cicd-github-actions

GitHub Actions CI/CD

Core Objectives

• Security: Minimal permissions, secrets handling, OIDC
• Performance: Caching, matrix builds, parallelization
• Maintainability: Reusable workflows, composite actions
• Reliability: Concurrency control, retry logic

Essential Checklist

• Workflows use minimal permissions (permissions: {} at root)
• Secrets never logged or exposed in artifacts
• Concurrency control configured
• Timeout values set on all jobs
• Caching implemented for dependencies
• PR workflows use pull_request, not pull_request_target
• A bordered operational header follows the workflow name:
• Untrusted contexts and inputs reach shell commands through step-level env
• Production deploys use protected GitHub Environments
• Changed workflows pass actionlint

Workflow Authoring Contract

Put a bordered operational comment block immediately after the workflow name. Use the headings Purpose, Triggers, Required Secrets, and Dependencies, with blank comment lines between sections. Record approval, rollback, recovery, or runbook requirements under Dependencies.

name: Deploy Application

# ================================================================
# Purpose: Deploys a tested release to a protected environment
#
# Triggers:
#   - Manual workflow dispatch
#
# Required Secrets:
#   - None: cloud authentication uses OIDC
#
# Dependencies:
#   - Published release artifact
#   - Production GitHub Environment approval
#   - Rollback runbook: docs/deployment-rollback.md
# ================================================================

Document reusable workflow and action inputs, outputs, secrets, defaults, and side effects where they are declared. Give jobs and non-obvious steps descriptive names, but do not add comments that merely restate YAML. Keep secret values, sensitive identifiers, and production data out of comments, summaries, logs, and artifacts.

Use the workflow documentation reference for the complete header pattern, interface descriptions, comments, summaries, and review checklist.