Immutable actions are published action releases that cannot be altered after publication, so a specific released version resolves to the same code every time. Moving major/minor tags can still be advanced to new releases, which is why pinning to a full commit SHA remains the strongest supply-chain practice.
A workflow is a configurable automated process defined in a YAML file under .
A job is a set of steps in a workflow that execute on the same runner.
A runner is a server that executes the jobs in a workflow.
A reusable workflow is a workflow invoked by another workflow through the workflow_call trigger, letting teams define automation once and call it from many repositories.
A composite action is a custom action that bundles multiple workflow steps into a single reusable action defined in an action.
A matrix strategy uses the strategy.
GITHUB_TOKEN is an ephemeral, automatically generated secret that GitHub Actions provisions for each workflow run to authenticate against the repository.
OIDC (OpenID Connect) lets a GitHub Actions workflow request a short-lived identity token to federate with a cloud provider, eliminating long-lived stored cloud secrets.
An artifact is a file or set of files produced by a workflow run and stored by GitHub for later download or use by other jobs.
Immutable actions are published action releases that cannot be altered after publication, so a specific released version resolves to the same code every time.
workflow_dispatch is an event that enables manually triggering a workflow from the GitHub UI or API.
A runner group is a collection of self-hosted or larger hosted runners managed together with shared access policies at the organization or enterprise level.
A context is a collection of workflow and runtime data accessed with the ${{ }} expression syntax, such as github, runner, env, secrets, matrix, and needs.
An artifact attestation is signed provenance metadata that records how a build artifact was produced, supporting frameworks such as SLSA.
An environment is a named deployment target in GitHub Actions that can require protection rules such as required reviewers, wait timers, and branch restrictions before a job proceeds.