2.4. Reflection Checkpoint

Key Takeaways

• Triggers are three decisions at once: which event (plus activity types and branch/path filters), how much authority (permissions: — declaring any scope revokes the rest), and how many concurrent runs (concurrency: with or without cancel-in-progress).
• workflow_dispatch inputs support string/boolean/choice/environment; workflow_call inputs support only string/number/boolean, and secrets must be mapped explicitly or with secrets: inherit. A reusable workflow is called by a job, never a step.
• Jobs run in parallel until needs: orders them; failure skips downstream jobs unless you override with always() / failure() / cancelled() and needs.<job>.result.
• fail-fast defaults to true; include adds variables or whole combinations while exclude removes them; matrices cap at 256 jobs.
• Anchors and aliases are parser-level and single-file only. Contexts are the run's data model, and ${{ }} is substituted before the shell runs — the root of both static-vs-runtime evaluation and script injection.
• Persistence is deliberate: $GITHUB_ENV/$GITHUB_OUTPUT between steps, job outputs (strings, secret-redacted) between jobs, artifacts for files (immutable in v4, 90-day default retention), and caches purely as an evictable optimization.

Connecting Forward

Phase 3 lifts every one of these decisions from a single repository to an entire organization: who is allowed to use which actions, which runners the work lands on and who may reach them, and how secrets and variables are scoped, layered, and rotated across org, repository, and environment.

Self-Check Questions

• A workflow sets permissions: {packages: write} to publish a container, and its previously working git push step now fails with 403. Explain the mechanism and give the fix in one line.
• Distinguish, precisely, when you would reach for a YAML anchor, a composite action, and a reusable workflow — using "how far must this reuse travel?" as your organizing question.
• A matrix job writes steps.meta.outputs.sha and sets it as a job output; a downstream job reads needs.build.outputs.sha and gets an unpredictable value. What is happening, and what's the correct pattern?