GitHub Actions

Adding an action to your workflow
You can add an action to your workflow by referencing the action in your workflow file. The actions you use in your workflow can be defined in:

[F] The same repository as your workflow file
[C] Any public repository
[B] A published Docker container image on Docker Hub Note: Adding an action from the same repository [F]
If an action is defined in the same repository where your workflow file uses the action, you can reference the action with either the {owner}/{repo}@{ref} or ./path/to/dir syntax in your workflow file.

References:
https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/find-and-customize-actions

In GitHub Actions, environment variables can be defined at three different scopes: workflow, job, and step.
Each scope determines the visibility and lifetime of the environment variable across the workflow execution.
Variables defined at the workflow scope are available to all jobs and steps within the workflow.
Variables defined at the job scope are available to all steps within a specific job.
Variables defined at the step scope are only available to the step in which they are defined. They are declared within a step and are not visible outside of that step.
References:
https://medium.com/@leroyleowdev/github-actions-ways-to-share-data-between-jobs-4267ff9ac2ce

Creating Redis service containers
You can use service containers to create a Redis client in your workflow. You can create a Redis service for jobs that run in containers or directly on the runner machine.

Configuring the runner job
The example uses the ubuntu-latest GitHub-hosted runner as the Docker host.

The workflow configures a service container with the label redis.

jobs:
# Label of the runner job runner-job:

# You must use a Linux environment when using service containers or container jobs runs-on: ubuntu-latest

# Service containers to run with `runner-job`
services:
# Label used to access the service container redis:

# Docker Hub image
image: redis
# Set health checks to wait until redis has started options: >-
--health-cmd "redis-cli ping"
--health-interval 10s
--health-timeout 5s
--health-retries 5

ports:
# Maps port 6379 on service container to the host

-6379:6379
References:
https://docs.github.com/en/actions/tutorials/use-containerized-services/create-redis-service-containers

Local GitHub Actions refer to two concepts: custom actions developed within your own repository and the process of running any GitHub Action locally on your machine for faster testing and debugging.

1. Local Actions (within your repository)
Definition:
These are custom actions that you define and store directly in your repository under the .github/actions/ directory. They are not publicly shared, unlike actions from the GitHub Marketplace.

Purpose:
They are used for project-specific, repetitive tasks that you want to reuse within your workflows without publishing them globally.

How it works:
You can call these local actions in your workflow files as if they were standard published actions.

2. Running Actions Locally (on your development machine)
Note: Pinned repositories You can give users easy access to important or frequently used repositories, by choosing up to six repositories for public users and six repositories for members of the organization. Once you pin repositories to your organization profile, the "Pinned" section is shown above the "Repositories" section of the profile page.

References:
https://dev.to/codenamegrant/supercharging-your-workflows-with-local-github-actions-2o23
https://docs.github.com/en/organizations/collaborating-with-groups-in-organizations/customizing-your-
organizations-profile

[C, F] Using custom labels to route jobs You can create custom labels and assign them to your self-hosted runners at any time. Custom labels let you send jobs to particular types of self-hosted runners, based on
how they're labeled.
[E] Using default labels to route jobs A self-hosted runner automatically receives certain labels when it is added to GitHub Actions. These are used to indicate its operating system and hardware platform: self-hosted: Default label applied to self-hosted runners. linux, windows, or macOS: Applied depending on operating system. x64, ARM, or ARM64: Applied depending on hardware architecture.

You can use your workflow's YAML to send jobs to a combination of these labels. In this example, a self-hosted runner that matches all three labels will be eligible to run the job:

runs-on: [self-hosted, linux, ARM64] self-hosted - Run this job on a self-hosted runner.

linux - Only use a Linux-based runner.
ARM64 - Only use a runner based on ARM64 hardware.

References:
https://docs.github.com/en/actions/how-tos/manage-runners/self-hosted-runners/use-in-a-workflow

Use the run: keyword only, not the shell keyword.
Use the special character |.

Note: There are two ways to run commands one after another on Github Actions.

On the same step:

steps:
-name: Run both python files
run: |
python manage.py runserver
python abc.py

On different steps (that will run in sequence):

steps:
- name: Run first python file
run: python manage.py runserver
- name: Run second python file
run: python abc.py

Incorrect:
[Not B, Not E] Use run not shell.

[Not C] Use run only, not the shell command.

[Not D] Need to use the | character.

References:
https://stackoverflow.com/questions/71047777/how-to-run-two-commands-on-github-actions-instance-one-after-another

[A, not B] Each GitHub-hosted runner is a new virtual machine (VM) hosted by GitHub with the runner application and other tools preinstalled, and is available with Ubuntu Linux, Windows, or macOS operating systems.

[E] When you use a GitHub-hosted runner, machine maintenance and upgrades are taken care of for you.

References:
https://docs.github.com/en/[email protected]/actions/concepts/runners/github-hosted-runners

[F] Add a label for the custom software as required.
Note: Using labels with self-hosted runners
You can use labels to organize your self-hosted runners based on their characteristics.
Creating a custom label
You can create custom labels for runners at the repository and organization levels.

[C, not D] Linux is a default label and does not have to be created to be used.

References:
https://docs.github.com/en/actions/how-tos/manage-runners/self-hosted-runners/apply-labels

Scheduled workflows run on the latest commit on the default branch.

Note: The default branch is also the initial branch that Git checks out locally when someone clones the repository. Unless you specify a different branch, the default branch in a repository is the base branch for new pull requests and code commits.

References:
https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax
https://docs.github.com/articles/about-branches

Security practices for writing workflows and using GitHub Actions features.

You can help mitigate this risk by following these good practices:

[B] Pin actions to a full-length commit SHA Pinning an action to a full-length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork. [D] Pin actions to a tag only if you trust the creator Although pinning to a commit SHA is the most secure option, specifying a tag is more convenient and is widely used. If you'd like to specify a tag, then be sure that you trust the action's creators. The 'Verified creator' badge on GitHub Marketplace is a useful signal, as it indicates that the action was written by a team whose identity has been verified by GitHub. Note that there is risk to this approach even if you trust the author, because a tag can be moved or deleted if a bad actor gains access to the repository storing the action.
References:
https://docs.github.com/en/actions/reference/security/secure-use