DOSSIER 23 / 4 ARTICLES
GitHub Actions and CI
Turn local checks into continuous integration with explicit permissions, results, and failure evidence.
Start with the first articleFollow the question further.
Actions is an event-driven automation system. Read its execution model, design CI contracts, merge gates, and resource policies, then review tokens, secrets, OIDC, untrusted inputs, and the supply chain. A Nix theme teaching example records evaluation, actual builds, output contracts, Actions runs, and desktop runtime separately. This topic centers on CI; deployment, Pages, Packages, large-scale Enterprise governance, and full self-hosted runner operations appear only where they connect directly to CI. GitHub interfaces, plans, runners, and Action versions change, so maintain configurations against current official references and actual platform state.
- 01
Learn the execution tree from event to step, then compare the roles of needs, outputs, matrix, concurrency, cache, and artifact.
The GitHub Actions execution model
Understand events, workflows, jobs, runners, and steps, along with the distinct roles of matrices, caches, and artifacts.
Read article - 02
Build quality gates from existing local commands, then examine matrices, caches, and aggregate checks. Verify required-check names, trigger coverage, and Pending states together.
Configuring CI with GitHub Actions
Design CI from local quality checks and connect stable check statuses to repository merge rules.
Read article - 03
Map trust boundaries for events, permissions, credentials, and runners first, then study pull_request_target/workflow_run, supply chains, log diagnostics, and cost control.
GitHub Actions security and troubleshooting
Locate CI risks and failures across event, permission, credential, runner, and supply-chain boundaries.
Read article - 04
Read the six-variant Nix workflow and Flake output contract section by section, then use the three-layer record template to assess what evaluation, builds, Actions, and desktop evidence can each establish.
Nix CI: evaluation, builds, and output contracts
Use a teaching example with six theme outputs to distinguish Nix evaluation, builds, Actions records, and desktop runtime evidence.
Read article