Master programming syntax, solve interactive challenges & run live code in Syntaxis Explore Arena →

menu_book Course Curriculum (GitHub Actions) expand_more

Workflow Basics

Workflow file anatomy push trigger pull_request trigger workflow_dispatch trigger Scheduled workflow Job definition Step definition Runner selection

Expressions & Data

Environment variables Repository variables Secrets Contexts Expression syntax if conditions Step outputs Job outputs

Build Strategies

Matrix strategy Include matrix values Exclude matrix values Fail-fast behavior Max parallel jobs Job dependencies Conditional jobs Reusable workflow inputs

Artifacts & Cache

Upload artifact Download artifact Dependency cache Cache key fallback Retention days Share artifact between jobs Build output artifact Test report artifact

Permissions & Security

GITHUB_TOKEN permissions Least-privilege contents permission OIDC identity token Environment secrets Pin action by commit SHA Untrusted pull request secrets Dependency review action Artifact attestation

Reusable Automation

Composite action Reusable workflow workflow_call secrets Workflow outputs Local action Action inputs Action outputs Repository dispatch

Deployments

Environment deployment Required environment approval Concurrency group Cancel in progress Release creation Container registry login Deploy job needs build Rollback workflow dispatch

Diagnostics & Quality

Debug logging Job summary Continue on error Timeout minutes Service containers Health checks Lint job Test-build-deploy pipeline

GitHub Actions / Permissions & Security

Artifact attestation

Learn Artifact attestation in GitHub Actions with a dedicated explanation, a topic-specific example, edge guidance, and a mastery check.

12 min read • Intermediate

github-actions-040.yml

yaml

name: lesson
on:
  workflow_dispatch:
permissions:
  id-token: write
  contents: read
  attestations: write
jobs:
  attest:
    runs-on: ubuntu-latest
    steps:
      - run: echo artifact > app.bin
      - uses: actions/attest-build-provenance@v2
        with:
          subject-path: app.bin

What to watch

Content source & attribution

Original Syntaxis Content · Original Syntaxis Content

Lesson quizzes

Artifact attestation Mastery Check →

Dependency review action

Composite action