Ship your first CI workflow
Create .github/workflows/ci.yml to run npm ci and npm test on push and pull_request to main.
DevOps & Tooling / Knowledge library
GitHub Actions
ci/cd workflow automation in github repos
Why learn GitHub Actions?
GitHub Actions automates build, test, release, and deployment steps directly from repository events, reducing manual DevOps work and improving delivery speed, consistency, and auditability.
Where it came from
2018: GitHub Actions launched in public beta. 2019: GitHub Actions became generally available. Reusable workflows and workflow_call enabled DRY pipeline design. Environments added approval gates and deployment protections for safer releases.
- 2018: GitHub Actions launched in public beta.
- 2019: GitHub Actions became generally available.
- Reusable workflows and workflow_call enabled DRY pipeline design.
- Environments added approval gates and deployment protections for safer releases.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Create .github/workflows/ci.yml to run npm ci and npm test on push and pull_request to main.
- Extend CI to test Node 18 and 20 using strategy.matrix, and fail fast on test errors.
- Add a deploy job that runs only on main after tests pass, uses environment protection, and authenticates to cloud via OIDC (no static secrets).
- Extract shared test logic into a reusable workflow and call it from two repositories.
- Harden a workflow with least-privilege permissions, pinned action SHAs, and dependency review checks.
More ways to practice
Matrix test strategy
Extend CI to test Node 18 and 20 using strategy.matrix, and fail fast on test errors.
Secure deploy pipeline
Add a deploy job that runs only on main after tests pass, uses environment protection, and authenticates to cloud via OIDC (no static secrets).
Reusable workflow refactor
Extract shared test logic into a reusable workflow and call it from two repositories.
Policy hardening
Harden a workflow with least-privilege permissions, pinned action SHAs, and dependency review checks.
Documentation and sources
- GitHub Actions documentation (docs.github.com)
- Workflow syntax reference (docs.github.com)
- Secure use reference (docs.github.com)
- GitHub Marketplace (Actions) (github.com)
Catalog research notes
- Artifact attestations added for stronger build provenance.
- Larger GitHub-hosted runners expanded for heavier CI workloads.
- OIDC-based cloud auth guidance expanded to reduce long-lived secrets.
- Official actions migrated toward newer Node runtimes; older runtimes deprecated.
Connect the ideas
Alternatives
Explore next
DockerKubernetesTerraformJenkinsArgo CDBashBuildKitCypressdbt (data build tool)GitLab CI/CDGodotJestPlaywrightTrivyUnityUnreal EngineVite (vite)Vitest (vitest)
Real World Example
Automated Compliance Validation for FinTech Microservices
A mid-sized financial services firm managing a distributed microservices architecture.
The business problem
Manual code reviews often miss security compliance requirements, leading to delayed deployments and potential regulatory friction during the release cycle.
How this topic solves it
GitHub Actions automates the validation process by triggering a workflow on every pull request, ensuring that security scanning and linting scripts execute before any code can be merged into the production branch.
- Define a YAML workflow file in the .github/workflows directory of the repository.
- Configure the workflow to trigger on pull_request events targeting the main branch.
- Utilize GitHub-hosted runners to execute security scanning scripts and linting tools.
- Implement branch protection rules to require successful workflow completion before merging.
This diagram illustrates the automated path from code submission to merge validation.
Submits code via Pull Request
Workflow execution engine
Automated compliance script
Gatekeeper for main branch
Production-ready code
- Developer → Triggers workflow → GitHub Actions
- GitHub Actions → Executes validation → Security Scanner
- Security Scanner → Reports status → Branch Protection
- Branch Protection → Allows merge if pass → Main Branch
Expected business outcome
The team achieves consistent enforcement of security standards, reducing the frequency of manual compliance interventions and accelerating the overall release velocity.
Limitations and checks
GitHub Actions imposes execution limits on workflows, which can lead to queueing if the repository has high-frequency commit activity; monitor this via the Actions usage dashboard.