GitHub Actions cheat sheet
Overview
Find each workflow's purpose, trigger, and failure consequences. Workflow links open the source; manual means GitHub Actions Run workflow. Use CI configuration for test environments and runner overrides. Publication and preview settings belong to their linked guides.
Test actions
| Workflow or job | What it does | When it runs | What failure blocks |
|---|---|---|---|
| CI | Required checks | PRs, pushes to main, merge groups, manual. |
CI Required blocks merge. Failed main-push CI blocks container and CLI publication. |
| First Agent Smoke (job within CI) | Basic Agent lifecycle | Code/configuration PRs, pushes to main, merge groups, manual. |
Outside CI Required; failure blocks container and CLI publication through failed main-push CI. |
| QA Matrix Advisory | Advisory Agent workflows | Every 6 h on main; main push if enabled; trusted PR with full or focused QA labels; manual on main. |
No merge or publication gate. |
| Full Integration | Selected real-service suites | Scheduled main admission or approved manual dispatch on main. Retry with a new approved dispatch. |
No merge or publication gate. |
| Check Native Container Images | Native image checks | Manual, manual CI, or container publication preparation. | Container publication when used by its preparation step. No merge gate. |
| Observability Demo | Monitoring demo tests | Relevant PRs and main pushes; merge groups; manual. |
Demo verification and dashboard artifacts only. |
| Local k3d Quickstart | Browser onboarding, Linear, and Git | Manual on protected main; approved development-branch push matching the reviewed commit. |
Quickstart result only; no merge gate. |
Other actions
| Workflow | What it does | When it runs | What failure blocks |
|---|---|---|---|
| Staging Release Qualification | Published-image startup checks | Manual on protected main. |
Qualification result only; no merge gate. |
| Enterprise Containers | Validates exact-source CI, prepares images, and optionally publishes images and a Helm chart. | Manual on main; publication must be selected. |
Requested image/chart publication. Requires successful main-push CI and native image checks. |
| Resume Container Publication | Publishes previously prepared image digests without rebuilding. | Manual on main. |
Recovery publication; requires original preparation evidence and successful CI for the recovery workflow. |
| Promote Containers to Docker Hub | Copies verified published GHCR digests to Docker Hub without rebuilding. | Manual on main. |
Docker Hub promotion; requires successful GHCR publication evidence. |
| Bootstrap Container Packages | Creates GHCR packages with harmless markers for initial access setup. | Manual on main. |
Initial package setup; no merge gate. |
| Release OCC CLI | Builds macOS/Linux AMD64/ARM64 binaries and publishes a GitHub Release. | Manual on main. |
CLI publication; requires exact-source successful main-push CI. |
| CI Image Cache | Warms the controller/runtime build cache. | Relevant main pushes; hourly at minutes 07, 27, 47 UTC; manual on main. |
Cache refresh only. |
| Console Storybook | Builds and uploads static Console fixture previews. | Relevant PRs and main pushes; manual. |
Preview artifact only. |
| Publish private documentation | Builds documentation/search and deploys GitHub Pages. | Every main push; manual on main. |
That documentation deployment. |
| CodeQL | Scans JavaScript/TypeScript and Actions for security findings. | PRs, main pushes, repository publication, Mondays 03:43 UTC, manual. See eligibility settings. |
Scan results only; no merge or publication gate. |
| ClawSweeper Dispatch | Forwards eligible issue/PR events and command comments to ClawSweeper. | Issue/PR updates and new or edited issue/PR comments. | Event forwarding only. |
CodeQL eligibility
Public repositories need no CODEQL_ENABLED setting. For private repositories,
set that Actions repository variable to true only after approved, licensed
Code Security advanced setup.
Merge, publication, and deployment
See CI checks and gates for the distinction between required checks and advisory jobs. Publication configuration explains release prerequisites; these workflows do not gate every Agent/platform deployment.