Pick your stack and get a ready-to-commit .github/workflows file: push, pull request, tag and schedule triggers, a version and OS matrix, dependency caching, lint, test and build steps, and an optional deploy to GitHub Pages or GitHub Container Registry. Least-privilege permissions and a matching dependabot.yml are included.
Last updated:
Generated files
Save as
Advertisement
Advertisement
How to use the GitHub Actions Workflow Generator
Choose your project type: Node.js, Python, Go, Java, Rust, .NET, Docker image or static site.
Set the triggers: branches for push and pull requests, optional tags such as v*, a cron schedule and manual runs.
Configure the matrix of language versions and operating systems, and edit the install, lint, test and build commands.
Choose a deploy target (GitHub Pages or a Docker image on GHCR) and extras like caching and artifacts.
Copy or download the workflow, save it as .github/workflows/ci.yml in your repository and push. The run appears in the Actions tab.
Workflow file structure
Key
Example
Meaning
on
push, pull_request, schedule, workflow_dispatch
Events that start the workflow
permissions
contents: read
Scopes of the automatic GITHUB_TOKEN
concurrency
group: ${{ github.workflow }}-${{ github.ref }}
Only one run per group; older PR runs are cancelled
jobs.<id>.runs-on
ubuntu-latest
Runner image for the job
strategy.matrix
node: ['22', '24']
Run the job once per combination
steps[].uses
actions/checkout@v5
Run a published action at a version
steps[].run
npm test
Run a shell command
needs
needs: test
Wait for another job to succeed first
if
github.ref == 'refs/heads/main'
Run a job or step only when the condition is true
Actions used by the generator
Major versions current as of 2025-2026. Pinning to a major tag gets bug fixes automatically; for maximum supply-chain safety you can pin to a full commit SHA instead and let Dependabot update it.
Use clean installs (npm ci, pnpm install --frozen-lockfile) so CI fails when the lock file is out of date instead of silently resolving new versions.
Keep the matrix small for pull requests; testing every OS and version multiplies minutes. Test the oldest and newest supported versions.
Use paths-ignore for docs-only changes, but remember that a required status check that never runs blocks the merge.
Store credentials as secrets (Settings → Secrets and variables → Actions) and reference them as ${{ secrets.NAME }}; never echo them in logs.
Validate locally with a YAML validator, or run workflows on your machine with a tool such as act before pushing.
Frequently asked questions
Where do I put the workflow file?
Save it in your repository under .github/workflows/ with a .yml or .yaml extension, for example .github/workflows/ci.yml, and push it to GitHub. Workflows run from the default branch for schedules and from the pushed branch for push and pull_request events. The dependabot.yml file goes directly in .github/.
What does the matrix do?
strategy.matrix runs the same job once for every combination of values, for example Node.js 22 and 24 on Ubuntu and Windows gives four parallel jobs. Set fail-fast to false to let the other combinations finish when one fails, so you see every broken version at once.
How does dependency caching work?
The official setup actions (setup-node, setup-python, setup-java, setup-go) can cache the package manager's download folder keyed on your lock file hash, so later runs reuse it instead of downloading everything. It requires a committed lock file such as package-lock.json or requirements.txt. Rust uses Swatinem/rust-cache and .NET uses actions/cache on the NuGet folder.
Why set permissions: contents: read?
The automatic GITHUB_TOKEN gets only the permissions you grant. Read-only contents is enough to check out code and limits the damage if a step or dependency is compromised. Jobs that need more ask for it explicitly: packages: write to push images, pages: write and id-token: write to deploy GitHub Pages.
How do I deploy a site to GitHub Pages with Actions?
Choose Deploy to GitHub Pages, set the build output folder, and in the repository settings set Pages → Source to GitHub Actions. The build job uploads the folder with actions/upload-pages-artifact and a deploy job publishes it with actions/deploy-pages into the github-pages environment.
What cron syntax does the schedule use?
Standard 5-field POSIX cron in UTC: minute, hour, day of month, month, day of week. For example 0 6 * * 1 runs every Monday at 06:00 UTC. The shortest interval is every 5 minutes, and scheduled runs can be delayed during periods of high load.
Which action versions are used?
Current major versions as of 2025-2026, for example actions/checkout@v5, actions/setup-node@v5, actions/setup-python@v6 and actions/setup-go@v6. Majors change over time, so the generated dependabot.yml checks the github-actions ecosystem weekly and opens pull requests when new versions are released.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.