A pull request is the proposal. Merging is the execution. When a pull request is approved and its checks pass, GitHub offers three distinct buttons: “Merge commit”, “Squash and merge”, and “Rebase and merge”. These are not cosmetic variations of the same action. Each produces a fundamentally different shape of Git history, and the choice…
A repository is only as safe as the gates that guard its main branch. Branch protection rules are those gates: they define who can push, what must pass before a merge, and whether history can be rewritten. CODEOWNERS is the routing table that ensures the right people review the right files. Used together, they turn…
GitHub Projects (v2) is not a board. It is a database with multiple views. This distinction is the single most important concept to internalize before touching the interface. The classic Projects product—columns of cards, one board per repository—is deprecated and being retired. The modern Projects product stores items as rows in a table, and the…
A tag is a Git concept: a fixed pointer to a specific commit that never moves. A release is a GitHub concept layered on top of a tag: a page with release notes and downloadable binary artifacts. Confusing the two is common. You can tag a commit without creating a release, but you cannot create…
GitHub Pages turns a repository into a static website. It is not a general-purpose web host. It serves HTML, CSS, JavaScript, and assets directly from a branch or a GitHub Actions artifact, with no server-side execution, no database, and no dynamic request handling. For documentation, project landing pages, and personal blogs, it is free, integrated…
A repository is more than a folder of code. It is a workspace with rules, workflows, and community expectations. GitHub defines a special directory, .github, where configuration files that shape the repository’s behavior live. The files inside this directory are not code—they are the contracts that govern how contributions are made, how issues are triaged,…
GitHub Actions is an automation platform built into GitHub. It runs workflows—a sequence of jobs and steps—in response to events like a push, a pull request, or a scheduled time. A workflow is defined in a YAML file inside .github/workflows/. The file names the triggers, defines the jobs, specifies the runner environment, and lists the…
A workflow that runs tests is continuous integration. A workflow that builds, tests, and deploys is continuous delivery. A workflow that deploys automatically on every merge to main is continuous deployment. GitHub Actions supports all three, but the difference between them is not the YAML syntax—it is the gates, environments, and conditions that separate one…
GitHub Packages is a package hosting service integrated directly into GitHub. It provides registries for npm, RubyGems, Maven, Gradle, NuGet, and Docker/OCI container images. The container registry, GHCR (GitHub Container Registry), is the most widely used component because it stores Docker images alongside source code, links them to repositories, and authenticates through the same GITHUB_TOKEN…
Dependabot is not a single feature. It is three distinct mechanisms that share a common foundation: the dependency graph. Dependabot alerts notify you when a dependency in your project has a known vulnerability. Dependabot security updates automatically open pull requests to fix those vulnerabilities. Dependabot version updates keep dependencies current even when no vulnerability exists,…