context
${{ github }}
The `github` context exposes information about the workflow run, event payload, repository, and actor. It is available in most expression fields and is the primary source of triggering-event data.
${{ github.<property> }}Common values / subkeys
| Value / Subkey | Purpose |
|---|---|
| github.repository | owner/name string |
| github.ref / github.ref_name | Full ref (refs/heads/main) / short name (main) |
| github.sha | Commit SHA that triggered the workflow |
| github.actor | Login that triggered the run |
| github.event_name | push / pull_request / workflow_dispatch / ... |
| github.event | Full webhook payload object |
| github.token | Same value as secrets.GITHUB_TOKEN |
| github.workflow / github.run_id / github.run_number | Workflow name and run identifiers |
Examples
if: github.event_name == 'pull_request'Guard on trigger
run: echo ${{ github.repository }}@${{ github.sha }}Print repo + commit
if: github.actor != 'dependabot[bot]'Skip runs initiated by Dependabot
- run: gh pr comment "$NUM" --body 'hi'
env:
NUM: ${{ github.event.pull_request.number }}Read PR number from the event payload (via env to avoid injection)
Gotcha
`github.event.*` values come from an untrusted webhook payload — never interpolate PR titles or issue bodies directly into a `run:` script; pass them through `env:` and quote in the shell.
Related keywords
${{ <expression> }}
GitHub Actions expressions are evaluated by the runner and interpolated into YAML values before shells see them. They support literals, operators, contexts, and a fixed set of functions — this is unrelated to Terraform's `${}` interpolation.
env:
Defines environment variables for a scope. Declared at the workflow, job, or step level and read back via the `env` context or as real environment variables inside `run:` scripts.
${{ secrets.NAME }}
The `secrets` context exposes repository, environment, and organization secrets to workflow expressions. Values are masked in logs and are not passed to workflows triggered from forked PRs.
${{ vars.* }} / ${{ inputs.* }}
`vars` exposes non-secret configuration variables defined at the repository, environment, or organization level. `inputs` exposes typed parameters passed to `workflow_dispatch`, `workflow_call`, or composite actions.