Ravindra BagaleCourses & study guides मराठी

Ravi Sir's Cards › DevOps

Chapter 9: GitHub Actions Hands-On: Cards

मराठी cards · Open the chapter

Revision cards

Why Actions: checks on every push. People forget to run tests; broken code reaches main.
Revision card 1 of 15: Why Actions: checks on every push · Download PNG · Open card page

Lesson: 9.1 Why Actions — checks on every push

Minimal workflow: test on pull request. A small working workflow beats a big broken one.
Revision card 2 of 15: Minimal workflow: test on pull request · Download PNG · Open card page

Lesson: 9.2 Minimal workflow — test on pull request

Jobs, steps, needs and permissions. Without needs, build runs even if tests fail.
Revision card 3 of 15: Jobs, steps, needs and permissions · Download PNG · Open card page

Lesson: 9.3 Jobs, steps, needs and permissions

Caching and artifacts. Slow pipelines get skipped or ignored.
Revision card 4 of 15: Caching and artifacts · Download PNG · Open card page

Lesson: 9.4 Caching and artifacts

Build and push an image (GHCR sketch). Images built by hand differ from what was tested.
Revision card 5 of 15: Build and push an image (GHCR sketch) · Download PNG · Open card page

Lesson: 9.5 Build and push an image (GHCR sketch)

Local act: dry thinking before push. Push-and-pray burns time and noisy commits.
Revision card 6 of 15: Local act: dry thinking before push · Download PNG · Open card page

Lesson: 9.5b Local act / dry thinking before push

Secrets and OIDC awareness. Stored cloud keys are a big leak risk.
Revision card 7 of 15: Secrets and OIDC awareness · Download PNG · Open card page

Lesson: 9.6 Secrets and OIDC (awareness)

Deploy sketch: SSH to one lab VM. A first deploy job shows the full CI/CD loop.
Revision card 8 of 15: Deploy sketch: SSH to one lab VM · Download PNG · Open card page

Lesson: 9.7 Deploy sketch — SSH to one lab VM

Matrix and reuse (awareness). Copy-pasting jobs across versions and repos gets messy.
Revision card 9 of 15: Matrix and reuse (awareness) · Download PNG · Open card page

Lesson: 9.7b Matrix and reuse (awareness only)

Reading a failed Actions log like a pro. Scrolling randomly through logs wastes time.
Revision card 10 of 15: Reading a failed Actions log like a pro · Download PNG · Open card page

Lesson: 9.7c Reading a failed Actions log like a pro

Branch protection and required checks. CI is useless if people can merge red builds.
Revision card 11 of 15: Branch protection and required checks · Download PNG · Open card page

Lesson: 9.8 Branch protection and required checks

Troubleshooting table. The same few errors repeat across teams.
Revision card 12 of 15: Troubleshooting table · Download PNG · Open card page

Lesson: 9.9 Troubleshooting table

Pinning action versions. A third-party action can change under you.
Revision card 13 of 15: Pinning action versions · Download PNG · Open card page

Lesson: 9.9b Pinning action versions

Environment-specific configs in CI. One config for all environments causes prod accidents.
Revision card 14 of 15: Environment-specific configs in CI · Download PNG · Open card page

Lesson: 9.10 Environment-specific configs in CI

Lab: PR tests and main image push. This lab joins the chapter into one real pipeline.
Revision card 15 of 15: Lab: PR tests and main image push · Download PNG · Open card page

Lesson: 9.11 Lab — PR tests and main image push

Interview cards

What is GitHub Actions? GitHub's CI/CD service: YAML workflows in .github/workflows run jobs on events like push and pull_request.
Interview card 1 of 15: What is GitHub Actions? · Download PNG · Open card page

Lesson: 9.1 Why Actions — checks on every push

Write a minimal test workflow. Trigger on: pull_request, one job on ubuntu-latest, steps: checkout, set up language, run tests.
Interview card 2 of 15: Write a minimal test workflow. · Download PNG · Open card page

Lesson: 9.2 Minimal workflow — test on pull request

How do you make one job wait for another? Use needs: other-job. Jobs without needs run in parallel.
Interview card 3 of 15: How do you make one job wait for another? · Download PNG · Open card page

Lesson: 9.3 Jobs, steps, needs and permissions

Cache vs artifact in Actions? Cache: speed up future runs (dependencies). Artifact: keep outputs of this run (reports, binaries).
Interview card 4 of 15: Cache vs artifact in Actions? · Download PNG · Open card page

Lesson: 9.4 Caching and artifacts

How do you push an image from Actions? Log in to the registry with the GITHUB_TOKEN (packages: write), then build-push-action with a SHA tag.
Interview card 5 of 15: How do you push an image from Actions? · Download PNG · Open card page

Lesson: 9.5 Build and push an image (GHCR sketch)

How do you test a workflow without many pushes? Use act to run it locally, lint the YAML, and test on a branch or with workflow_dispatch.
Interview card 6 of 15: How do you test a workflow without many pushes? · Download PNG · Open card page

Lesson: 9.5b Local act / dry thinking before push

Why use OIDC instead of cloud keys in secrets? OIDC gives short-lived credentials per run, so there's no stored key to leak or rotate.
Interview card 7 of 15: Why use OIDC instead of cloud keys in secrets? · Download PNG · Open card page

Lesson: 9.6 Secrets and OIDC (awareness)

How would you deploy to a VM from Actions? After build, SSH in with a key from secrets, pull the new image, restart, then health check.
Interview card 8 of 15: How would you deploy to a VM from Actions? · Download PNG · Open card page

Lesson: 9.7 Deploy sketch — SSH to one lab VM

What is a build matrix? One job definition run for each combination of values like OS and language version.
Interview card 9 of 15: What is a build matrix? · Download PNG · Open card page

Lesson: 9.7b Matrix and reuse (awareness only)

A workflow failed. How do you debug it? Open the red step, find the first error, check what changed, reproduce locally, re-run with debug logging if needed.
Interview card 10 of 15: A workflow failed. How do you debug it? · Download PNG · Open card page

Lesson: 9.7c Reading a failed Actions log like a pro

How do you stop broken code reaching main? Branch protection: require pull requests, required status checks (CI) and at least one review.
Interview card 11 of 15: How do you stop broken code reaching main? · Download PNG · Open card page

Lesson: 9.8 Branch protection and required checks

Your workflow never starts. Why? Wrong trigger or branch filter, file not in .github/workflows, YAML error, or Actions disabled for the repo.
Interview card 12 of 15: Your workflow never starts. Why? · Download PNG · Open card page

Lesson: 9.9 Troubleshooting table

Why pin actions to a commit SHA? Tags can be moved to malicious code; a full SHA always points to the same reviewed code.
Interview card 13 of 15: Why pin actions to a commit SHA? · Download PNG · Open card page

Lesson: 9.9b Pinning action versions

How do you keep staging and prod configs separate in Actions? Use GitHub environments with their own secrets and vars, and reviewers on production.
Interview card 14 of 15: How do you keep staging and prod configs separate in Actions? · Download PNG · Open card page

Lesson: 9.10 Environment-specific configs in CI

Describe a basic CI pipeline you built. PRs run tests; merges to main run tests, build an image tagged with the SHA and push it; main is protected.
Interview card 15 of 15: Describe a basic CI pipeline you built. · Download PNG · Open card page

Lesson: 9.11 Lab — PR tests and main image push

Comparison cards

Actions cache vs artifact. Cache: files kept between runs to go faster (like downloaded libraries).Artifact: files saved from one run (like a test report).
Comparison card 1 of 3: Actions cache vs artifact · Download PNG · Open card page

Lesson: 9.4 Caching and artifacts

Stored secret vs OIDC. Stored secret: a cloud key saved in GitHub settings.OIDC (OpenID Connect): the cloud gives a short-lived token to this workflow run.
Comparison card 2 of 3: Stored secret vs OIDC · Download PNG · Open card page

Lesson: 9.6 Secrets and OIDC (awareness)

Action pinned by tag vs by SHA. Tag (@v4): a name pointing to a release; can be moved.SHA (@a1b2…): the exact commit; can't change.
Comparison card 3 of 3: Action pinned by tag vs by SHA · Download PNG · Open card page

Lesson: 9.9b Pinning action versions