A deployment workflow can be started after a build workflow has finished by using the workflow_run event in the deployment workflow's on trigger. You must specify the name of the build workflow you want to trigger on and use an if condition to ensure the deployment workflow only runs if the build workflow successfully completes.
Here's how to set it up:
In your deployment workflow file: (e.g., deploy.yml), define the on: trigger.
Use the workflow_run event: within the on: trigger.
Specify the build workflow: by its name.
Add a conditional if statement: to the workflow to check the conclusion of the workflow_run event, ensuring it equals 'success'.
Reference:
https://docs.github.com/actions/learn-github-actions/events-that-trigger-workflows

GitHub secrets are defined at different levels: organization, repository, and sometimes at the workflow level. If a secret is defined at both the organization level and the repository level, the repository-level secret will take precedence. So, if the value of the secret differs between these levels, the workflow will use the value from the repository level instead of the organization level.

The GITHUB_REF environment variable specifies the branch or tag that triggered the workflow. It contains the full reference to the branch or tag, such as refs/heads/main for a branch or refs/tags/v1.0 for a tag.

The action.yml file is the metadata file in a custom GitHub Action that defines the main entry point, including information such as the inputs, outputs, description, and the runs key that specifies the main entry point (e.g., a script or a Docker container).

GitHub-hosted runners automatically handle patching, meaning they will be kept up to date with the latest security updates and software patches for both the runner environment and the underlying operating system.
GitHub-hosted runners support Linux, Windows, and macOS, giving you flexibility to run workflows on different operating systems without needing to manage your own self-hosted runners.