github-actions

GitHub Actions automates CI/CD pipelines through workflow files in .github/workflows/. Define triggers (push, pull_request), jobs with steps, environment variables, and secrets. Start with a basic workflow: run on push to main, install dependencies, execute tests, and upload artifacts.

Least-privilege permissions restrict GITHUB_TOKEN access to only required scopes per job. Set permissions at workflow or job level to limit token capabilities—grant only read for contents, write for pull-requests, or other specific actions needed. Reduces security risk from compromised tokens.

Matrix strategies run a job across multiple Node.js versions, operating systems, or custom variables in parallel. Define matrix values in your workflow; each combination generates a separate job instance. Reduces duplication and speeds up testing across environments.

Reusable workflows allow you to centralize common CI/CD logic and call it from other workflows using uses keyword. Define the workflow once, then reference it from multiple pipelines. Improves maintainability, consistency, and reduces duplication across projects.

Caching stores dependencies between workflow runs using the cache action. Specify paths (node_modules, vendor/) and a cache key. Restored cache reduces installation time on subsequent runs, accelerating build and test stages significantly.

Store secrets in repository or organization settings; reference them as ${{ secrets.SECRET_NAME }} in workflows. GitHub encrypts secrets at rest and masks them in logs. Combine with least-privilege permissions and avoid hardcoding sensitive data in workflows or version control.