$ run as a normal user# run as root (or with sudo)
Run on push and pull request
The most used events. Filter by branch, tag and path.
.github/workflows/terraform.yml
on:
push:
branches: [main]
tags: ["v*"]
paths: ["envs/**", "modules/**"]
pull_request:
branches: [main]
paths-ignore: ["docs/**", "**.md"]| Filter | Meaning |
|---|---|
branches / branches-ignore | Only these / not these branches |
tags | Tag pushes, for releases |
paths / paths-ignore | Only when these files changed |
Remember
pull_request runs the code of the PR in a safe context: secrets are not given to PRs from forks.
Run on a schedule
schedule uses cron syntax in UTC — for nightly scans, drift checks and reports.
.github/workflows/nightly.yml
on:
schedule:
- cron: "30 1 * * *"Watch out
Scheduled runs can start late at busy times, and they stop after 60 days without activity in a public repository.
Run by hand with inputs
workflow_dispatch adds a Run workflow button, with inputs you choose.
.github/workflows/deploy.yml
on:
workflow_dispatch:
inputs:
environment:
type: choice
options: [staging, prod]
default: staging
dry_run:
type: boolean
default: true
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- run: echo "Deploying to ${{ inputs.environment }} (dry run ${{ inputs.dry_run }})"gh workflow run deploy.yml -f environment=staging -f dry_run=falseChain workflows
workflow_run starts a workflow when another one finishes; workflow_call makes a workflow reusable (see Reuse workflows).
.github/workflows/deploy-after-ci.yml
on:
workflow_run:
workflows: [CI]
types: [completed]
branches: [main]
jobs:
deploy:
if: github.event.workflow_run.conclusion == 'success'
runs-on: ubuntu-latest
steps:
- run: echo "CI passed, deploying"Know other useful events
Many GitHub events can start automation.
| Event | Use |
|---|---|
release (types: [published]) | Build and upload release files |
issues, issue_comment | Label or triage issues |
merge_group | Checks for the merge queue |
repository_dispatch | Start from an outside system through the API |
pull_request_target | Runs with secrets for PRs from forks — dangerous, see Secure your pipelines |