Backend6 min read

GitHub Actions

GitHub's built-in CI/CD platform - automate testing, building, and deploying on push, PR, or schedule with reusable workflows and 10,000+ community actions.

GitHub ActionsCI/CDDevOpsAutomationWorkflows

skill: GitHub Actions category: Backend tags: [GitHub Actions, CI/CD, DevOps, Automation, Workflows] readingTime: 6

GitHub Actions is the default CI/CD for GitHub-hosted projects - zero setup, free for public repos, and tightly integrated with PRs and deployments. For large-scale enterprise CI with advanced caching and parallelism, CircleCI or Buildkite may outperform. For non-GitHub repos, GitLab CI or Jenkins are the alternatives.

Workflow

Write a basic CI workflowAutomated tests on every PR catch regressions before they merge - the foundation of any CI pipeline.
Cache dependencies for speednpm ci from scratch on every run takes 30-60s. Caching the node_modules layer reduces it to < 5s on cache hit.
Use secrets for sensitive valuesAPI keys and passwords in workflow files are visible to anyone with repo access. GitHub Secrets are encrypted and only exposed to runners.
Build and push Docker imagesGitHub Actions is the standard place to build and push Docker images to a registry on every merge to main.
Run a matrix of configurationsMatrix builds run the same job across multiple OS versions, Node.js versions, or database versions in parallel - catching compatibility issues.

Output Format

GitHub Actions CI/CD pipeline: test → lint → build → Docker push → deploy.

.github/workflows/
├── ci.yml           # Test + lint on PR
├── build.yml        # Docker build + push on merge
└── deploy.yml       # Deploy to staging/prod after build

Examples

Input

Output

Edge Cases & Gotchas

Workflow permissions - New GitHub repos default to restrictive permissions. Set permissions: { contents: write, packages: write } at the job level for jobs that push to the registry or create releases.
GITHUB_TOKEN expiry - GITHUB_TOKEN is scoped to the current workflow run and expires after the run. For operations that outlive the run (scheduled tasks, webhooks), use a PAT stored as a secret.
Self-hosted runner security - Self-hosted runners execute arbitrary code from PRs. Only allow self-hosted runners on private repos or require approval for PR workflows from outside contributors.
Concurrency and queue buildup - Multiple rapid pushes queue up runs. Use concurrency: { group: ${{ github.ref }}, cancel-in-progress: true } to cancel stale runs.

When to Break These Rules

Use Buildkite or CircleCI when GitHub Actions' queue times under high load are unacceptable - both offer dedicated, faster runners.
Use ArgoCD for Kubernetes GitOps deployments instead of triggering kubectl apply from GitHub Actions - ArgoCD provides drift detection and rollback UI.

Reference Files

https://docs.github.com/en/actions
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions