Anatomy of a Workflow

Read a workflow top to bottom

A workflow has a name, an on block listing triggers, optional top-level permissions and concurrency, and jobs. Each job has a runs-on runner label and a list of steps; a step either uses an action (with with inputs) or runs shell commands. Jobs run in parallel by default and each starts on a fresh runner, so files are not shared between jobs unless passed as artifacts or outputs.

A complete CI workflow, linted

I checked this workflow with actionlint 1.7.12 (actionlint -oneline .github/workflows/ci.yml); the output and exit code are copied from that run. actionlint validates syntax, expressions, job dependencies and known actions offline; shellcheck was not installed, so shell scripts inside run: were not linted. The workflow was not executed on GitHub. The workflow tests on Node 20 and 22, cancels superseded runs, restricts the token to read access and uploads a build artifact; actionlint reports no problems.

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        node: [20, 22]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: npm
      - run: npm ci
      - run: npm test

  build:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

Output:

(no problems found)
(exit code 0)

One workflow per purpose

Separate CI, release and housekeeping workflows; small files are easier to review and to permission correctly.

त्वरित जाँच: Do two jobs in the same workflow share files by default?

• No, each job runs on a fresh runner; use artifacts or outputs to pass data
• Yes, always
• Only on Windows runners
• Only if they have the same name