GITHUB_TOKEN is an ephemeral, automatically generated secret that GitHub Actions provisions for each workflow run to authenticate against the repository. It is scoped to the run, expires when the job finishes, and its permissions can be narrowed with the permissions key.
A workflow is a configurable automated process defined in a YAML file under .
A job is a set of steps in a workflow that execute on the same runner.
A runner is a server that executes the jobs in a workflow.
A reusable workflow is a workflow invoked by another workflow through the workflow_call trigger, letting teams define automation once and call it from many repositories.
A composite action is a custom action that bundles multiple workflow steps into a single reusable action defined in an action.
A matrix strategy uses the strategy.
GITHUB_TOKEN is an ephemeral, automatically generated secret that GitHub Actions provisions for each workflow run to authenticate against the repository.
OIDC (OpenID Connect) lets a GitHub Actions workflow request a short-lived identity token to federate with a cloud provider, eliminating long-lived stored cloud secrets.
An artifact is a file or set of files produced by a workflow run and stored by GitHub for later download or use by other jobs.
Immutable actions are published action releases that cannot be altered after publication, so a specific released version resolves to the same code every time.
workflow_dispatch is an event that enables manually triggering a workflow from the GitHub UI or API.
A runner group is a collection of self-hosted or larger hosted runners managed together with shared access policies at the organization or enterprise level.
A context is a collection of workflow and runtime data accessed with the ${{ }} expression syntax, such as github, runner, env, secrets, matrix, and needs.
An artifact attestation is signed provenance metadata that records how a build artifact was produced, supporting frameworks such as SLSA.
An environment is a named deployment target in GitHub Actions that can require protection rules such as required reviewers, wait timers, and branch restrictions before a job proceeds.