Your first workflow.
Without the guesswork.

Use spaces, never tabs. This app uses two spaces per level. Children are indented beneath a parent; siblings line up. A wrong indent can change the meaning, even if the YAML still parses.

jobs:
  build:
    runs-on: "ubuntu-latest"

build belongs to jobs; runs-on belongs to build.

A mapping is key: value. A list uses - for each item. Strings are text. Quote text such as "3.13", "yes", or "hello: world" to avoid accidental numbers, booleans or mappings. Inside double quotes, escaped characters such as \n mean a newline.

steps:
  - name: "Say hello"
    run: "echo hello"

| introduces a multiline string that preserves line breaks. YAML 1.1 tools can misread unquoted on as a boolean; the generator quotes keys too, so "on" stays a string.

name: display label. on: events that start runs. jobs: work grouped into jobs. runs-on: the runner machine. steps: ordered tasks within a job. A step either uses a reusable action or runs commands with run.

Jobs usually run in parallel; steps in one job run in order. Checkout downloads your repository before commands can use its files. with supplies inputs to an action.

push reacts to commits. pull_request checks proposed changes (normally the merge result), and branch filters refer to the PR's base branch. A branch filter on push excludes tag pushes. workflow_dispatch enables manual runs once the workflow exists on the default branch.

schedule uses UTC cron: minute, hour, day of month, month, day of week (0 or 7 = Sunday). Both day fields are matched with OR if both are restricted. Schedule files must exist on the default branch. This tool supports a small numeric cron subset, not every possible Actions configuration.

An expression like ${{ github.ref }} reads a context value. Contexts include github (run metadata), env (variables) and secrets (configured secrets). Shell $LEARNING_MESSAGE is different: Bash expands an environment variable at runtime.

- name: "Read a branch safely"
  env:
    BRANCH: ${{ github.head_ref }}
  run: |
    printf '%s\n' "$BRANCH"

Never insert event text directly into run, use eval, or execute untrusted branch text. The example passes it as data through env. To use a secret, configure it in repository Settings > Secrets and variables > Actions, then reference ${{ secrets.MY_SECRET }} through an action input or env. Never paste values here, commit them, or print secrets. Fork PRs normally do not receive repository secrets.

permissions: contents: read limits the automatic GITHUB_TOKEN to reading repository contents; unspecified permissions are none. Checkout uses persist-credentials: false. This tool intentionally excludes pull_request_target and deployment/write-token templates.

Actions are dependencies. A full commit SHA is immutable; a tag such as @v7 can move. Generated files pin reviewed official action revisions and include version comments. Review updates (for example with Dependabot); pinning alone does not guarantee an action is safe. These Node 24 actions target current GitHub-hosted runners, not old self-hosted installations.