You automate deployment with GitHub Actions by putting the release steps in a workflow, attaching the deploy job to a named environment such as staging or production, and letting that environment’s protection rules decide whether the job may run. Add a concurrency group so two releases cannot update the same target at once, and where your cloud provider supports it, use OpenID Connect (OIDC) instead of storing long-lived cloud keys as secrets. Safety comes from those controls working together, not from any single one.
A minimal deployment workflow
A working setup has three parts: a build job that validates the code, a deploy job that depends on it, and an environment that gates the deploy job. The file lives in .github/workflows/ in your repository. The following example is a starting point, not a drop-in configuration, because the build commands, deploy script and cloud provider depend on your stack.
As an Amazon Associate I earn from qualifying purchases.
name: Deploy
on:
push:
branches: [main]
workflow_dispatch:
permissions:
contents: read
concurrency:
group: deploy-production
cancel-in-progress: false
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Build and test
run: |
# replace with your own install, test and build commands
npm ci
npm test
npm run build
- uses: actions/upload-artifact@v4
with:
name: site
path: dist/
deploy:
needs: build
runs-on: ubuntu-latest
environment:
name: production
url: https://example.com
permissions:
id-token: write
contents: read
steps:
- uses: actions/download-artifact@v4
with:
name: site
path: dist/
- uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
aws-region: us-east-1
- name: Publish
run: ./scripts/deploy.shTwo details in this file do most of the safety work. The job-level environment key is what makes the deploy job wait for protection rules, and the job-level permissions block grants id-token: write only to the job that needs to request a cloud token. The workflow-level default keeps everything else read-only.
Recommended Free Tools
Choosing the trigger
GitHub’s deployment guide lists push, pull_request and workflow_dispatch among common workflow triggers. Each one answers a different question about when code is ready to ship, so pick by release model rather than by convenience. The trigger and the environment rules are separate controls: a trigger decides when a run starts, and protection rules decide whether a job inside that run may proceed.
#1 Best Overall
- SUPERCHARGED BY M5 — The 14-inch MacBook Pro with M5 brings next-generation speed and powerful on-device AI to personal, professional, and creative tasks. Featuring all-day battery life and a breathtaking Liquid Retina XDR display with up to 1600 nits peak brightness, it’s pro in every way.*
- HAPPILY EVER FASTER — Along with its faster CPU and unified memory, M5 features a more powerful GPU with a Neural Accelerator built into each core, delivering faster AI performance. So you can blaze through demanding workloads at mind-bending speeds.
- BUILT FOR APPLE INTELLIGENCE — Apple Intelligence is the personal intelligence system that helps you write, express yourself, and get things done effortlessly. With groundbreaking privacy protections, it gives you peace of mind that no one else can access your data — not even Apple.*
- ALL-DAY BATTERY LIFE — MacBook Pro delivers the same exceptional performance whether it’s running on battery or plugged in.
- APPS FLY WITH APPLE SILICON — All your favorites, including Microsoft 365 and Adobe Creative Cloud, run lightning fast in macOS.*
- push to a release branch suits continuous delivery to a staging target, where every merge should reach a test environment automatically.
- workflow_dispatch suits production, where a person chooses the moment and can supply inputs such as a version tag. It is also useful for rolling back by re-running a known-good revision.
- pull_request runs against a proposed change before it is merged. It is useful for previews and tests, but it is rarely the right trigger for production, because the code being deployed has not yet been reviewed into the release branch.
Environments: named targets with gates
An environment is a named deployment target, typically development, staging or production. A job that references an environment must pass that environment’s protection rules before GitHub sends it to a runner. Environment secrets and variables are only made available after those rules pass, which means a job waiting for approval has not yet received its credentials.
You configure environments in the repository under Settings > Environments. The rules available there are described in GitHub’s deployment environments documentation.
Required reviewers
Required reviewers pause the deploy job until a listed person or team approves it. Use this for production, and make sure at least one reviewer is someone other than the person who merged the change, otherwise the gate adds a click rather than a check.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- [Built for Heavy Multitasking & Business Workloads] Configured with 32GB high-bandwidth DDR5 RAM and a 1TB PCIe NVMe M.2 SSD, this laptop handles large spreadsheets, data analysis, presentations, CRM systems, browser-heavy workflows, and AI-assisted business tools with ease—ideal for professionals working across multiple applications all day.
- [Business-Class Performance with Intel Core Ultra 7] Powered by the Intel Core Ultra 7 255U Processor (12 Cores, 14 Threads, up to 5.2GHz), delivering strong multi-core performance, integrated AI acceleration, and energy-efficient operation. Designed for enterprise users, analysts, developers, and managers who need consistent, reliable performance for long work sessions—not just short bursts.
- [16" Productivity Display – More Space, Less Scrolling] Features a 16″ WUXGA (1920×1200) IPS display with 16:10 aspect ratio, antiglare coating, and 400 nits brightness, providing more vertical workspace for documents, coding, dashboards, financial models, and multitasking, making it more efficient than standard 16:9 laptops.
- [Enterprise-Ready Connectivity & Security] 2 x USB-C (Thunderbolt 4, USB 40Gbps), 2 x USB-A (USB 5Gbps) – one always on, 1 x USB-A (hi-speed USB), 1x Headphone / mic comb, 1 x HDMI, 1 x Ethernet (RJ-45), 1 x Kensington Nano Security Slot, Fingerprint, Backlit Keyboard, Wi-Fi 6E + Bluetooth, Windows 11 Pro, supporting business security, remote management, virtualization, and professional workflows.
- [ThinkPad L16 – Built for Mobility & Long-Term Business Use] Positioned above entry-level models, the ThinkPad L16 Gen 2 offers stronger build quality, MIL-STD-810H–tested durability, all-day battery life, and IT-friendly reliability, making it a smarter choice for corporate environments, managed deployments, remote work, and professionals upgrading from E-series or consumer laptops.
Wait timers
A wait timer delays the deploy job for a set number of minutes after it is queued. It gives a window to cancel a release that someone spots as wrong, and it is most useful alongside reviewers rather than instead of them.
Branch restrictions
Deployment branch rules limit which branches or tags can deploy to an environment. For production, restrict deployments to your release branch or to protected tags, so a workflow edited on a feature branch cannot send code to production.
Custom deployment protection rules
Custom protection rules let a GitHub App approve or reject a deployment based on an external check, such as an incident or change-freeze system. At the time of writing, GitHub’s documentation marks custom deployment protection rules as public preview, so confirm their status and the plan they require on the environments page before relying on them. Some environment features also depend on repository visibility and your GitHub plan.
Rank #3
- FAST RUNS IN THE FAMILY — The 14-inch MacBook Pro with the M5 Pro or M5 Max chip brings next-generation speed and powerful on-device AI to personal, professional, and creative tasks. With all-day battery life, double the starting storage,* and a breathtaking Liquid Retina XDR display, it’s pro in every way.*
- BUCKLE UP — Along with a next-generation CPU, faster unified memory, and up to 2x faster SSD storage,* M5 Pro and M5 Max feature a more powerful GPU with a Neural Accelerator built into each core, delivering faster AI performance and on-device training capabilities. So you can blaze through demanding workloads at mind-bending speeds.
- BUILT FOR AI — Apple silicon, and every major component that powers it, is designed to run demanding on-device AI workloads like LLM inference and training. And Apple Intelligence helps you write, express yourself, and get things done effortlessly with groundbreaking privacy protections at every step.*
- ALL-DAY BATTERY LIFE — MacBook Pro delivers the same exceptional performance whether it’s running on battery or plugged in.*
- MACOS RUNS APPS FAST — All your go-to apps run lightning fast in macOS, including built-in apps like FaceTime and Messages. Plus, built-in virus protection and free software updates help keep your Mac running smoothly and securely.
Concurrency: stopping overlapping releases
A concurrency group allows only one job or workflow that uses the group to run at a time. GitHub’s deployment guide describes using concurrency to keep an environment to one deployment in progress, which reduces the chance that two releases race to update the same target and leave it in a mixed state.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Set the cancel-in-progress option deliberately. In the example above it is false, so a newer deployment waits for the current one to finish instead of interrupting it. Cancelling a deploy partway through can leave a target half-updated, so reserve cancel-in-progress: true for jobs that are safe to abort, such as preview builds.
Secrets: scope them and expose them late
GitHub encrypts secrets before they reach its servers and exposes them only to the workflows and environments that you scope them to. Secrets can be defined at the organization, repository or environment level, and the narrowest scope that works is the right one. For production credentials, put the secret on the production environment, not on the repository, so it is unavailable to jobs targeting other environments and to branches that fail the environment’s rules.
Rank #4
- POWERFUL FOR CREATIVITY - The Dell Precision 7000 series, positioned at the apex of the Precision lineup, surpasses the 3000 and 5000 series and aligns closely with the evolving direction of the Dell Pro Max series. This top-tier 7680 features the NVIDIA RTX 2000 Ada 8GB GPU to deliver robust performance for professionals in design, architecture, photography, video editing, and engineering. Furthermore, the series' intelligent design for data science leverages AI to optimize system performance for key applications, enabling accelerated workflow efficiency
- HIGH PERFORMANCE - Powered by Intel Core i7-13850HX vPro Processor for superior efficiency and speed, 64GB DDR5 CAMM RAM and 1TB PCIe NVMe M.2 SSD for seamless multitasking and fast storage. CAMM was designed specifically to overcome the performance limits of SODIMM while reducing both Z height and routing traces on the PCB to ultimately allow for laptops with both faster RAM and thinner profiles
- CRISP DISPLAY - 16" FHD+ (1920 x 1200) Anti-Glare 45% NTSC display delivers crisp visuals, supported by the ability to connect 4 external monitors via HDMI, USB-C and Thunderbolt ports at 4K (3840x2160) @60Hz (without docking station). 1080p FHD RGB webcam for crystal-clear video calls
- VERSATILE CONNECTIVITY - Equipped with 2x Thunderbolt 4, USB-C, 2x USB-A, HDMI, Ethernet (RJ-45), and an Audio combo jack. With Wi-Fi 6E and Bluetooth 5.2, ensuring fast wireless connectivity and compatibility with a wide range of peripherals. A full-size keyboard with a dedicated numeric keypad boosts productivity.
- OPERATING SYSTEM - Windows 11 Pro 64‑bit, with AI‑powered Copilot, offers intelligent assistance to streamline complex professional workflows, enhance productivity, and support advanced multitasking across demanding applications. Built for workstation‑class computing, it delivers enterprise‑grade security and IT manageability
Pass each secret only to the step that needs it, rather than as a workflow-wide environment variable, so it cannot be read by unrelated steps or actions. The GitHub secrets documentation covers scoping and precedence in detail.
If you deploy from self-hosted runners, treat them as a separate risk. GitHub’s deployment reference states that self-hosted runners are not run in isolated containers, even when environments are used. A secret available to a job on a shared self-hosted machine may be visible to any other job that runs there, so keep production deploys on GitHub-hosted runners or on machines dedicated to that environment.
Replacing stored cloud keys with OIDC
OIDC lets a workflow obtain short-lived credentials from a cloud provider without storing a long-lived access key in GitHub. GitHub documents this for supported providers, and the setup has two sides: the cloud provider must trust GitHub’s OIDC identity, and the workflow must request a token.
Best Value
- POWERFUL PERFORMANCE FOR PRODUCTIVITY: Equipped with Intel 4-Core CPU and 8GB DDR5 RAM, this 2026 Edition Lenovo laptop delivers smooth multitasking for small business operations, student assignments, and daily office work. The 256GB SSD ensures fast boot times and quick file access, keeping you efficient throughout your workday.
- CRYSTAL-CLEAR VISUAL EXPERIENCE: Features a 15.6-inch FHD (1920x1080) anti-glare display that reduces eye strain during extended use. Perfect for video conferences, document editing, spreadsheet analysis, and multimedia content consumption with vibrant colors and sharp details.
- ALL-DAY BATTERY LIFE: Long-lasting battery keeps you productive without constantly searching for outlets. Ideal for students moving between classes, professionals working remotely, or anyone who needs reliable computing power throughout the day without interruption.
- PORTABLE AND LIGHTWEIGHT DESIGN: Slim profile and portable construction make this laptop easy to carry in backpacks or briefcases. Perfect for students commuting to campus, business travelers, or remote workers who need computing power on the go without the bulk.
- READY TO USE OUT OF THE BOX: Pre-installed with Windows 11, offering an intuitive interface, enhanced security features, and compatibility with essential business and educational software. Includes multiple USB ports, HDMI output, and wireless connectivity for seamless integration with your devices.
- In your cloud account, register GitHub as an OIDC identity provider. The details differ by provider; GitHub’s guide to configuring OIDC in cloud providers summarizes the common pattern.
- Create a deployment role or identity whose trust policy accepts tokens only from your repository, and ideally only from the production environment. The trust policy must include at least one condition on the token’s subject claim. Without one, any repository could request a token that the policy accepts.
- Grant that role only the permissions the deploy script needs. OIDC removes the stored key; it does not reduce what the role can do.
- In the workflow, set
permissions: id-token: writeon the deploy job. This permission lets the job request an OIDC token. It does not itself grant write access to any cloud resource; the role’s permissions do that. - Use the provider’s login action to exchange the token for credentials. For AWS, the
aws-actions/configure-aws-credentialsaction performs that exchange. GitHub’s guide to configuring OIDC in Amazon Web Services walks through the AWS side.
AWS is one documented path, not a universal recommendation. If your target is Azure or another provider, GitHub’s continuous deployment guide points to provider-specific workflow templates and actions, and the trust and token details will differ from the AWS pattern.
Common failures and what they mean
- The deploy job shows as waiting. This is normal when required reviewers or a wait timer are configured. Approve the deployment from the workflow run page, or check that the branch matches the environment’s branch rules if the job was rejected.
- Environment secrets are empty or missing. The job probably ran before its protection rules passed, or the secret was defined on a different scope. Confirm the secret exists on the environment named in the job.
- The OIDC token request fails. Check that the job has
id-token: write. If the permission is present, the trust policy’s subject condition probably does not match the repository, branch or environment in the token. Compare the token’s claims with the condition, character for character. - The cloud role is denied access. The token was accepted but the role lacks the permission the deploy script needs. Add the narrowest action that fixes the error, not a broad administrator policy.
Deploying to production safely: checklist
- Build and test in a separate job, and make the deploy job depend on it with
needs. - Run production deploys from
workflow_dispatchor from a protected release branch, not from feature branches or pull requests. - Require at least one reviewer other than the person who merged the change on the production environment.
- Restrict production deployments to the release branch or protected tags.
- Set a concurrency group per environment, and keep
cancel-in-progressset tofalsefor deploys. - Store production secrets on the production environment, and use OIDC where your provider supports it.
- Set the workflow-level
permissionsto read-only and grant write permissions only on the jobs that need them. - Keep a known-good revision you can redeploy through
workflow_dispatch, so rollback uses the same gated path as a release.
Test each gate once with a dummy change before you depend on it, because a rule that never fires is indistinguishable from a rule that is missing.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
