A practical GitHub Actions map as of September 2026: events, jobs, steps, full-SHA pinning, least-privilege tokens, OIDC, and turning ./gradlew check into a pull-request gate. Workflow lockfiles and agentic Markdown workflows are still preview.
A run
One event starts one workflow. Jobs run in parallel unless needs: chains them. Steps are sequential on one runner.
Pinning
Official docs still treat a full 40-character commit SHA as the immutable release. Org policy can require it. A workflow lockfile is preview, not the default yet.
Privilege
Set permissions: in YAML. Fork PRs get no repo secrets. Prefer OIDC over long-lived cloud keys.
Watch for
Pwn requests (pull_request_target / workflow_run + untrusted checkout), script injection in run:, and self-hosted runners on public repos.
Gate
Required checks, CODEOWNERS on .github/workflows, and the same command you run locally.
Not this
GitHub Agentic Workflows (Markdown + an agent) are a public-preview complement. Deterministic CI stays YAML.