Chapter 5 — Practice and Operations (lessons 17–20)

You'll consolidate repeated steps into reusable workflows and composite actions, cutting down runtime and cost. You'll finish by wiring CI through to deploy as a single pipeline, and look back over the whole course.

17

Turning CI into Building Blocks with Reusable Workflows

Bundle lint, type-check, and test into one workflow_call flow, called twice with different inputs. Version and type-checking switch via inputs, coverage returns via outputs, and permissions cap it.

🔒 Basic
18

Building Your Own Composite Action

Bundle the "install uv, then install deps with caching" steps every job repeats into one composite action.yml. Inputs/outputs, the failure from using it before checkout, and the $/ syntax from 2026.

🔒 Basic
19

Cutting Runtime and Cost

Actions on private repos rounds each job's time up to the nearest minute. See how job splits change monthly minutes and bill, trim with paths-ignore, concurrency, timeout-minutes, and Dependabot.

🔒 Basic
20

Capstone: From CI to Production Deploy

Assemble 20 lessons' work into two workflows: CI for pull requests, and a release from tag push to production. Review permissions, caching, approvals, rollbacks, CODEOWNERS, and act/actionlint/zizmor.

🔒 Basic

Once you've finished all 20 lessons, move on to Kubernetes to run the images this pipeline pushes, Cloud to work with the services OIDC connects you to, or Testing Techniques to raise the quality of the tests you run in CI. A membership unlocks every course.