CI/CD — cheat sheet

A one-page lookup for the YAML keys and expressions used across this course. Grouped by task; the course pages cover the why behind each one — this page is just the what.

Triggers (on:)

Key	Fires on
on: push	A commit lands on a branch (or tag)
on: pull_request	A PR is opened/updated against a target branch
on: schedule	A cron expression, on a timer
on: workflow_dispatch	A human clicks "Run workflow"

Filter	Narrows the trigger to
branches: / tags:	Specific branches or tags only
paths:	Pushes that touch specific files/directories only

Jobs & steps

Key	Meaning
jobs:	Top-level map of job IDs — every job starts in parallel unless needs: says otherwise
needs: <job-id>	Wait for that job to succeed before starting
steps:	A job's ordered, always-sequential list — all steps share the one runner and its filesystem
uses:	Run a pre-built, version-pinned action
run:	Run a raw shell command on the runner

Secrets & variables

Key	Meaning
${{ secrets.NAME }}	A secret — encrypted at rest, masked automatically in logs
${{ vars.NAME }}	A plain variable — stored and logged as plain text, never for anything sensitive
permissions:	Scopes what the auto-issued, short-lived GITHUB_TOKEN can read/write this run

Secret scope	Visible to
Organization	Every repo it's shared with
Repository	This repo's jobs only
Environment	Only a job that declares that exact environment:

Environments

Key	Meaning
environment: <name>	Gate this job behind the named environment (e.g. staging, production)

Protection rule	What it does
Required reviewers	Pauses the job until someone approves
Wait timer	Mandatory delay before the job may start
Environment secrets	Only visible to jobs targeting that environment

Artifacts & images

Task	Mechanism
Hand a file from one job to another	Upload it as an artifact in the producing job, download it in the consuming job
Hand a container image from build to deploy	build pushes it to a registry, deploy pulls it from that same registry
Pass data between steps in the same job	Nothing needed — steps already share one runner's filesystem

How this connects

The triggers page covers on:/filters and the push-vs-pull_request trust distinction, the jobs & steps page covers needs: and the uses:/run: split, the secrets & environments page covers scoping and GITHUB_TOKEN, and the build → test → deploy page covers the full job graph these pieces assemble into.