Welcome to your GitHub Actions training path. This page lists every lesson of the course, in reading order and grouped into progressive modules: workflows, runners, optimisation and supply chain security.
Tick each lesson as you work through it: your progress is saved locally in your own browser, with no account required and nothing sent to the server. You can also tick a lesson straight from its page, through the tracking banner at the top.
Course · Beginner to advanced
GitHub Actions Training
From your first workflow to self-hosted runners, with supply chain security at the centre
- 10 modules
- 67 lessons
- 6 labs
- 59 quizzes
- 41h
Progress 0 / 67 (0%)
-
01
- lesson Getting started with GitHub Actions: CI/CD pipelines and security 20 min
- lesson quiz What is a GitHub Actions workflow? 35 min
- lesson quiz First security reflexes for GitHub Actions workflows 40 min
- lesson quiz GitHub Actions secrets and configuration 40 min
- lesson quiz GitHub Actions Marketplace: evaluating third-party actions 40 min
-
02
- lesson GitHub Actions workflows: the complete guide 1h
- lesson quiz Contexts and expressions in GitHub Actions 45 min
- lesson quiz Variables and secrets in GitHub Actions 40 min
- lesson quiz GitHub Actions triggers: events and filters 35 min
- lesson quiz Conditions and if in GitHub Actions 35 min
- lesson quiz needs and job outputs: modelling a pipeline as a graph 30 min
- lesson quiz Matrix strategy in GitHub Actions 1h10
- lesson quiz Service containers and job containers 30 min
- lesson quiz Reusable workflows in GitHub Actions 40 min
- lesson quiz Composite actions in GitHub Actions 35 min
-
03
- lesson Securing GitHub Actions: the complete guide 1h
- lesson quiz Pinning actions by SHA 35 min
- lesson quiz Maintaining SHA-pinned actions at scale 30 min
- lesson quiz Supply chain attacks on GitHub Actions: real cases and protections 45 min
- lesson quiz Auditing your GitHub Actions workflows with zizmor 40 min
- lesson quiz Scanning your CI/CD pipelines with poutine 40 min
- lesson quiz Plumber: securing your GitLab CI and GitHub Actions pipelines 40 min
- lesson quiz Hardening GitHub Actions runners with Harden-Runner 40 min
- lesson quiz Threat modelling a GitHub Actions workflow 30 min
-
04
- lesson quiz GitHub Actions permissions: the GITHUB_TOKEN 30 min
- lesson quiz Securing pull_request_target 40 min
- lesson quiz GitHub Actions OIDC: authentication without secrets 30 min
- lesson quiz GitHub Actions OIDC: AWS, Azure, GCP 40 min
- lesson quiz GitHub Actions attestations 30 min
- lesson quiz Verifying GitHub attestations 40 min
- lesson quiz GitHub Actions workflow security checklist 35 min
-
05
- lesson Lab: a secure GitHub pipeline, end to end 10 min
- lab quiz Bootstrapping a secure GitHub repository 1h05
- lab quiz Hardened CI pipeline: passing the four scanners 50 min
- lab quiz Verifiable build: SLSA provenance, SBOM and signature 55 min
- lab quiz Branch protection and governance 1h
- lab quiz Scoring and hardening: the 19 Scorecard checks 1h05
-
06
- lesson Deploying with GitHub Actions: from CI to CD 15 min
- lesson quiz GitHub Actions environments: targeting a deployment 30 min
- lesson quiz GitHub deployment protection rules 30 min
- lesson quiz Promoting an artifact: build once, deploy twice 30 min
- lesson quiz GitHub releases and GHCR images: publishing what you deploy 30 min
- lesson quiz Rollback and deployment concurrency in GitHub Actions 30 min
- lab quiz Lab: promoting an approved deployment 55 min
-
07
- lesson Optimising GitHub Actions workflows 20 min
- lesson quiz Debugging GitHub Actions workflows 40 min
- lesson quiz GitHub Actions Artifacts: sharing files between jobs 40 min
- lesson quiz GitHub Actions cache: speeding up your workflows 40 min
- lesson quiz Python and pip caching in GitHub Actions 30 min
- lesson quiz Node.js and npm caching in GitHub Actions 30 min
- lesson quiz Java, Maven and Gradle caching in GitHub Actions 30 min
- lesson quiz Artifacts vs Cache: making the right choice 25 min
- lesson quiz GitHub Actions concurrency: avoiding parallel runs 30 min
-
08
- lesson GitHub Actions runners: where do your workflows run? 25 min
- lesson quiz GitHub-hosted versus self-hosted runners 35 min
- lesson quiz Securing self-hosted runners 40 min
- lesson quiz Ephemeral GitHub Actions runners 40 min
- lesson quiz Isolating GitHub Actions runners 35 min
- lesson quiz Maintaining self-hosted runners 35 min
-
09
- lesson Governing GitHub Actions: what YAML does not protect 15 min
- lesson quiz GitHub rulesets: protecting the branch that carries your workflows 30 min
- lesson quiz CODEOWNERS: enforcing a review on your workflows 25 min
- lesson quiz Restricting the allowed actions in an organisation 25 min
- lesson quiz Runner groups: bounding what a run can reach 25 min