Glossary

153 terms from CI/CD with GitHub Actions, in plain words, each with the chapter that teaches it.

Search the glossary

#

--fail (curl): A curl option that makes an error status print a short message and exit non-zero, so a pipeline step fails. `--retry` and `--retry-all-errors` try again, giving a new container time to start.
.dockerignore: A file listing what Docker should never send to the builder, like `.gitignore` does for Git. It keeps builds fast and clutter out of the image.
.gitignore: A file listing files and folders Git should never commit, such as `.venv/` and Python's cache folders.

A

act: A free tool that runs your workflows on your own computer using Docker.
action: A ready-made, reusable step that someone has published, such as `actions/checkout`. You use it in a step with `uses:`.
actionlint: A free tool that checks workflow files for mistakes on your computer before you push. If it prints nothing, it found no problems.
Actions tab: The tab on a repository's GitHub page that lists workflow runs, newest first, with a yellow dot for running, a green check for success and a red cross for failure.
actions/cache: A general-purpose action that saves and restores any folder between runs under a key you choose. Kettle & Crane uses it to keep pip's downloads.
actions/checkout: The action that copies your repository onto the runner. Without it the runner's folder is empty.
actions/setup-python: An action that installs the Python version you ask for on the runner. It can also manage the pip cache with `cache: pip`.
actions/upload-artifact: An action that saves a file or folder from a run, such as the test report, so people can download it. Its companion `download-artifact` fetches files in a later job.
always(): An expression function that is always true. Used as `if: always()`, it makes a step run even when an earlier step failed, so the test report still uploads.
ARG: A Dockerfile instruction that declares a value you can pass in while building the image, such as `APP_VERSION`.
ARN (Amazon Resource Name): Amazon's full, unique name for an AWS resource, such as the role a workflow assumes to deploy.
artifact: A file a run keeps on purpose for people or other jobs to download, such as Kettle & Crane's test report. Unlike a cache, it is not just a speed-up.
assert: A Python keyword that checks something is true; if it is false, the test fails.
AWS (Amazon Web Services): Amazon's cloud platform, offering servers, storage and many other services. A GitHub Actions workflow can deploy to it without a stored access key by using OIDC to assume an AWS role.

B

base64: A way of rewriting data as plain text. A secret printed in base64 form is no longer matched by log masking, so it appears in full.
bash -s: Starts bash reading its script from standard input instead of a file. The deploy step uses it to feed `deploy.sh` to the server over SSH without copying the file there.
branches / branches-ignore: Settings under `push` or `pull_request` that list the branches a workflow should run for, or skip. For a pull request they refer to the branch it targets.
build-args: The setting of `build-push-action` (or `--build-arg` of `docker build`) that passes a value to the Dockerfile's `ARG`, such as the commit SHA as `APP_VERSION`.
Buildx: Docker's builder, which the build-push action and the layer cache need. `docker/setup-buildx-action` sets it up on the runner.

C

cache: Files saved at the end of one run and restored at the start of the next to save time, such as pip's downloaded packages. If it is missing, the run is only slower.
cache hit / cache miss: A hit means a cache with exactly the requested key exists and is restored. A miss means none does, so the job saves a new one at the end.
cancel-in-progress: A `concurrency` setting that cancels a running run when a newer one starts in the same group. The shop uses it for CI but never for deploys.
CD (continuous delivery / continuous deployment): Continuous delivery means every passing change is packaged and ready to release at the press of a button. Continuous deployment releases it automatically.
check: A pass or fail result from a workflow, shown with a green check or red cross on a commit or at the bottom of a pull request, with a Details link to the run.
chmod 600: Command that changes a file's permissions so only its owner can read and write it. SSH refuses a private key that other users can read.
CI (continuous integration): Testing every push automatically so mistakes show up within minutes, while the change is fresh in your mind.
CMD: A Dockerfile instruction giving the command a container runs when it starts. The shop's starts gunicorn.
CodeQL: GitHub's code scanner, free for public repositories, that you add as one more workflow.
composite action: An action you write yourself from a few steps saved in an `action.yml` file. Kettle & Crane's `setup-shop` installs Python and the packages.
concurrency group: A name for a set of runs of which GitHub allows only one at a time. It can cancel outdated runs or queue deploys.
container: A running image, cut off from the rest of the machine as if it had a small computer of its own.
context: A named collection of values you can read in expressions, such as `github`, `inputs`, `secrets`, `vars`, `matrix`, `steps` and `runner`.
COPY: A Dockerfile instruction that copies files from your project into the image.
cron: A five-field format for times (minute, hour, day of month, month, day of week) used with `schedule`. For example `0 14 * * 1` is 14:00 UTC every Monday.
curl: A command that sends a web request and prints the reply. Kettle & Crane uses it to test the shop's `/health` and `/api/total` addresses.

D

debug logging: Extra diagnostic detail in a run's logs, turned on by choosing Re-run jobs and then Enable debug logging on a failed run. Re-running the run for an old version tag this way is also how a deploy can be rolled back.
default branch: The branch a repository treats as its main one (here `main`). A manual `workflow_dispatch` button and scheduled runs depend on the workflow being on it.
Dependabot: A GitHub feature that checks for new versions of actions and packages and opens a pull request for each, so your CI can test the update before you merge.
deploy.sh: The shell script that runs on the server to pull the new image, remove the old shop container and start the new one.
Docker: The most common tool for building images and running containers.
docker build / docker run: `docker build -t shop .` builds an image from the Dockerfile and names it. `docker run -p 8000:8000 --rm shop` starts a container, connects a port and deletes it when it stops.
docker pull / docker rm: `docker pull` downloads an image from a registry; `docker rm --force` stops and deletes a container. The deploy script uses both before starting the new container with `docker run --detach`.
docker/build-push-action: The action that builds an image from the Dockerfile and, with `push: true`, pushes it to a registry under the given tags.
docker/login-action: The action that logs the runner in to a registry. For GHCR it uses `github.actor` and `GITHUB_TOKEN`.
Dockerfile: The recipe for building an image, with one instruction per line run from top to bottom.
docstring: Text in triple quotes in Python code that describes what the code does.

E

ENV: A Dockerfile instruction that stores a value as an environment variable inside the image.
env:: A key that sets environment variables for a step, job or workflow. It is the safe way to pass text people write into `run:` commands, because the shell reads it as data.
environment: A named deploy target such as `staging` or `production` with its own secrets, variables and protection rules. A job joins one with `environment:`.
environment variable: A named value that a program reads from its surroundings, such as `APP_VERSION` read by the shop app.
event: Something that happens on GitHub, such as a push or a new pull request, that starts a workflow.
exclude / include (matrix): Matrix keys that remove or add single combinations. For example, exclude drops macOS with Python 3.13, and include adds Python 3.12 on Linux only.
exit code: A number a command leaves behind: 0 means success, anything else is failure. A non-zero exit code fails the step and the job.
EXPOSE: A Dockerfile instruction noting which port the app listens on.
expression: Code written `${{ ... }}` that GitHub works out and pastes in before the step runs, for example `${{ github.sha }}`.

F

fail-fast / max-parallel: Matrix settings under `strategy`. `fail-fast` (on by default) cancels the other jobs when one fails; `max-parallel` limits how many run at once.
Flask: A small Python library for building web apps, used for the Kettle & Crane shop.
fork: Someone's own copy of your repository. Workflows started by pull requests from forks get no secrets and a read-only token.
FROM: A Dockerfile instruction that picks the starting image, here `python:3.14-slim`.
function: A named piece of Python code started with `def`. A parameter is the value it is given, like `items` in `order_total`.

G

GET / POST: The HTTP methods for fetching data and for sending data. With curl, `-X POST` sets the method, `-H` adds a header and `-d` gives the body.
gh (GitHub CLI): GitHub's command-line tool, used here to start workflow runs, set secrets and variables, and view logs.
GHCR (GitHub Container Registry): GitHub's registry for container images at ghcr.io, where Kettle & Crane's images are named like `ghcr.io/kettleandcrane/shop`.
github context: The context holding facts about the run, such as the commit SHA, the branch or tag ref, the user who started it and the repository name.
GITHUB_STEP_SUMMARY: A variable holding the path of a file; Markdown appended to it shows on the run's summary page.
GITHUB_TOKEN: An access token GitHub creates for each job when it starts and cancels when it ends. What it may do is set with `permissions:`.
glob: A pattern such as `v*`, `release/**` or `**.md` that matches names. `*` matches anything except `/`, and `**` also matches `/`.
gunicorn: A web server for running Python apps in production. The shop's image uses it instead of Flask's development server.

H

hashFiles(): An expression function that turns the files matching a glob into a fingerprint that changes when their contents change. It is used to build cache keys.
Host addresses (127.0.0.1, 0.0.0.0): `localhost` (127.0.0.1) means your own computer. `0.0.0.0` tells a server to accept connections from anywhere, which gunicorn needs inside a container.
HTTP status codes: A number a web server sends back with its reply: 200 means OK, 403 forbidden (a missing permission) and 404 not found.
HTTPS: The encrypted form of the web protocol. The servers' proxy accepts HTTPS and forwards traffic to port 8000.

I

ID token: A short message signed by GitHub saying which repository, branch or environment a run belongs to. A job needs `id-token: write` to ask for one.
id:: A name given to a step so later steps can read its outputs, as in `steps.pip-cache.outputs.cache-hit`.
if:: A key on a workflow job or step that runs it only when its condition is true; otherwise it is skipped. The `${{ }}` expression wrapper is optional in its value, as in `if: always()` or `if: steps.pip-cache.outputs.cache-hit != 'true'`.
image: A package holding an operating system's basic files, Python, the shop's packages and its code, frozen together. A container is an image running.
inputs: Values given to a workflow when it is run by hand or called by another workflow, read with `${{ inputs.name }}`. Each has a type such as string, boolean, choice or number.

J

job: A list of steps that runs on one runner. A workflow holds one or more jobs, which run at the same time unless told otherwise.
job id: The name you choose for a job under `jobs:`, using letters, digits, `-` and `_`.
JSON: A text format web apps use to exchange data, such as `{"status": "ok"}`.
JUnit XML: A file format for test results that many tools can read. `pytest --junitxml=report.xml` writes the shop's test report in it.

K

key (cache): The name a cache is saved and found under. Built from `runner.os` and `hashFiles()`, it changes when the requirements change.
known_hosts: The list of servers `ssh` already trusts. `ssh-keyscan` fetches the servers' public keys to build it, so an impostor with a different key is refused.

L

layer (Docker): The saved result of one Dockerfile step. Docker reuses a layer until its files change, and the `gha` cache keeps layers between runs so unchanged steps aren't rebuilt.
least privilege: Giving each job only the access it needs, so a mistake or a bad third-party action can do little harm.
linter: A tool that reads code without running it and reports likely mistakes. The shop uses ruff.

M

mask: GitHub hides a secret's exact value in logs, showing `***`. Masking misses changed forms such as base64, so you should never print secrets.
matrix: A `strategy` setting that runs one job once for each value, or each combination of values, in its lists, such as Python versions and operating systems.

N

needs: A job key that makes the job wait for other jobs to succeed. If one fails, the dependent job is skipped.

O

OIDC (OpenID Connect): A way for a job to sign in to a cloud with a short-lived, signed ID token instead of a stored key. The cloud checks the token against rules you set up once.
outputs: Results a step reports, such as `cache-hit`, read as `steps.<id>.outputs.<name>`. Your own steps write `name=value` lines to the `GITHUB_OUTPUT` file so later steps or jobs can read them.

P

paths / paths-ignore: Settings that run a workflow only when a changed file matches (`paths`), or skip it when every changed file matches (`paths-ignore`).
permissions: A key that sets what the job's `GITHUB_TOKEN` may do, with `read` or `write` per area. Areas you don't list get no access.
pinning: Fixing an exact version. `flask==3.1.3` pins a package, and `uses:` with a full commit SHA pins an action so its tag can't be moved to new code.
pip: Python's package installer. `pip install -r requirements-dev.txt` installs everything listed in that file.
pipeline: The chain of automatic steps from a push to running software.
port: A numbered doorway on a machine where a program listens for connections. The shop listens on port 8000, and `-p 8000:8000` connects your computer's port to the container's.
private key / public key: A key pair for SSH. The private key stays secret in the workflow; the public half goes on the servers so they accept it.
production: The live system customers use, here `shop.kettleandcrane.com`.
pull_request: The event that runs when a pull request is opened, gets new commits or is reopened. It tests the result of merging into the target branch.
pull_request_target: A pull request event that runs with your repository's secrets and a write token. Never check out and run the pull request's code in it.
push: The event that runs a workflow when commits are pushed; filters can limit it to certain branches, tags or files.
pytest: The tool that runs Python tests: it finds `test_*.py` files, runs functions named `test_*` and reports results.

R

ref: The full name of the branch or tag a run is for, such as `refs/heads/main` or `refs/tags/v1.0.0`.
registry: A server that stores images so other machines can download them, the way GitHub stores repositories.
required reviewer: A person who must approve before a job targeting an environment starts. Sam approves production, and Prevent self-review stops whoever started the run from approving it.
required status check: A check that must pass before a pull request can merge, set in a ruleset. The check name must match the job name exactly.
requirements.txt: Files listing the Python packages and their pinned versions. `requirements.txt` is what the app needs to run; `requirements-dev.txt` adds pytest and ruff.
restore-keys: A fallback list for `actions/cache`: on a miss, the newest cache whose key starts with one of these prefixes is restored, even if somewhat out of date.
retention-days: An input of `upload-artifact` saying how long GitHub keeps the artifact (default 90 days).
reusable workflow: A workflow with the `workflow_call` trigger that other workflows call as a job, sharing whole jobs such as test or deploy.
reverse proxy: A program in front of the app, such as Caddy or nginx, that accepts HTTPS from the internet and forwards the traffic to the app's port 8000.
role (AWS): A set of AWS permissions a run can borrow. Its trust condition says which tokens may use it, for example only the shop's `main` branch.
roll back: Deploying the last good version again after a bad release, for example by re-running the old tag's run.
ruff: A fast Python linter. `ruff check .` checks every Python file and exits 0 when nothing is wrong.
ruleset: A set of rules for branches or tags set in a repository's Settings. Kettle & Crane's ruleset on `main` requires pull requests and passing checks.
run: / uses:: The two ways a step does work: `run:` gives shell commands, and `uses:` runs an action. At job level `uses:` calls a reusable workflow.
runner: The computer that runs a job. GitHub-hosted runners are fresh virtual machines created for one job and thrown away after it.
runner context: The context describing the machine running the job, such as `runner.os` (`Linux`).
runs-on: A job key choosing the runner. `ubuntu-latest` asks for a machine running Ubuntu Linux.

S

schedule: An event that starts a workflow at set times written in cron syntax. It uses UTC and the default branch's latest commit.
script injection: An attack where untrusted text, such as a pull request title put inside `run:` through `${{ }}`, runs as commands. Pass such text through `env:` instead.
secret: An encrypted value stored in repository or environment settings and given only to workflow runs, read with `${{ secrets.NAME }}`. Logs mask its exact value.
secrets: inherit: A line in a calling job that passes all the caller's secrets on to the reusable workflow it calls.
self-hosted runner: A runner on your own machine. It should never be used for public repositories, where a stranger's pull request could run code on it.
set -euo pipefail: A line at the top of a shell script that makes it stop at the first failing command, treat unset variables as errors and fail pipes when any command in them fails.
SHA: A commit's unique ID, a long hash. The shop tags each image with it, and pinning an action to a full SHA means it always refers to the same files.
shell: bash: A setting naming which shell runs a step. Every `run:` step in a composite action must have it.
smoke test: A quick check that a fresh deploy is alive, such as curling the shop's `/health` address.
SSH: A way to log in to another computer securely. The runner uses it to run the deploy script on the servers; `ssh-keygen` makes a key pair.
staging: A staff-only copy of production at `staging.kettleandcrane.com`, used to check a change before customers see it.
startsWith(): An expression function true when the first text begins with the second. Production deploys only when `github.ref` starts with `refs/tags/v`.
step: One `run:` command or `uses:` action in a job. Steps run in order, and a failing one stops the job.
steps context: The context holding earlier steps' results, such as `steps.pip-cache.outputs.cache-hit`.
sub claim: The part of an OIDC token naming where the run came from, such as `repo:kettleandcrane/shop:ref:refs/heads/main`. The cloud's trust condition matches against it.

T

tag (Git): A label on a commit, such as `v1.0.0`. Pushing a `v*` tag releases to production at Kettle & Crane.
tag (image): The label after the colon in an image's name that picks one version of it. The shop tags images with the commit SHA.
test: Code that runs your code and checks the result, for example that an order of exactly $50 ships free.
timeout-minutes: A job setting giving a time limit; a job running longer is canceled and marked failed. The default is 360 minutes.

U

UTC: The world time standard in which cron schedules are written. 14:00 UTC is 7 a.m. in Portland in summer.

V

variable: A plain, non-secret setting stored in repository or environment settings, read with `${{ vars.NAME }}`. Unlike secrets, variables show in logs and can be read back.
virtual environment: A folder holding its own Python and packages for one project, so they stay apart from everything else on your computer.

W

wait timer: An environment rule that delays a deploy job by a set number of minutes. Waiting doesn't use runner minutes.
with:: A key that passes inputs to an action or reusable workflow, such as `python-version` for `setup-python`.
WORKDIR: A Dockerfile instruction that sets the current folder inside the image, creating it if needed.
workflow: A YAML file in `.github/workflows/` that says which event starts it and which jobs to run.
workflow_call: The trigger that makes a workflow reusable: it runs only when another workflow calls it, and it declares inputs and optionally secrets.
workflow_dispatch: The trigger that lets you start a workflow by hand, with a Run workflow button or `gh workflow run`, and optionally asks for typed inputs.

Y

YAML: A plain text format for settings that workflows are written in. It uses `key: value` pairs, two-space indentation (never tabs) and `- ` for list items.
yamllint: A tool that checks YAML syntax, used to validate `dependabot.yml`, which actionlint doesn't read.