Get Creative with GitHub Actions

Presented on November 13 2026 at WordCamp The Netherlands, The Hague, The Netherlands.
https://netherlands.wordcamp.org/2026/session/get-creative-with-github-actions/
---------------------------------------------------------------
If you are a solo developer on a project, Quality Assurance checks are the only thing that keeps you honest.

And having QA checks set up is all nice and dandy, but if you don't run them....

In comes, GitHub Actions to automatically run all your QA checks and more.... More ? Yes, why limit yourself to QA checks when GitHub Actions allows you to do much more. Let's get creative!

1. Get Creative With GitHub Actions Juliette Reinders Folmer Toot about it: @jrf_nl #WCNL26
2. GitHub Actions == Continuous Integration == Quality Control & Automation
3. Quality Control ? Tests Code Style Lint Static Analysis Validate Configuration Build/Deploy
4. Typical Tasks ✓ Check Javascript CS ✓ Check CSS Code Style ✓ Check Markdown CS ✓ Check for broken links ✓ Check spelling ✓ Run ESLint ✓ Run XMLLint ✓ Run Yamllint ✓ Check PHP Code Style (and auto-commit fixes) ✓ Run PHPStan ✓ Lint PHP code ✓ Run Unit Tests ✓ Run Integration Tests ✓ Run End To End Tests
5. The Basics
6. Anatomy of a Workflow name: QA on: push: pull_request: Triggers jobs: test: name: Test runs-on: ubuntu-latest Job name OS image steps: - name: Checkout code uses: actions/checkout@v7 Exec - name: Install dependencies uses: ramsey/composer-install@v4 - name: Run tests run: vendor/bin/phpunit
7. Running the Same Thing Multiple Times jobs: test: name: Test runs-on: ubuntu-latest strategy: matrix: php: ['8.1', 'latest', 'nightly'] continue-on-error: ${{ matrix.php == 'nightly' }} steps: - ...
8. Running the Same Thing Multiple Times steps: - name: Checkout code uses: actions/checkout@v7 - name: Install PHP uses: shivammathur/setup-php@v2 with: php-version: ${{ matrix.php }} ini-values: error_reporting=-1, display_errors=On - name: Install Composer dependencies uses: ramsey/composer-install@v4 with: composer-options: ${{ matrix.php == 'nightly' && '--ignore-platform-req=php+' || '' }}
9. Max 256 jobs per workflow Max 50 re-runs Max 6 hours Logs 90 days
10. Getting Started ▪ https://docs.github.com/en/actions ▪ https://github.com/actions/starter-workflows ▪ https://github.com/actions/starter-workflows
11. Securing Your Workflows
12. Secure By Design ?
13. Insecure by Design
14. Set Permissions name: QA on: push: pull_request: # Permissions should be configured at the job level. permissions: {} jobs: test: permissions: contents: read # To clone the repo. name: Test runs-on: ubuntu-latest steps: - ...
15. ... Use Checkout v7 (or higher) jobs: test: permissions: contents: read # To clone the repo. name: Test runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v6 with: persist-credentials: false - ...
16. ... Prevent Cache Poisoning steps: - name: Checkout code uses: actions/checkout@v7 - name: Install dependencies uses: ramsey/composer-install@v4 with: ignore-cache: ${{ github.ref_type == 'tag' && "yes" || "no" }} - ...
17. ... Pin Action Runners 1. Pin action runners 2. Add Pinact job? name: Test runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c 181273ba90b1 # v7.0.1 - name: Install dependencies uses: ramsey/composerinstall@65e4f84970763564f46a70b8a54b90d033b3b dda # 4.0.0 - name: Run tests run: vendor/bin/phpunit
18. version: 2 Pin Action Runners updates: - package-ecosystem: "github-actions" directory: "/" target-branch: "lowest-supported" 1. Pin action runners 2. Add Pinact job? groups: action-runners: applies-to: version-updates 3. Set up Dependabot update-types: 4. Group Dependabot - "patch" - "minor" schedule: updates 5. Change frequency ? interval: "monthly"
19. version: 2 Set Cooldown updates: - package-ecosystem: "github-actions" directory: "/" target-branch: "lowest-supported" groups: ... schedule: interval: "monthly" cooldown: default-days: 7
20. ... Make Variables Secure via ENV - name: Check title env: ISSUE_TITLE: ${{ github.event.issue.title }} run: | title="${{ github.event.issue.title }}" title="${ISSUE_TITLE}" if [[ ! $title =~ ^.*:\ .*$ ]]; then echo "Bad issue title" exit 1 fi
21. Useful Tools Pinact Zizmor https://github.com/ suzuki-shunsuke/pinact https://docs.zizmor.sh/
22. Get Creative But Don't Be Evil
23. Automate All Repetitive Tasks
24. Interesting Triggers gollum milestone pull_request_target release schedule workflow_dispatch
25. schedule Workflow A Workflow B Triggers: push, pull_request Trigger: schedule Reusable Workflow Trigger: workflow_call
26. Auto Merge Dependabot PRs name: Dependabot auto-merge on: pull_request: jobs: automerge: permissions: pull-requests: write contents: write runs-on: ubuntu-latest if: github.actor == 'dependabot[bot]' steps: - name: Auto-merge Dependabot PRs uses: fastify/github-action-mergedependabot@v3 with: target: 'minor' merge-method: 'squash' use-github-auto-merge: true
27. Mark PRs with a Merge Conflict name: Check PRs for merge conflicts on: push: branches: - main pull_request_target: types: - opened - synchronize - reopened jobs: check-prs: permissions: pull-requests: write name: Check PRs for merge conflicts runs-on: ubuntu-latest steps: - name: Check PRs for merge conflicts uses: eps1lon/actions-label-mergeconflict@v3
28. Regenerate Documentation on Release [1] name: Build website on: release: types: - published pull_request: paths: - '.phpdoc.xml.dist' - '.github/workflows/update-docs.yml' jobs: build: name: "Build the website" runs-on: ubuntu-latest
29. Regenerate Documentation on Release [2] https://github.com/ PHPCSStandards/ PHPCSUtils/blob/ develop/.github/ workflows/ update-docs.yml ... steps: - name: Checkout code uses: actions/checkout@v7 - name: Install PHP uses: shivammathur/setup-php@v2 with: php-version: '8.4' coverage: none tools: phpdoc - name: Generate phpDoc documentation run: phpDocumentor -n - name: Setup GH Pages uses: actions/configure-pages@v6 - ...
30. Re-run Tests on Release of Other Project George Hodan
31. Check for File Update https://github.com/ WordPress/Requests/ blob/develop/ .github/workflows/ reusable-update -cacert.yml name: Certificates on: schedule: - cron: '20 4 * * *' jobs: certificate-check: permissions: contents: write pull-requests: write runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v7 - name: Get current certificate bundle working-directory: ./certificates run: curl --remote-name https://curl.se/ca/cacert.pem - name: Create pull request uses: peter-evans/create-pull-request@v8 with: base: 'main' branch: 'update-cacert' title: "Update certificate bundle"
32. Update Your GH Profile With Your Latest Blog Posts name: RSS Feeds on: schedule: - cron: 0 0 * * 1 workflow_dispatch: jobs: update: name: Update profile page runs-on: ubuntu-latest steps: - name: "Blog" uses: JasonEtco/rss-to-readme@v2 with: feed-url: https://make.wordpress.org/core/feed/ readme-section: main
33. Uptime Monitor https://github.com/ upptime/upptime Jean Beaufort
34. Verify Your Database Backups https://stefanzweifel.dev/ posts/2023/06/15/ introducing-laravelbackup-restore/#uselaravel-backup-restore-toverify-backup-integrityusing-github-actions Gerd Altmann
35. What's Your Most Creative Use of GitHub Actions ?
36. Thanks! Any questions ? Slides: https://speakerdeck.com/jrf Feedback: https://joind.in/talk/dafa1 @jrf_nl@phpc.social @jrfnl https://github.com/sponsors/jrfnl