---
title: "GitHub Actions"
description: "4 posts about GitHub Actions, summarised, each linking to the original."
---

# GitHub Actions
> 4 posts about GitHub Actions, summarised, each linking to the original.

## Articles

### [Staying Evergreen: How we automated secure access and repo hygiene in a shared org](https://yomu.fyi/post/staying-evergreen-how-we-automated-secure-access-and-repo-hygiene-in-a.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Greg Mohler
- Published: Oct 15, 2026
- Type: Problem & solution

Managing outside collaborator access and stale repositories in a shared GitHub organization becomes harder to keep up with as projects grow. Evergreen is a GitHub App built with native GitHub features—scheduled actions, webhooks, issues, and custom properties—that automates two workflows: quarterly outside collaborator access reviews and stale repository detection and archival. Its design principles are fail secure, revoking access if no one responds, and never destroy anything, keeping archived repos recoverable and every change tracked in issues. The app is a Go webhook server that stores state as JSON files in a controller repo, using git history as the audit trail, and interacts via checklist issues in each repository. Rollout included dry-run mode, overcommunication, Splunk observability, and proactive rate-limit pacing; the pattern is adaptable using native GitHub features.


### [Your diff has a demo now with Junie /demo](https://yomu.fyi/post/your-diff-has-a-demo-now-with-junie-demo.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Aliaksei Kartynnik
- Published: Sep 18, 2026
- Type: Tutorial

Junie /demo adds a mode to Junie CLI that builds and launches an application, drives its UI, and records a requested check. It produces an HTML report, screenshots, and video, while leaving reviewers able to inspect steps, outcomes, and evidence. In the example, a prompt selects two issues, marks them Done, checks counter changes, reloads the page, and verifies persistence. Initial setup analyzes the repository and generates configuration after a confirmed build and launch plan; Docker-based environments can use custom templates for complex repositories. The mode also supports GitHub Actions workflows for pull-request demonstrations and release smoke tests, but an explicit PASS verdict is required for a scenario to pass.


### [Using GitHub Actions with Heroku Flow for additional Security Control](https://yomu.fyi/post/using-github-actions-with-heroku-flow-for-additional-security-control.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: Andrew Fawcett
- Published: Mar 27, 2025
- Type: Tutorial

The pattern combines GitHub Actions with Heroku Flow for private repositories and stricter security requirements when GitHub organization IP restrictions cannot use Heroku IP ranges. A custom self-hosted GitHub Runner runs as a Docker image on Heroku, while the Platform API and Source Endpoint API upload source code to ephemeral storage, build and deploy apps, and manage Review Apps. Event-specific workflows handle pushes, manual runs, schedules, and pull requests; a weekly workflow rebuilds and autodeploys the runner image within GitHub’s 30-day update window. Setup uses a Heroku Private Space, its outbound IPs, a GitHub access token, and organization name, but omits the repository URL in the Review App UI, does not run conventional Heroku CI tests, and is incompatible with Fir.


### [How to Create a Secure CI/CD Pipeline Using Okta Terraform](https://yomu.fyi/post/how-to-create-a-secure-ci-cd-pipeline-using-okta-terraform.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Nick Connelly
- Published: Oct 11, 2024
- Type: Tutorial

The guide presents a secure CI/CD pipeline for managing Okta resources with Terraform, AWS, and GitHub Actions, addressing local setup, collaboration, state storage, secrets, and deployment automation. Its architecture uses GitHub as source control and workflow trigger, GitHub OIDC to authenticate to AWS IAM STS and assume roles, S3 for Terraform state, DynamoDB for state locking, and AWS Secrets Manager for Okta OAuth 2.0 client credentials private keys. Developers push changes to develop for an automatic development build, open a pull request to main for a production plan, and merge approved changes to trigger the production build. The workflows run Terraform init, plan, and apply as appropriate, while the guide also covers repository setup, branch organization, and troubleshooting for missed configuration in GitHub, Okta, or AWS.