2.3.3. Job Summaries, Badges, and Environment Protections

💡 First Principle: A workflow's most valuable output is often communication — a readable report, a public signal of health, a gate that pauses for a human — and Actions provides a purpose-built mechanism for each.

Job summaries turn a run into a report. Append Markdown to $GITHUB_STEP_SUMMARY and it renders on the run's summary page, above the logs — tables of test results, coverage deltas, deployed URLs, anything a reader shouldn't have to dig through logs for:

- run: |
    {
      echo "## Test Results"
      echo "| Suite | Passed | Failed |"
      echo "|:------|-------:|-------:|"
      echo "| unit  | 412    | 0      |"
    } >> "$GITHUB_STEP_SUMMARY"

Each step gets its own summary buffer (up to 1 MiB), and the buffers are concatenated in step order for the job.

Status badges publish workflow health into the README with a predictable URL — https://github.com/OWNER/REPO/actions/workflows/WORKFLOW-FILE/badge.svg, optionally with ?branch= and ?event= parameters to pin the badge to what you actually care about. A badge with no parameters shows the most recent run on the default branch, which is why a badge can look green while a release branch is broken.

Environments are the gate mechanism, and they carry three protection rules: required reviewers (up to six, any of whom can approve — the job waits, deployment-pending, for up to 30 days), a wait timer (a forced delay before the job proceeds), and deployment branch policies (only refs matching your rules may deploy to this environment). A job opts in with a single key:

jobs:
  deploy:
    environment:
      name: production
      url: https://app.example.com
    runs-on: ubuntu-latest

Environments also hold their own secrets and variables — and this is the load-bearing point Phase 3.3 develops: those secrets are released to the job only after every protection rule passes.

⚠️ Exam Trap: Environments are not just a label for organizing secrets — they are an approval gate. If a scenario needs "a human must approve before production credentials are used," the answer is an environment with required reviewers holding the secrets, not a repository secret plus a manual trigger.

Reflection Question: A README badge shows green while production is broken. Name two badge-URL parameters that would have prevented the false reassurance, and say what each pins.