Build & Secure GitHub Actions CI/CD Pipelines

GitHub Actions Workflow Design guides the construction of organized CI/CD pipelines. It combines workflow triggers and YAML structure with job dependencies, matrix execution, deployment conditions, security permissions, caching, and reusable components. A pipeline can separate testing, building, and deployment while passing outputs between jobs.

Trigger patterns include pushes and pull requests on selected branches, ignored documentation paths, and manual workflow_dispatch inputs that choose a deployment environment. Matrix testing spans operating systems and Node.js versions, with an additional matrix entry enabling coverage. Build depends on testing and exposes an image digest; deployment depends on earlier jobs and checks the main branch.

Security examples declare explicit repository, package, and security-event permissions. They use the GitHub token for checkout, AWS role-based credential configuration, Docker content-trust settings, and Trivy vulnerability scanning with SARIF output. The broader guidance includes pinned action references, environment-specific secrets, production environment protection rules, and artifact attestations for supply-chain security.

Runner selection and workflow performance monitoring support tuning. Performance patterns cache dependency directories and Docker layers using runner-specific keys, lockfile hashes, and fallback restore keys. Path filtering distinguishes backend from frontend changes so deployment jobs can respond to the affected part of a repository. Environment names can vary between production and staging, and deployment outputs can expose a resulting URL.

Use this skill when a workflow needs several test environments, ordered build and deploy jobs, selective execution, or shared deployment logic. It also applies when reducing repeated dependency work or adding failure diagnostics to an existing pipeline.

The YAML examples contain specific action references, runtime versions, registry settings, and file paths. They are patterns to adapt to a repository's requirements rather than a completed pipeline for every project. Production rollout behavior depends on the configured conditions, protection rules, and environment secrets.

Inputs include branches, event types, changed paths, runtime matrices, dependency lockfiles, environment names, image tags, and deployment secrets. Outputs include workflow YAML, build digests, uploaded test results and coverage, vulnerability reports, deployment URLs, and failure notifications.

Failure-handling examples retry tests with bounded attempts and a timeout, upload artifacts even when a job fails, and send a Slack notification on failure. Reusable workflows define typed inputs, required secrets, and an exposed deployment URL. Dynamic matrices can be generated from a preceding setup job's JSON output. A concurrency group controls overlapping deployments:

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: false