What is GitHub Actions and how does it automate testing and deployments?

Published on 2026-10-20 by frfrand

GitHub Actions explicado: workflows, eventos, jobs, runners, secrets y un ejemplo de pruebas antes de publicar código.

GitHub Actions is an automation tool integrated into GitHub that runs processes when events occur in a repository. It can run tests, compile an application, analyze code, or prepare a deployment without a person having to manually repeat all the steps each time.

Imagine having a checklist before publishing a website. One day you forget to run the tests and upload a version with an obvious error. GitHub Actions allows certain verifications to be performed consistently.

What is a workflow?

A workflow is an automation normally defined in YAML files within .github/workflows/ of the repository.

The file indicates when it runs, what jobs it must perform, and under what conditions. For example, you can decide that every pull request to the main branch runs a backend test.

This does not mean that by creating the file you are already deploying anything. First, you have to define which commands are correct and what permissions they need.

What is a job and what is a runner?

A job is a set of steps that run in a specific environment. A workflow can include several jobs: install dependencies, run tests, build frontend, or prepare a package.

The runner is the environment that executes those steps. GitHub offers hosted runners and also allows self-hosted runners in certain scenarios.

If you use a self-hosted runner, you assume security and maintenance responsibilities for the machine. It is not advisable to connect a runner with privileged permissions to a repository where untrusted code can run freely.

A simple example in a Node application

You could configure a workflow that triggers on a pull request, checks out the repository, sets up Node, and installs dependencies to run tests.

The conceptual structure would be this:

name: Verificar proyecto

on:
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - run: npm ci
      - run: npm test

It is an educational example: you need the project to have test scripts, review action versions, and adapt the environment to your dependencies. For additional security, in sensitive projects it is advisable to pin actions to specific commits and limit token permissions.

What are secrets?

Sometimes a workflow needs credentials to communicate with an external service. GitHub allows storing certain secrets and variables to use them under configured conditions.

That does not mean you can print a secret in the logs or hand it over to external code without risk. Workflow permissions must be minimal, and requests originating from forks require special attention.

Whenever possible, it is advisable to use temporary credentials with identity federation instead of keeping long-lived keys.

Does GitHub Actions automatically publish your application?

Only if you configure an automation to do so. Running tests and deploying are different actions.

You can decide that the main branch is deployed after approving the checks or require a manual step to publish to production. The second option may be appropriate for delicate changes.

It is also advisable to prepare a rollback method. A green workflow does not guarantee that an application works correctly after a data migration.

Most common failures

Confusing tests with total quality. An incomplete test suite may approve defective code.

Granting excessive permissions. Not all jobs need write access to the repository or server credentials.

Ignoring duration and cost. Long builds can consume resources and quotas. Measure times and avoid installing everything from scratch if there are safe caching options.

Running untrusted code on a privileged runner. A workflow can execute exactly what the branch includes, so the attack surface deserves attention.

What is its relationship with CI/CD?

GitHub Actions is a tool to implement continuous integration and continuous delivery practices, but CI/CD is the general practice. You can use other platforms to achieve similar goals.

How does it combine with ArduMaker?

You can use GitHub Actions to verify that an application passes tests before deploying it to a VPS managed with ArduMaker. The workflow verifies the code; the target environment still needs configuration, monitoring, and correct permissions.

In summary: GitHub Actions allows automating checks and processes associated with the repository. What matters is writing clear, secure workflows that truly add value.

Source: GitHub Actions Documentation · GitHub Actions Security · What is CI/CD.