8.1. Terms A–L

Action — A packaged unit of reusable steps, referenced with uses:. Comes in three types: JavaScript, Docker, composite. (§5.1.1)

Activity type — A sub-filter on a repository event, such as opened or labeled on pull_request; pull_request defaults to opened, synchronize, and reopened. (§2.1.1)

Anchor / alias / merge key — YAML &, *, and << constructs that reuse mappings within a single file; expanded by the parser before Actions sees the document. (§2.2.5)

Artifact — Files a workflow deliberately persists for download or later jobs; billed storage, default 90-day retention, immutable in upload-artifact@v4. (§2.3.1)

Artifact attestation — Signed provenance linking a built artifact to the workflow, commit, and runner that produced it; verified with gh attestation verify. (§6.1.4)

ARC (Actions Runner Controller) — Kubernetes operator that autoscales ephemeral self-hosted runners as pods. (§3.2.1)

Cache — Best-effort, key-addressed storage that speeds up rebuilds; 10 GB per repository, LRU-evicted, removed after 7 idle days. Never for data you must keep. (§2.3.1, §6.2.1)

Composite action — An action whose runs.using is composite; its steps inline into the caller's job, sharing that runner. Cannot set runs-on; needs secrets passed as inputs. (§5.1.1)

Concurrency group — A named queue limiting simultaneous runs; with cancel-in-progress: true it supersedes older runs (right for PRs, wrong for deploys). (§2.1.4, §6.2.2)

Context — A structured object exposed to expressions: github, env, vars, secrets, inputs, matrix, needs, steps, job, runner, strategy. (§2.2.6)

Deployment branch policy — An environment protection rule restricting which refs may deploy to that environment. (§2.3.3, §6.1.5)

Environment — A named deployment target holding its own secrets and variables, gated by protection rules; secrets are released only after the rules pass. (§2.3.3, §3.3.1)

Ephemeral runner — A self-hosted runner configured to accept a single job and deregister, restoring clean-state guarantees. (§3.2.1)

Expression — ${{ … }} syntax evaluated by the workflow engine before the shell runs; the root of both static-vs-runtime evaluation and script injection. (§2.2.6, §6.1.2)

fail-fast — Matrix setting, default true, cancelling all in-progress and queued variants when one fails. (§2.2.4)

GITHUB_TOKEN — An ephemeral GitHub App installation token, scoped to the current repository, revoked when the job ends; shaped by permissions:. (§6.1.1)

Immutable action — An action version published as an OCI package whose contents cannot change after release. (§5.1.2)

Job — The unit of parallelism and isolation; each runs on its own fresh runner. (§1.2.2)

Job summary — Markdown appended to $GITHUB_STEP_SUMMARY, rendered on the run's summary page. (§2.3.3)

Larger runner — A GitHub-hosted runner with more resources and optional static IP ranges. (§3.2.1)