Path filters answer whether a workflow runs; deciding which packages a change affects needs the dependency graph as well as the diff. The transitive closure is what makes…
A trace is large and is only interesting when something went wrong, so recording on retry and uploading on failure is the arrangement that stays affordable. if: failure()…
A pipeline that reports its result by making somebody open the log is a pipeline whose result nobody reads. Writing the failure explanation into the summary rather than…
needs controls ordering and shares outputs, and each job still starts on a fresh machine with an empty workspace. Outputs are strings and are limited in size, so…
An environment attaches secrets, reviewers and a branch restriction to a job, which puts the gate somewhere a convention cannot be forgotten. Scoping the secrets to the environment…
The token exchange replaces a long-lived key with a short-lived one, and the value is entirely in how narrowly the trust is scoped. Omitting the subject condition means…