GitHub Workflows: Automate Code Quality Checks

GitHub Actions workflows automate builds, tests, and quality checks on every push or pull request. This guide explains YAML structure, triggers, jobs, secrets, and how to add validation steps — without claiming workflows alone enforce branch protection (that is configured separately in repository settings).

Video explainer (1:08) · Watch with transcript

Workflow building blocks

  • Triggers — push, pull_request, schedule, workflow_dispatch
  • Jobs — parallel or sequential units of work
  • Steps — shell commands or marketplace actions
  • Runners — GitHub-hosted or self-hosted
  • Permissions — least privilege for tokens
  • Secrets — store credentials in GitHub Secrets, never in YAML

Pull request validation pattern

Typical PR workflow: checkout → restore dependencies → build → test → optional lint/static scan → upload artifacts. Failed steps mark the check red; branch protection can require checks before merge when admins configure it.

Example: GitHub Actions build and test for .NET

name: ci
on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  build-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'
      - name: Restore
        run: dotnet restore ./src/MyApp.sln
      - name: Build
        run: dotnet build ./src/MyApp.sln --configuration Release --no-restore
      - name: Test
        run: dotnet test ./tests/MyApp.Tests/MyApp.Tests.csproj --configuration Release --no-build

Adding quality checks

Invoke dotnet format, ESLint, or a hosted scanner API after tests. Parse reports to fail on Critical counts. Cache NuGet or npm directories to speed up runs.

Troubleshooting failed workflows

  • Read step logs; reproduce locally with same SDK version
  • Verify paths to solution and test projects
  • Check secret names and repository permissions
  • Watch for flaky tests vs real failures

Where CodeInspector fits

CodeInspector supports scheduled or manual repository scans outside Actions by scanning GitHub repositories (public URL or connected private repos via GitHub OAuth) with rule-based static analysis for C#, Java, JavaScript, TypeScript, and C++. Findings include severity, file context, recommendations, and suggested fixes where available; PDF reports and scan history help teams track remediation. Explorer includes Gemini chat to discuss findings — it assists investigation, not autonomous code review. Python, Go, and PHP are listed as coming soon on the About page. Evaluate at https://codeinspector.app with starter credits for new accounts.

Frequently asked questions

Do workflows replace code review? — No.

Are Actions free? — See GitHub pricing for minutes limits.

Can workflows push to main? — Possible with tokens; use care.

Conclusion

GitHub workflows automate repeatable checks. Pair Actions with repository-wide static analysis — trigger CodeInspector scans on release branches or after major merges via your team process.

Related