DevOps / GitHub Actions Interview Questions
How do you trigger one GitHub Actions workflow from another using workflow_run?
workflow_run fires a workflow when a named workflow completes (or starts). This lets you chain independent workflows without merging them into one file — useful for separating CI (fast, runs on all PRs) from CD (slow, only runs after CI passes on main).
# .github/workflows/deploy.yml on: workflow_run: workflows: ["CI"] # exact name of the upstream workflow types: [completed] branches: [main] # only when CI ran on main jobs: deploy: if: ${{ github.event.workflow_run.conclusion == 'success' }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: ./deploy.sh
The if: check on the job is critical. workflow_run fires regardless of whether the upstream workflow succeeded or failed — the conclusion can be success, failure, cancelled, or timed_out. Without the check, your deploy job would run even on a failed CI.
Important security note: workflow_run always runs in the context of the default branch, not the branch that triggered the upstream workflow. This gives it access to repository secrets even for fork PRs — which is intentional for use-cases like uploading test coverage from fork PRs. However it also means you must be careful not to execute untrusted code from the fork in the workflow_run context.
For simpler same-workflow chaining (one job triggers another), use needs: instead. Use workflow_run only when the two workflows must remain separate files or when you need the default-branch security context.
More Related questions...