github-actions

GitHub Actions

GitHub Actions automates software workflows with event-driven CI/CD pipelines. Workflows are YAML files in .github/workflows/ that define jobs, steps, and actions triggered by repository events.

Action types:

• Workflow files: CI/CD pipelines using existing actions (.github/workflows/*.yml)
• Custom JavaScript actions: Fast, cross-platform, use @actions/toolkit
• Custom Docker actions: Full environment control, Linux only, slower startup
• Composite actions: Combine multiple steps into reusable units

Quick Start

# .github/workflows/ci.yml
name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run tests
        run: npm test

Ruby/Rails with RSpec:

- uses: ruby/setup-ruby@v1
  with:
    ruby-version: .ruby-version
    bundler-cache: true

- name: Setup database
  env:
    RAILS_ENV: test
  run: bin/rails db:setup

- run: bundle exec rspec

TypeScript/Node.js:

- uses: actions/setup-node@v4
  with:
    node-version: '20'
    cache: 'npm'

- run: npm ci
- run: npm run build --if-present
- run: npm test

Deploy to Fly.io:

- uses: superfly/flyctl-actions/[email protected]
- run: flyctl deploy --remote-only
  env:
    FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

Creating Workflows

1. Identify triggers: push, pull_request, workflow_dispatch, schedule, etc.
2. Define jobs: Specify runner OS, steps, and dependencies
3. Add security: Set GITHUB_TOKEN permissions to read-only, pin actions to SHA
4. Optimize performance: Enable caching, use matrix builds for parallelization
5. Test locally: Use act or GitHub CLI to test before pushing

Evaluating Workflows

1. Security scan: Check permissions, secrets exposure, action pinning, pull_request_target usage
2. Performance analysis: Identify slow steps, missing caches, parallelization opportunities
3. Best practices review: Validate naming, structure, error handling, documentation