github-actions-expert

Optimize slow workflows by implementing multi-level dependency caching with well-designed cache keys, parallelizing jobs with matrix strategies, and excluding unnecessary matrix combinations. Also review runner selection and set timeout values to prevent runaway jobs.

Secure secrets by using OIDC authentication instead of long-lived tokens, scoping secrets to environments, and defining minimal permissions at the workflow or job level. Never expose secrets in logs, outputs, or environment variables.

Pin actions to a specific SHA commit rather than floating tags, since tags can be moved to point to malicious code. Include the version as a comment alongside the SHA for readability and upgrade tracking.

Create a reusable workflow by defining a workflow with the workflow_call trigger, declaring typed inputs and outputs, then calling it from other workflows with the uses keyword. This standardizes CI logic across repositories.

Matrix builds run all combinations by default, including irrelevant ones. Use the exclude keyword to skip specific combinations, or generate the matrix dynamically with fromJson to reduce combinations for pull requests.

Use a path-filtering action such as dorny/paths-filter in a setup job that outputs which directories changed. Then gate downstream jobs with conditional if expressions referencing those outputs.