A practical GitHub Actions map as of September 2026: events, jobs, steps, full-SHA pinning, least-privilege tokens, OIDC, and turning ./gradlew check into a pull-request gate. Workflow lockfiles and agentic Markdown workflows are still preview.