GitHub Actions Training

Course · Beginner to advanced

GitHub Actions Training

From your first workflow to self-hosted runners, with supply chain security at the centre

• 4 levels
• 11 modules
• 68 lessons
• 7 labs
• 60 quizzes
• 43h

Start Lesson: GitHub Actions: securing your CI/CD

Recommended before you start: Git (in French)

About this path · first level: 15 lessons, about 3 weeks

Welcome to your GitHub Actions training path. This page lists every lesson of the course, in reading order and grouped into progressive modules: workflows, runners, optimisation and supply chain security.

Yes, it is a long path. Nobody follows it in one go: it is split into levels. The first one, "Write and design workflows", is 15 lessons of about 40 minutes: at one per working day, roughly 3 weeks, and it ends with its own result. Each module gives you a skill you can use the next day, and your progress waits for you in this browser and on the devices linked to your optional account.

Reach a goal

This topic path gathers all our content on the domain. Your personal path may only use part of it.

• Skills 6 (+5 in part) 6 by quiz · 1 in a lab · 1 with a proof
• Jobs DevSecOps EngineerCI/CD EngineerPlatform Engineer

Progress 0 / 68 (0%)

• Knowledge Not measured Your first quiz will show up at the end of a lesson.
• Practice Not measured Labs measure what you can do. You do not need DSOXLab to start a course.
• Proof Not measured Challenges and hands-on exams check that you can act without step-by-step instructions.

Tick lessons here, or with “Mark as read” at the end of each lesson. Progress stays in this browser; nothing is sent to the server unless you link this browser to an optional account.

Reset

Expand all Collapse all

1. 01 Overview 0 / 1

   • lesson GitHub Actions: securing your CI/CD 20 min

A1

Write and design workflows

0 / 15 lessons 0 / 2 modules

You write a workflow that triggers at the right time, then make it dynamic with matrices, expressions and reusable workflows.

1. 02 Writing your first workflow 0 / 5

   • lesson Getting started with GitHub Actions: CI/CD pipelines and security 20 min
   • lesson lab quiz What is a GitHub Actions workflow? 1h05
   • lesson quiz First security reflexes for GitHub Actions workflows 40 min
   • lesson quiz GitHub Actions secrets and configuration 40 min
   • lesson quiz GitHub Actions Marketplace: evaluating third-party actions 40 min
2. 03 Designing dynamic workflows 0 / 10

   • lesson quiz GitHub Actions workflows: the complete guide 1h10
   • lesson quiz Contexts and expressions in GitHub Actions 45 min
   • lesson quiz Variables and secrets in GitHub Actions 40 min
   • lesson quiz GitHub Actions triggers: events and filters 35 min
   • lesson quiz Conditions and if in GitHub Actions 35 min
   • lesson quiz needs and job outputs: modelling a pipeline as a graph 30 min
   • lesson quiz Matrix strategy in GitHub Actions 1h10
   • lesson quiz Service containers and job containers 30 min
   • lesson quiz Reusable workflows in GitHub Actions 40 min
   • lesson quiz Composite actions in GitHub Actions 35 min

Level validation: no validation test is defined for this level yet.

A2

Secure the pipeline

0 / 22 lessons 0 / 3 modules

You cut permissions down to the minimum, replace secrets with OIDC, pin actions and produce verifiable provenance.

1. 04 Defending the supply chain 0 / 9

   • Secure a pipeline definition: permissions, secrets, pinning and triggers

     • lesson Securing GitHub Actions: the complete guide 1h
     • lesson quiz Pinning actions by SHA 35 min
     • lesson quiz Maintaining SHA-pinned actions at scale 30 min
     • lesson quiz Supply chain attacks on GitHub Actions: real cases and protections 45 min

   • Audit a CI workflow and model its threats

     • lesson quiz Auditing your GitHub Actions workflows with zizmor 40 min
     • lesson quiz Scanning your CI/CD pipelines with poutine 40 min
     • lesson quiz Plumber: securing your GitLab CI and GitHub Actions pipelines 40 min

   • Harden and isolate CI runners

     • lesson quiz Hardening GitHub Actions runners with Harden-Runner 40 min

   • Audit a CI workflow and model its threats

     • lesson quiz Threat modelling a GitHub Actions workflow 30 min
2. 05 Least privilege, OIDC and provenance 0 / 7

   • Secure a pipeline definition: permissions, secrets, pinning and triggers

     • lesson quiz GitHub Actions permissions: the GITHUB_TOKEN 30 min
     • lesson quiz Securing pull_request_target 40 min
     • lesson quiz GitHub Actions OIDC: authentication without secrets 30 min
     • lesson quiz GitHub Actions OIDC: AWS, Azure, GCP 40 min

   • Sign an artifact, attest its provenance and verify it before deployment

     • lesson quiz GitHub Actions attestations 30 min
     • lesson quiz Verifying GitHub attestations 40 min

   • Secure a pipeline definition: permissions, secrets, pinning and triggers

     • lesson quiz GitHub Actions workflow security checklist 35 min
3. 06 Lab: a hardened GitHub pipeline, end to end 0 / 6

   • Govern and tool an organization's CI

     • lesson Lab: a secure GitHub pipeline, end to end 10 min
     • lab quiz Bootstrapping a secure GitHub repository 1h05

   • Secure a pipeline definition: permissions, secrets, pinning and triggers

     • lab quiz Hardened CI pipeline: passing the four scanners 1h30

   • Sign an artifact, attest its provenance and verify it before deployment

     • lab quiz Verifiable build: SLSA provenance, SBOM and signature 55 min

   • Govern and tool an organization's CI

     • lab quiz Branch protection and governance 1h
     • lab quiz Scoring and hardening: the 19 Scorecard checks 1h05

Level validation: no validation test is defined for this level yet.

A3

Deliver and speed up

0 / 16 lessons 0 / 2 modules

You deploy through protected environments and make a slow pipeline fast and easy to troubleshoot.

1. 07 Delivering: environments and deployments 0 / 7

   • lesson Deploying with GitHub Actions: from CI to CD 15 min
   • lesson quiz GitHub Actions environments: targeting a deployment 30 min
   • lesson quiz GitHub deployment protection rules 30 min
   • lesson quiz Promoting an artifact: build once, deploy twice 30 min
   • lesson quiz GitHub releases and GHCR images: publishing what you deploy 30 min
   • lesson quiz Rollback and deployment concurrency in GitHub Actions 30 min
   • lab quiz Lab: promoting an approved deployment 55 min
2. 08 Speeding up and debugging the pipelines 0 / 9

   • lesson Optimising GitHub Actions workflows 20 min
   • lesson quiz Debugging GitHub Actions workflows 40 min
   • lesson quiz GitHub Actions Artifacts: sharing files between jobs 40 min
   • lesson quiz GitHub Actions cache: speeding up your workflows 40 min
   • lesson quiz Python and pip caching in GitHub Actions 30 min
   • lesson quiz Node.js and npm caching in GitHub Actions 30 min
   • lesson quiz Java, Maven and Gradle caching in GitHub Actions 30 min
   • lesson quiz Artifacts vs Cache: making the right choice 25 min
   • lesson quiz GitHub Actions concurrency: avoiding parallel runs 30 min

Level validation: no validation test is defined for this level yet.

A4

Run CI at scale

0 / 14 lessons 0 / 3 modules

You choose and isolate runners, govern an organisation's workflows and tool their review from the command line.

1. 09 Choosing and securing the runners 0 / 6

   • lesson GitHub Actions runners: where do your workflows run? 25 min
   • lesson quiz GitHub-hosted versus self-hosted runners 35 min
   • lesson quiz Securing self-hosted runners 40 min
   • lesson quiz Ephemeral GitHub Actions runners 40 min
   • lesson quiz Isolating GitHub Actions runners 35 min
   • lesson quiz Maintaining self-hosted runners 35 min
2. 10 Governing the CI beyond the YAML 0 / 5

   • lesson Governing GitHub Actions: what YAML does not protect 15 min
   • lesson quiz GitHub rulesets: protecting the branch that carries your workflows 30 min
   • lesson quiz CODEOWNERS: enforcing a review on your workflows 25 min
   • lesson quiz Restricting the allowed actions in an organisation 25 min
   • lesson quiz Runner groups: bounding what a run can reach 25 min
3. 11 The command line toolkit 0 / 3

   • lesson quiz GitHub CLI (gh): managing GitHub from the terminal 40 min
   • lesson quiz act: running GitHub Actions workflows locally 45 min
   • lesson quiz actionlint: validating your GitHub Actions workflows 35 min

Level validation: no validation test is defined for this level yet.

When you are done: the practice exam

The quiz at the end of each lesson checks that one lesson. The practice exam does something else: it draws from the whole bank, across every module, and gives you a score by domain rather than a single number. That is what tells you where to go back.

It comes in four levels, from twelve to forty questions, and each attempt draws a different set: replaying is meant to be useful, not repetitive. Nothing is sent anywhere, the marking happens in your browser.

• Beginner, 12 questions: the vocabulary and the shape of a workflow.
• Intermediate, 20 questions: the level of someone who writes pipelines every week.
• Advanced, 30 questions: permissions, OIDC, supply chain security.
• Expert, 40 questions: the whole path, with nothing left out.

×

See in the glossary →