GitHub Foundations — knowledge map
The 212 core concepts of GitHub Foundations and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (212)
GitHub
A service that hosts Git repositories in the cloud and adds collaboration features like Pull Requests, Issues, review, and Actions.
Repository
The container holding a project files and its full history/metadata; physically the hidden .git folder.
GitHub Actions
A workflow platform for automating CI/CD; defined as YAML in .github/workflows and run on runners.
Prerequisites: YAML
Encrypted secrets and variables (secrets / vars)
Store sensitive values as secrets (secrets.<name>) and non-sensitive config as variables (vars.<name>); scoped at org/repo/environment, with the narrower scope winning (environment > repo > org). Managed via REST API (writes are public-key encrypted).
Related: Environment and protection rules
Workflow
An automation process defined as a YAML file under .github/workflows/; declares triggers in on: and runs one or more jobs.
Prerequisites: YAML
Job
A unit of execution in a workflow; selects a runner via runs-on and runs a sequence of steps. Jobs run in parallel by default, each in an isolated environment.
Related: runs-on
Issue
Tracks and discusses bugs/requests/tasks one at a time; integrates with Labels/Assignees/Milestones.
Commit
A snapshot of changes at a point in time, identified by a unique hash (SHA) computed from its content.
Branch
A movable reference for a parallel line of development; branch a feature off main to work.
Contexts
Objects to access runtime metadata—github, env, vars, secrets, inputs, matrix, needs, runner, job, steps, etc.
Prerequisites: needs (job dependency)
merge
Integrating while preserving both histories with a merge commit; history shows what happened.
Runner
The environment that runs Actions jobs; GitHub-hosted or self-hosted.
Environment and protection rules
A unit representing a deploy target; supports required-reviewer approval, a wait timer, deployable-branch restrictions, and environment-scoped secrets/variables—gating production deploys.
permissions (token scope)
A key declaring the GITHUB_TOKEN’s permissions; default to least privilege (e.g., contents: read) and elevate only jobs needing writes. Grant id-token: write when using OIDC.
Related: GITHUB_TOKEN
Step
An individual task composing a job; run: executes a shell command and uses: invokes an action. Steps run top to bottom.
Code review (Pull Request)
Commenting on a diff in a Pull Request and approving or requesting changes; required reviews and CODEOWNERS-required reviewers enforce quality before merge.
Prerequisites: CODEOWNERS、Environment and protection rules、merge
GitHub Advanced Security (GHAS)
A set of features protecting code, secrets, and dependencies across the SDLC. In late 2024 it was reorganized into two independent, separately licensed products—Code Security (CodeQL/code scanning) and Secret Protection (secret scanning/push protection). Dependabot and dependency/supply-chain features are free. Public repos are largely free; private/Enterprise require a product license.
Prerequisites: Dependabot、Encrypted secrets and variables (secrets / vars)、Code Security、Secret Protection
Related: Code scanning
Issue templates
A predefined form shown when creating a new issue. Beyond the older Markdown-based format, YAML-defined issue forms add structured inputs (text fields, dropdowns, checkboxes), letting you require fields and auto-apply labels to standardize submissions. Stored under `.github/ISSUE_TEMPLATE/`.
Prerequisites: inputs (workflow inputs)、GitHub、Issue、Markdown
Related: Assignee、Labels (GitHub)
Labels (GitHub)
A tagging feature attached to issues and pull requests to classify by type, priority, or status. Colors and descriptions are freely defined, and labels can be filtered with the label: search qualifier or used as Actions trigger conditions. Repos/orgs ship with default labels (bug, enhancement, etc.).
Prerequisites: GitHub Actions、GitHub、Issue、Pull Request (PR)
Related: Assignee、Issue templates
LICENSE
A file stating terms for use/modify/redistribute; a public repo with none defaults to all rights reserved.
Prerequisites: Repository
Pull Request (PR)
A proposal to merge a work branch (compare) into the default branch (base), merged after review and checks.
Branch protection rule
A setting that enforces required reviews/checks/conversation resolution and can block direct pushes before merge.
Prerequisites: Branch、Code review (Pull Request)、Environment and protection rules、push / pull_request events
Dependabot
Alerts on vulnerable dependencies and auto-opens PRs for security/version updates.
strategy.matrix
Auto-expands one job definition into multiple variations (OS×version, etc.); add with include and drop with exclude.
Prerequisites: Job
Related: include / exclude (matrix)
needs (job dependency)
A key controlling job order; needs: [A, B] declares "run after A and B complete." It is also the path to read prior jobs’ outputs.
Prerequisites: Job
push / pull_request events
Core CI events triggered by code pushes or PR open/update; narrow scope via branches/paths (and *-ignore) filters.
workflow_call (reusable workflow)
A trigger declaration that lets other workflows call it via uses:; callers pass with: inputs and secrets: (inherit allowed) and can read outputs.
Prerequisites: Encrypted secrets and variables (secrets / vars)、Workflow
Related: secrets: inherit、inputs (workflow inputs)
GitHub Enterprise Server (GHES)
The self-hosted edition of Enterprise, deployed on an organization's own data center or private cloud. Keeping data in-house helps meet compliance requirements, but features arrive via periodic feature releases and some cloud-only capabilities (e.g., certain security features) can lag or be unavailable. Administrators operate their own upgrades and backups.
Prerequisites: GitHub Enterprise、Organization、Releases
Organization
An organization account that centrally manages members and repositories, with Teams, billing, and permissions.
Related: Team
Team
A unit grouping members within an organization to grant repo permissions; can be nested, inheriting the parent.
Prerequisites: Repository
Related: Organization
YAML
A human-friendly text format that expresses hierarchy through indentation. Favored for CloudFormation and other IaC tools and CI/CD pipeline config files, and interconvertible with JSON representing the same data.
Prerequisites: JSON
Dependency graph
Parses manifests/lockfiles to list the packages a repo depends on, including transitive dependencies; it underpins Dependabot alerts and Dependency Review.
Prerequisites: Dependabot、Dependabot alerts and security updates、Dependency Review、Repository
GitHub Enterprise
For large organizations: groups multiple orgs centrally; comes as Cloud (GitHub-hosted) and Server (self-hosted).
Prerequisites: GitHub、Organization
fork
Copying a repository into your own account on GitHub; the start of contributing to OSS.
Prerequisites: GitHub、Repository
Fine-grained PAT
A Personal Access Token with fine-grained permissions, repo scope, and expiry. Issue with least privilege + expiry, revoke on leak; orgs can require approval/restrict it.
Prerequisites: Policies (member capabilities)、permissions (token scope)、Issue、Personal Access Token (PAT)
GitHub Support
The channel for outages, bugs, and GHES system failures that admins can’t resolve via settings/permissions. First triage issues into "admin-solvable" vs "Support case."
Prerequisites: permissions (token scope)、GitHub、GitHub Enterprise Server (GHES)、Issue
Ruleset
Guardrails that enforce branch protection, required reviews, and required status checks across orgs. A layer distinct from policies (member capabilities), governing code changes.
Prerequisites: Branch、Branch protection rule、Code review (Pull Request)
GitHub usage metrics
Reports that surface consumption—Actions minutes, Packages/Codespaces storage, and license (seat) usage—for billing and optimization, viewed in enterprise/organization billing and usage reports.
Prerequisites: GitHub Actions、GitHub Codespaces、License (seat)、Usage report
Code Security
The core of GitHub's Code Scanning feature, which statically analyzes (SAST) source code to detect vulnerabilities; the default engine CodeQL builds a code database and uses dataflow analysis (source→sink) to find dangerous paths (third-party SAST tools can also be integrated). Note that "GitHub Code Security" is a subscription product plan introduced in 2025 (bundling Code Scanning, Copilot Autofix, etc.), not a rename of the Code Scanning feature itself.
Prerequisites: Code scanning、Autofix (Copilot Autofix)、Dataflow analysis (source→sink)、GitHub
Assignee
One or more users assigned as responsible for an issue or pull request. Filterable with the assignee: search qualifier, and used to surface a person's own tasks in notifications and dashboards. Distinct from a reviewer, who is asked to review the change's content rather than own the work item.
Prerequisites: Pull Request (PR)
Related: Issue templates、Labels (GitHub)、Issue、Search qualifiers
Releases
Publishes a specific version tied to a tag, with release notes and assets.
Code scanning
Statically analyzes code (e.g., CodeQL) to find vulnerabilities and bugs (GHAS).
Related: GitHub Advanced Security (GHAS)
Actions cost optimization
Reducing Actions consumption via paths/branches filters, concurrency, caching, minimizing matrices, and right-sizing runners—cutting waste without lowering quality.
Prerequisites: GitHub Actions、Cache (actions/cache)、concurrency、strategy.matrix
Policies (member capabilities)
Org/enterprise settings governing what members can do (repo creation, visibility, forking, Actions usage, enabling GHAS, etc.). Enterprise policy cascades to lower orgs/repos—a separate layer from rulesets (guardrails on code changes).
Prerequisites: fork、Ruleset、Repository、Visibility (Public/Private/Internal)
inputs (workflow inputs)
Parameters received via workflow_dispatch or workflow_call; define type (string/boolean/choice/number/environment), required, default, options, and read via inputs.<name>.
Prerequisites: Workflow
Related: workflow_dispatch、workflow_call (reusable workflow)
Larger runners
GitHub-hosted runners with more CPU/memory or static IP ranges; used for fixed-IP needs or heavy jobs.
Prerequisites: GitHub-hosted runner、Job、needs (job dependency)、GitHub
on: (trigger declaration)
The key that declares the events triggering a workflow—push, pull_request, schedule, workflow_dispatch, repository_dispatch, workflow_call, etc.
Prerequisites: push / pull_request events、repository_dispatch、schedule (cron)、Workflow
GitHub Desktop
A desktop app to handle commits, branches, and Pull Requests via a GUI; enables Git work without the command line.
Prerequisites: Branch、Commit、GitHub、Pull Request (PR)
Markdown
A lightweight formatting syntax (.md) used widely in Issues, PRs, comments, and READMEs.
Prerequisites: Issue
Related: README
Secret scanning
Detects API keys/tokens in commits/pushes; push protection blocks leaks up front.
Prerequisites: Commit
Star
Bookmarks a repository (saved to your Stars list) and signals interest; it does not notify you.
Prerequisites: Repository
GitHub Codespaces
On-demand cloud dev environments usable from a browser/editor; define the env as code with devcontainer.json.
GitHub Copilot
AI coding assistance across IDEs, the CLI, and GitHub.com; humans must review and decide on suggestions.
Prerequisites: GitHub
GitHub Connect
Links GitHub Enterprise Server/Cloud with GitHub.com to enable license sync, unified search, and using Actions from the server.
Prerequisites: GitHub Actions、GitHub Enterprise、GitHub、GitHub Enterprise Server (GHES)
License (seat)
A per-user allocation. Monitor license usage and reclaim unused seats; with SCIM/EMU, departed users’ seats free up automatically.
Prerequisites: SCIM (provisioning)、LICENSE
Action types (JavaScript/Docker/composite)
Three types: JavaScript (Node.js, cross-platform, fast), Docker container (bundles an environment but Linux-runner only, slower start), and composite (a bundle of steps).
Prerequisites: Composite action、Environment and protection rules、Step、Runner
Cache (actions/cache)
Saves/restores regenerable data (e.g., dependencies) by key to speed up builds; restore-keys allows partial-match restore. Differs in purpose from artifacts (outputs to keep).
Prerequisites: GitHub Actions、Artifact
env: (environment variables)
A key defining environment variables at workflow/job/step levels; narrower scopes take precedence.
Prerequisites: Secret scope (env > repo > org)、Environment and protection rules、Job、Step
GitHub-hosted runner
An ephemeral VM that GitHub provisions, updates, and tears down; clean per job, suited to general CI. Usage-billed (with free minutes).
GITHUB_TOKEN
A temporary, scoped credential auto-issued per workflow run; scope it to least privilege via permissions (e.g., contents: read) and elevate only jobs needing writes. Avoid long-lived PATs.
Related: permissions (token scope)
schedule (cron)
A trigger for periodic runs via a cron expression; cron is UTC-based with minimum-interval limits and load delays, and stops if the repo is inactive.
Prerequisites: Expressions (${{ }})、Repository
Toolcache
A mechanism to check preinstalled language runtimes/tool versions on GitHub-hosted runners; consult alongside runner image release notes.
Prerequisites: Cache (actions/cache)、GitHub-hosted runner、GitHub、Releases
.github/workflows
The default directory holding workflow YAML in a repository; YAML placed here is recognized as Actions.
Prerequisites: GitHub Actions、Workflow、GitHub、Repository
Prevention-first and gate-based
Prevention-first keeps problems from entering at the source (e.g., Push Protection). Gate-based blocks vulnerable items via required checks before merge/deploy (required Code Scanning/Dependency Review). Not exclusive—combine in layers.
Prerequisites: Code scanning、push / pull_request events、merge、Secret scanning
Related: Dependency Review
Secret Protection
Formerly secret scanning. Detects/blocks secrets (API keys, tokens) committed or about to be committed. Enabled at repo/org. Since a leaked secret remains in history, revoking (rotating) the token is mandatory.
Prerequisites: Commit、Encrypted secrets and variables (secrets / vars)、Repository、Secret scanning
Supply chain security
An umbrella concept for securing the software supply chain (dependencies and artifacts). On GitHub it encompasses the dependency graph, Dependabot (alerts and updates), dependency review, and SBOM export, covering transitive dependencies as well as direct ones.
Prerequisites: Dependabot、Dependency graph、Dependency Review、SBOM (Software Bill of Materials)
GitHub Marketplace
A marketplace to find and install apps and Actions workflows that integrate with GitHub, extending capabilities like CI/CD and code quality.
Prerequisites: GitHub Actions、Workflow、GitHub
GitHub Projects
A flexible planning/tracking tool spanning issues and pull requests (Projects v2). It offers board/table/roadmap views, custom fields, and built-in automation.
Prerequisites: GitHub、Issue、Pull Request (PR)
GitHub App
A first-class actor for automation and integrations on GitHub. It installs per-repository and grants only the fine-grained permissions it needs, making it the recommended least-privilege choice for automation and integration development over an OAuth App. It calls the API as an installation rather than as a user, and gets its own bot identity.
Prerequisites: needs (job dependency)、permissions (token scope)、GitHub、Repository
Related: OAuth App
GitHub Enterprise Cloud (GHEC)
The GitHub-hosted cloud edition of the Enterprise plan. GitHub operates the infrastructure, and new features and security updates typically land here before the self-hosted edition (GHES). A data residency option lets an org choose the storage region.
Prerequisites: GitHub Enterprise、GitHub、GitHub Enterprise Server (GHES)
Related: Data Residency
GitHub Mobile
The official phone app to check notifications and triage/review Issues and PRs; Copilot Chat is also available on mobile.
Prerequisites: Copilot Chat、GitHub、Issue
GitHub Packages
Hosts packages (npm, Maven, NuGet, RubyGems, and containers via GitHub Container Registry / GHCR) close to the repo; permissions integrate with GitHub auth and Actions can publish/consume them.
Prerequisites: GitHub Actions、permissions (token scope)、GitHub、Repository
OAuth App
An integration method that acts on behalf of a user against GitHub. At authorization the user grants a chosen scope, and the app then operates with that user's permissions—so, unlike a GitHub App, it cannot be scoped down per repository with fine-grained permissions. It is also distinct from a PAT (Personal Access Token), a user's own simple token.
Prerequisites: permissions (token scope)、GitHub、Personal Access Token (PAT)、Repository
Related: GitHub App
README
The entry-point description of a project (overview, usage, contributing); written in Markdown.
Related: Markdown
Remote (origin)
A named reference to where a repository is stored; the clone source defaults to origin.
Prerequisites: clone、Repository
clone
Copying an existing repository, with its history, to your machine (git clone).
Prerequisites: Repository
GitHub Discussions
A space for conversations like questions and ideas; use Issues to track work.
gh CLI
The official command-line tool to work with Issues, PRs, and repos from the terminal (uses the API).
Prerequisites: Issue、Repository
Deployment scenarios (GHEC/EMU/Data Residency/GHES)
Deployment options chosen by requirements: GHEC with EMU (fully managed IDs), GHEC with Data Residency + EMU (pinned data location), GHEC with personal accounts, and GHES (fully self-hosted).
Prerequisites: GitHub Enterprise Cloud (GHEC)、GitHub Enterprise Server (GHES)、Managed services (management boundary)
Related: Data Residency
Identity provider (IdP)
A corporate auth platform (Entra ID, Okta, etc.) that handles authentication via SAML SSO and, combined with SCIM/team sync, centrally manages accounts and groups.
Prerequisites: SCIM (provisioning)、Team synchronization、Team
Metered billing
Products billed by consumption on top of per-seat fees—Actions minutes, storage, Packages, Copilot, GHAS, etc. Use usage reports to find heavy-consuming orgs/repos.
Prerequisites: GitHub Actions、License (seat)、GitHub Advanced Security (GHAS)
Related: Usage report
Secret scope (env > repo > org)
Secrets are scoped at org, repository, and environment levels; on name clashes the narrowest scope wins (env > repo > org). Limit which repos can use org secrets, and centralize shared credentials at org level for easy rotation.
Prerequisites: Environment and protection rules、Encrypted secrets and variables (secrets / vars)、Repository
Composite action
An action bundling multiple steps (run: and other actions’ uses:); invoked as a single step via uses: in a workflow.
Prerequisites: GitHub Actions、Step、Workflow
Configuration variables
Non-secret settings defined at repo/environment/org level and read via the vars context; use secrets for sensitive values (variable values can appear in logs).
Prerequisites: Contexts、Environment and protection rules、Encrypted secrets and variables (secrets / vars)、Repository
github context
A context holding event/repository info; reference github.ref (branch/tag) or github.event (event payload).
Prerequisites: Branch、Contexts、GitHub、Repository
Job outputs
Maps step outputs to a job’s outputs so dependent jobs read needs.<job>.outputs.<name>; passes short values to another job.
Prerequisites: $GITHUB_OUTPUT、Job、needs (job dependency)、Step
Self-hosted runner
A runner where you install and register the runner app on your own machine/cloud; for special hardware, internal-network access, or large caches. State can persist, so use on public repos is risky.
Prerequisites: Cache (actions/cache)、Repository、Runner
SHA pinning
Referencing a third-party action via uses: owner/repo@<full commit SHA>; since tags are reassignable, an immutable SHA is safest against tampering. Avoid floating refs like @main.
Prerequisites: Commit、Repository
Starter workflow
A scaffold (template) for creating new workflows; placed under workflow-templates in the org .github repo for members to copy. Independent after copy—original updates don’t propagate.
Prerequisites: Workflow、GitHub、Repository、Star
workflow_dispatch
A manual trigger from UI/API/CLI; define inputs with type/required/default/options to accept parameters at start.
Related: inputs (workflow inputs)
YAML anchors / aliases
A YAML feature to reuse repeated fragments within one file (anchor &, alias *, merge key <<); expanded by the parser before evaluation. Not for cross-file sharing (use reusable workflows for that).
Prerequisites: Workflow、workflow_call (reusable workflow)、merge、YAML
Agent Mode
Given a goal, autonomously iterates plan → edit → verify via build/test → fix, deciding which files and commands it needs.
Prerequisites: needs (job dependency)
Copilot Chat
A conversational surface to ask questions and request code generation, explanation, fixes, and tests in natural language; you can pass a selection or file as context.
Prerequisites: Contexts
Dependabot alerts and security updates
Dependabot alerts notify of known dependency vulns (Advisory/CVE); security updates auto-create PRs to safe versions; version updates keep deps current regardless of vulns (the two differ).
Prerequisites: Dependabot
Dependency Review
A gate-based prevention that inspects a PR’s added/updated dependency diff before merge and blocks vulnerable deps or disallowed licenses; can be a required check.
Prerequisites: merge
Related: Prevention-first and gate-based
Git
The most popular distributed version control tool; each person keeps a full local copy of the history.
Prerequisites: Distributed version control、Version control system (VCS)
github.dev
An in-browser lightweight editor opened by pressing "." on a repo; it has no compute.
Prerequisites: GitHub、Repository
GitHub Flow
A lightweight pattern: branch → commit → PR → review → merge → deploy; keep main always deployable.
.gitignore
A file listing files/patterns to exclude from tracking (build outputs, dependencies, secrets).
Prerequisites: include / exclude (matrix)、Encrypted secrets and variables (secrets / vars)
HEAD
A reference to the currently checked-out branch/commit—your current position.
Milestone
Groups issues/PRs by release/deadline and shows completion and due dates.
Prerequisites: Releases
Related: Issue
Personal Access Token (PAT)
A scope-limited token used instead of a password for Git auth (fine-grained recommended).
rebase
Replaying your commits onto the target branch tip to linearize history; careful when shared.
Staging area (index)
Where you place the changes to include in the next commit; added with git add.
Prerequisites: Commit、include / exclude (matrix)
Code of conduct
A document defining expected behavior for community participants and how violations are handled; with CONTRIBUTING and a license it supports healthy OSS governance.
Prerequisites: LICENSE
CODEOWNERS
A file that auto-requests reviewers when a PR changes specific paths.
Distributed version control
A model where each developer holds a complete copy of the history, so committing and browsing work offline.
Prerequisites: Commit、Version control system (VCS)
GitHub Docs
The official documentation covering how features work—the primary source to check first.
Prerequisites: GitHub
Enterprise Managed Users (EMU)
Dedicated users a company manages centrally via its identity provider; separate from personal accounts.
Prerequisites: Identity provider (IdP)
Custom repository role
A custom repository role bundling only the needed permissions when the built-in Read–Admin levels don’t fit—useful for least privilege.
Prerequisites: permissions (token scope)、Repository
Related: Repository roles
Data Residency
Storing GitHub data in a specific geographic region (GHEC with Data Residency), used to meet regulatory/compliance requirements.
Prerequisites: GitHub
Related: Deployment scenarios (GHEC/EMU/Data Residency/GHES)、GitHub Enterprise Cloud (GHEC)
Repository roles
Per-repo access levels—Read / Triage / Write / Maintain / Admin—plus custom repository roles for fine-grained control. Assign by team, not per individual.
Prerequisites: Repository、Team
Related: Custom repository role
SCIM (provisioning)
Syncs IdP user create/update/delete to GitHub, auto-provisioning/deprovisioning accounts. A user disabled in the IdP is auto-removed from GitHub, preventing leftover access—distinct from SAML (authentication).
Prerequisites: GitHub
SECURITY.md
A file publishing a repository’s security reporting process (where to report vulnerabilities and the response policy), clarifying where finders should report.
Prerequisites: Repository
Support bundle / diagnostics
A set of diagnostics GHES generates, provided to GitHub Support for investigating cases (outages, bugs, system failures).
Prerequisites: GitHub Support、GitHub、GitHub Enterprise Server (GHES)
Team synchronization
Maps IdP groups to GitHub team membership and auto-reflects group changes into teams, centralizing group management in the IdP; can conflict with manually added GitHub members.
Usage report
A report showing metered consumption by org/repo and trend, used for budgeting, chargeback, and cost-optimization decisions.
Prerequisites: Repository
Related: Metered billing
Action input (INPUT_/getInput)
How to read with:-passed inputs inside an action—via the INPUT_<NAME> env var, or @actions/core getInput in JavaScript actions.
Prerequisites: GitHub Actions、Action types (JavaScript/Docker/composite)、inputs (workflow inputs)
Action use policy
An org/enterprise setting governing which actions can run: disable all / allow all / GitHub-authored only / GitHub + verified / an allow list of specific actions. Can also require SHA pinning for external actions.
Prerequisites: GitHub Actions、SHA pinning、GitHub
Artifact
Stores files (build outputs, test reports) against a run; save with upload-artifact, fetch with download-artifact. Auto-deleted after retention. The standard way to pass files between jobs.
Prerequisites: Job
Related: Retention
Expressions (${{ }})
Expressions evaluated inside ${{ }} for if: and value interpolation; mind static (parse-time) vs runtime evaluation and never leak secrets into expressions/logs.
Prerequisites: Encrypted secrets and variables (secrets / vars)
Fork-PR run approval
A setting requiring approval before Actions first run on a PR from an external fork; prevents unreviewed external-code execution and secret abuse.
Prerequisites: GitHub Actions、fork、Encrypted secrets and variables (secrets / vars)
$GITHUB_OUTPUT
A special file to set a step output; write echo "name=value" >> "$GITHUB_OUTPUT" and read within the job via steps.<id>.outputs.<name>. For passing short values.
if (conditional) and status functions
Controls whether a job/step runs via an expression; status functions success()/failure()/cancelled()/always() express failure-only, always, etc.
Prerequisites: Expressions (${{ }})、Job、Step
Immutable actions
Makes a released action version unchangeable so a referenced version cannot be swapped later; with SHA pinning, strengthens supply-chain safety.
Prerequisites: GitHub Actions、SHA pinning、Releases
include / exclude (matrix)
include adds a specific matrix combination (or attaches values); exclude drops unneeded combinations.
Related: strategy.matrix
IP allow list
An org setting accepting access only from approved IP ranges; since GitHub-hosted source IPs vary, combine with larger runners’ static IPs or self-hosted for fixed IPs.
Prerequisites: Larger runners、GitHub、Runner
paths / branches filters
Filters narrowing what triggers push/pull_request; paths/paths-ignore by file and branches/branches-ignore by branch, avoiding unneeded runs to save cost.
Prerequisites: Branch、push / pull_request events
Runner group
A unit grouping self-hosted runners to control which orgs/repos may use them; can restrict a sensitive runner to specific repos.
Prerequisites: Self-hosted runner、Repository、Runner
runs-on
The key selecting the runner for a job; specify a GitHub-hosted label like ubuntu-latest or a self-hosted label.
Related: Job
secrets: inherit
A setting by which a reusable-workflow caller forwards all of its secrets at once.
Prerequisites: Encrypted secrets and variables (secrets / vars)、Workflow
Related: workflow_call (reusable workflow)
Status badge
An SVG badge in the README that shows at a glance the latest result (pass/fail) of a workflow for a given branch/event.
Workflow commands
Special output commands to interact with the runner—log annotations (::notice::/::warning::/::error::), secret masking (::add-mask::), log folding (::group::).
Prerequisites: Annotations、Workflow、Runner
Inline suggestions
Suggests a grayed-out "continuation" from the cursor context; not applied to the code until accepted (confirmed).
Prerequisites: Contexts
GitHub Security Advisory (GHSA)
Vulnerability info in the GitHub Advisory Database backing Dependabot detection. A repository security advisory lets you fix a vulnerability in your own project privately and then publish it.
Prerequisites: Dependabot、GitHub、Repository
Shift left
Moving security earlier in development to prevent problems before they grow—Push Protection, dependency scanning, pre-merge analysis. Later fixes cost more. Prevention doesn’t replace detection/remediation (use layers).
Prerequisites: push / pull_request events、merge、Secret scanning
Wiki and repository insights
A Wiki manages long-form project docs and the README shows an overview. Insights visualize repository health—contributions, traffic, and the dependency graph.
Prerequisites: Dependency graph、README、Repository
Gist
A lightweight repository for quickly sharing a single file or code snippet.
Prerequisites: Repository
Principle of least privilege
A design principle that grants each identity (person, app, or service) only the minimum permissions needed to do its job. Excess privilege widens the blast radius of a mistake or breach, so it is continuously tightened through IAM roles, policies, and permission boundaries.
Prerequisites: permissions (token scope)
GitHub Pages
Hosts a static site from a repository for free (no dynamic server logic).
Prerequisites: GitHub、Repository
Search qualifiers
Keywords like is:/label:/author:/assignee: that narrow a search by type/state/owner; multiple combine with AND.
Related: Assignee
GitHub Skills
Official hands-on courses where you learn by doing.
Prerequisites: GitHub
upstream
The conventional remote name for the original (forked-from) repo; your fork is origin.
Prerequisites: fork、Remote (origin)、Repository
Version control system (VCS)
A system that records the history of file changes, enabling revert, tracing who/why, and collaboration.
Visibility (Public/Private/Internal)
A repo audience: Public = anyone, Private = permitted users, Internal = within the same Enterprise.
Prerequisites: Repository
Watch
Subscribes to a repository update notifications; distinct from Star.
Prerequisites: Repository、Star
Merge conflict
A conflict when the same spot is changed differently; resolve manually before completing the merge.
Prerequisites: merge
Enterprise teams
A higher-level team that manages membership, roles, and policy (governance) across multiple organizations within an enterprise; define a team once and assign it to many organizations. Nesting and parent-permission inheritance are features of organization-level teams, not enterprise teams.
Prerequisites: Organization、Team
Organization roles (owner/member/security manager)
Roles governing the org: the owner (whole-org control), regular members, and carved-out roles like security manager. Owner is powerful—grant sparingly.
Prerequisites: Security manager (role)、Organization
Third-party Vault integration
Connecting to an external secrets manager (e.g., HashiCorp Vault) via OIDC and fetching credentials dynamically at runtime—avoiding long-lived storage in GitHub and reducing exposure.
Prerequisites: Encrypted secrets and variables (secrets / vars)、GitHub
ACTIONS_STEP_DEBUG
A secret that, when set, enables step-execution debug logging; used to investigate failures the normal logs don’t explain.
Prerequisites: Encrypted secrets and variables (secrets / vars)、Step
Major-version tag (@v4)
A tag consumers reference like @v4; providers move the major tag to the latest commit each release so consumers auto-receive fixes.
max-parallel
The cap on concurrent matrix jobs; used to manage cost and runner capacity.
Prerequisites: strategy.matrix、Runner
Re-run failed jobs / Re-run all jobs
Re-running only failed jobs vs retrying the whole run; use the former when a specific matrix variant fails and the latter for flaky failures.
Prerequisites: Job、strategy.matrix
Retention
How long logs, artifacts, and runs are kept; set at repo/org level and tunable via retention-days at upload. Manageable via the REST API and affects storage billing.
Prerequisites: Repository
Related: Artifact
Script injection
A vulnerability where embedding untrusted input (PR title, issue body) directly into a run: shell command lets an attacker’s command execute; mitigate by routing values via an env var with quoting, plus validation, least privilege, and vetted actions.
Prerequisites: GitHub Actions、Issue
$GITHUB_STEP_SUMMARY
A special file where appended Markdown renders as a rich job summary (test tables, coverage, links) on the run page.
Verified creator
An action creator verified by GitHub; used in policies like "allow only GitHub-authored + verified-creator actions."
Prerequisites: GitHub Actions、GitHub
GitHub Copilot CLI
Brings Copilot to the terminal—command suggestions/explanations, shell-script generation, file operations via natural language; installed/authenticated separately from the IDE extension.
Prerequisites: GitHub Copilot、GitHub
Content exclusion
A setting that keeps specific files/repositories out of Copilot’s context and suggestions to protect sensitive or policy-restricted code; admins set it at repo/org level, and excluded targets get no suggestions.
Prerequisites: Contexts、Repository
Copilot-supported editors/IDEs
GitHub Copilot installs as an extension in Visual Studio Code, Visual Studio, JetBrains IDEs, Neovim, and more; completion and Chat run inside the editor.
Prerequisites: GitHub Copilot、GitHub
Duplication detection
A safeguard that blocks/suppresses suggestions matching public code to reduce licensing concerns; an aid—post-adoption license-check responsibility remains.
Prerequisites: LICENSE
Copilot org policy (feature availability)
An enterprise/org-level setting managing who can use which Copilot features and how; spans the IDE and github.com and is above individual settings.
Prerequisites: Policies (member capabilities)、GitHub
Output ownership and licensing
Ownership/responsibility for adopted code rests with the adopting user/org; output may match public code, so mind licensing and use duplication detection.
Prerequisites: Duplication detection、Alert dismissal and ownership
Autofix (Copilot Autofix)
Auto-suggests fixes for detected vulnerabilities that developers review and adopt; since suggestions can be wrong, validate before merging.
Prerequisites: merge
Delegated bypass / delegated exceptions
A mechanism to temporarily bypass a block (e.g., Push Protection) or grant a policy exception with approval; control who may approve via access management and record for auditability (not a permanent waiver).
Prerequisites: push / pull_request events、Secret scanning
EPSS (Exploit Prediction Scoring System)
A score estimating the probability a vulnerability is actually exploited; combined with severity (CVSS) to prioritize "severe and likely-exploited" issues.
Prerequisites: Issue
Related: CVSS (severity)
Security rulesets and enforcement boundaries
A mechanism defining and enforcing required features/checks/remediation SLAs org-wide; enforcement boundaries set scope (whole enterprise / specific orgs / repo sets). Works only when enforced, not merely defined; can enforce multiple pillars together (cross-suite).
Prerequisites: Ruleset、Repository
SARIF
The Static Analysis Results Interchange Format. Uploading a third-party SAST’s SARIF to GitHub surfaces results as Code Scanning alerts in one UI, coexisting with CodeQL.
Prerequisites: Code scanning、GitHub
SBOM (Software Bill of Materials)
A "bill of materials" listing included dependencies/versions in standard formats (SPDX, CycloneDX). Exportable from the dependency graph for compliance and supply-chain transparency (not a vulnerability list itself).
Prerequisites: Dependency graph
Infrastructure as Code (IaC)
Defining infrastructure declaratively as code (templates) so it is reproducible and version-controlled—preventing manual drift and enabling review, automation, and consistent multi-environment builds. On AWS, CloudFormation and CDK are the main tools.
Prerequisites: Environment and protection rules、Version control system (VCS)
JSON
A lightweight text format representing structured data as braces and key–value pairs. Widely used wherever machine-readability matters most—API request/response bodies and permission definitions like IAM or bucket policies.
Managed services (management boundary)
A categorization by how much AWS operates for you. The more fully managed (AWS handles patching/scaling/availability), the lower your operational burden but less control; unmanaged (e.g., EC2) is flexible but self-operated. It frames “where your responsibility ends” in the shared responsibility model.
SHA (commit hash)
A unique identifier computed from a commit content; it uniquely identifies the commit.
Prerequisites: Commit
GitHub Sponsors
A way to financially support OSS developers/projects; separate from Star (a free bookmark).
Twelve-Factor App
A set of principles for cloud-native apps: externalize config to env vars, keep processes stateless, treat logs as event streams, design for disposability, and keep dev/prod parity. A guide to scalable, portable applications.
Prerequisites: Encrypted secrets and variables (secrets / vars)
Webhook
Sends HTTP notifications to an external URL when repo/org events occur, used to automate CI integrations, SIEM, ticket creation, etc.
Prerequisites: Repository
action.yml (metadata)
The required metadata file at an action’s root; defines name, description, inputs, outputs, runs (using = node20/docker/composite), and branding. Must match runs.using to the implementation to start.
Prerequisites: inputs (workflow inputs)
Annotations
Summarized error/warning displays on the logs that jump to the offending line, aiding failure diagnosis.
concurrency
Limits same-group runs to one at a time; with cancel-in-progress: true a new run auto-cancels in-progress older runs, validating only the latest and saving cost.
fail-fast
A matrix-strategy setting; true (default) cancels the rest on one failure, false runs all combinations to completion. Use false to diagnose.
Prerequisites: strategy.matrix
$GITHUB_ENV
A special file to pass a runtime-computed value as an env var to later steps; append like echo "KEY=value" >> "$GITHUB_ENV".
Prerequisites: Step
repository_dispatch
A trigger started by external systems via API (POST) with a custom event name; used for external integration.
Run history
The list of a workflow’s past runs; used to find when/from which change it began failing and to isolate causes.
Prerequisites: Workflow
Service containers (services:)
Spins up sidecar containers (DB, queue) only during a job; supports port mapping and health checks, enabling integration tests without an external DB.
Prerequisites: Job
setup-* actions
Official actions like actions/setup-node that provide a specified tool version at runtime; used when the preinstalled version is unavailable.
Prerequisites: GitHub Actions
Agent session
The unit managing Agent Mode work; you can check progress, pause, and resume.
Prerequisites: Agent Mode
Copilot Code Review policy
A policy to roll out Copilot code-review assistance to org standards; it does not replace human review.
Prerequisites: Code review (Pull Request)
Context gathering and prompt building
Input processing that selects relevant info from around the cursor, open files, and related files to build the prompt; excluded files are left out.
Prerequisites: Contexts
Reducing context switching
Asking Chat about unfamiliar APIs/errors to reduce switching to a browser or docs, preserving development flow.
Prerequisites: Contexts
Instructions files
A standing config file that supplies coding conventions and review standards so Copilot reviews/responds with consistent criteria.
Suggestion lifecycle
The loop: context change → prompt → model generates → present candidate → accept/reject → next suggestion with new context; accepted content influences the next context.
Prerequisites: Contexts
Modernizing legacy code
Assistance to rewrite old syntax/deprecated APIs/verbose code toward modern style; adopt after verifying semantic equivalence via tests.
Prerequisites: Semantic equivalence
Pull Request summaries
Auto-summarizes changes to speed up the start of review; it does not replace human review.
Prerequisites: Pull Request (PR)
Probabilistic generation
The LLM trait of generating output probabilistically; output can vary for the same context and isn’t always optimal (not a bug).
Prerequisites: Contexts
Prompt file
A file of reusable standard instructions for consistent Chat responses; distinct in use from always-applied instructions files.
Prerequisites: Instructions files
Subscription (seat) management
Managing Copilot seat assignment/removal and usage retrieval; automatable via the REST API in addition to the UI, used for onboarding/offboarding seat operations.
Prerequisites: License (seat)
Semantic equivalence
That behavior is unchanged before/after refactoring or modernization; verified via tests to prevent "a working but different thing."
Spaces (Copilot)
A place to bundle related code, docs, and instructions as shared context to give Copilot consistent context.
Prerequisites: Contexts
Sub-agent
A subordinate agent to which subtasks are delegated for large tasks/growing context, optimizing each agent’s context usage.
Prerequisites: Contexts
Validating AI output
A required practice of checking Copilot output before adoption—via code review, testing, security scanning, and fact-checking—including validating generated tests themselves.
Prerequisites: Code review (Pull Request)
Alert dismissal and ownership
Dismiss alerts only for false positives/accepted cases with recorded reasons (careless dismissal leaves risk). Clarify ownership so who responds/remediates is clear, preventing neglect or duplicate work.
Security campaigns
A mechanism bundling like existing alerts across many repos for planned, bulk remediation to a deadline; combined with PR-based remediation and bulk alert management for large-scale risk reduction.
Prerequisites: Repository
Custom secret patterns
Regex-defined patterns to detect an org’s proprietary tokens/internal keys not caught by default patterns. A too-loose regex raises false positives—tune via tests.
Prerequisites: Encrypted secrets and variables (secrets / vars)
CVSS (severity)
Common Vulnerability Scoring System—a standard scoring vulnerability severity. For prioritization, combine with EPSS (exploit probability), reachability, and asset criticality.
Dataflow analysis (source→sink)
CodeQL analysis showing the path of "where a dangerous value enters (source) and where it can be exploited (sink)," revealing the cause, blast radius, and where to add validation/sanitization.
Default security configuration
A template of "which features to enable with which settings." Applied to an org, it applies uniformly to targeted repos and inherits to repos created later. Choose GitHub-recommended or org custom.
Prerequisites: GitHub
Grouping and auto-dismiss (dependency updates)
Grouping combines related dependency updates into one PR to cut noise; auto-dismiss drops low-risk alerts by conditions (too loose dismisses real risk). Configure update strategy in dependabot.yml.
Prerequisites: Dependabot
Security manager (role)
A role overseeing security policy, managing alerts, and approving exceptions; granted independently of code-write access, at least privilege to the right people.
Security Overview
A dashboard giving an at-a-glance view of security posture across an org/repo—enablement, open alerts, risk trends—for prioritization and coverage checks (it doesn’t remediate).
Prerequisites: Repository
Validity check
Verifies whether a detected token is still live (active) via provider APIs and prioritizes alerting for high-confidence secrets—focusing attention rather than chasing revoked/dummy values.
Prerequisites: Encrypted secrets and variables (secrets / vars)
TLS
A protocol that encrypts traffic and authenticates the server (and, when required, the client) via certificates. It performs key exchange and authentication in a handshake, then encrypts data with a symmetric key. Cloud load balancers and CDNs commonly terminate it, with certificates issued and renewed by a managed service.
Prerequisites: Managed services (management boundary)