domains / devops / github-actions-ci-cd / github-actions

github-actions

Skill card

combined

The copies cover different scopes of the same skill name. BagelHole and sickn33 are nearly identical general GitHub Actions references, with sickn33 adding a security/scope section and safer runner registration guidance. callstackincubator is a specialized React Native mobile build artifact skill that references composite actions and gh CLI downloads not present in the others. Crowning one would hide either the mobile artifact workflow or the security constraints.

Repositories

Other copies

Combined skill

---
name: github-actions
description: Build, test, and deploy applications using GitHub Actions workflows, including general CI/CD patterns and React Native mobile artifact builds.
license: MIT
---

# GitHub Actions

Automate software workflows in GitHub repositories. Use this skill for general CI/CD pipelines, reusable workflows, secrets, caching, artifacts, Docker builds, self-hosted runners, and React Native mobile artifact builds.

## When to Use

- Setting up CI/CD pipelines for GitHub repositories.
- Automating build, test, and deployment workflows.
- Creating reusable workflow components.
- Configuring self-hosted runners.
- Managing workflow secrets and variables.
- Debugging failed workflow runs.
- Building React Native iOS simulator or Android emulator artifacts in CI.
- Downloading GitHub Actions artifacts via gh CLI or GitHub API.

## Prerequisites

- GitHub repository with write access.
- Understanding of YAML syntax.
- For self-hosted runners: a server with Docker (optional).
- For mobile artifact workflows: access to the referenced composite actions and gh CLI or GitHub API.

## Scope and Security Notes

Examples are independent YAML fragments, not a complete deployable pipeline. Each new job needs its own checkout, tool setup, locked dependency installation, and artifact transfer; jobs do not share a working directory. Review untrusted event inputs, least-privilege permissions, protected environments, and secret exposure before adoption. Image push, deployment, and runner registration require authorization.

## Workflow File Structure

Workflows are defined in `.github/workflows/`:

```yaml
name: CI Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'
      - run: npm ci
      - run: npm test
```

## Common Triggers

### Push and Pull Request

```yaml
on:
  push:
    branches: [main]
    paths:
      - 'src/**'
      - 'package.json'
  pull_request:
    branches: [main]
```

### Scheduled Runs

```yaml
on:
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM UTC
```

### Manual Dispatch

```yaml
on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Deployment environment'
        required: true
        default: 'staging'
        type: choice
        options:
          - staging
          - production
```

## Job Configuration

### Matrix Builds

```yaml
jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [22, 24]
        os: [ubuntu-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
      - run: npm test
```

### Job Dependencies

```yaml
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: npm run build

  test:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - run: npm test

  deploy:
    needs: [build, test]
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh
```

### Environment Protection

```yaml
jobs:
  deploy:
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://example.com
    steps:
      - run: ./deploy.sh
```

## Secrets and Variables

### Using Secrets

```yaml
steps:
  - name: Deploy
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    run: aws s3 sync ./dist s3://my-bucket
```

### Using Variables

```yaml
steps:
  - name: Build
    env:
      API_URL: ${{ vars.API_URL }}
    run: npm run build
```

## Caching Dependencies

```yaml
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-node-
```

## Artifacts

### Upload Artifacts

```yaml
- uses: actions/upload-artifact@v4
  with:
    name: build-output
    path: dist/
    retention-days: 5
```

### Download Artifacts

```yaml
- uses: actions/download-artifact@v4
  with:
    name: build-output
    path: dist/
```

## Docker Builds

```yaml
jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: user/app:latest
```

## Reusable Workflows

### Define Reusable Workflow

```yaml
# .github/workflows/reusable-deploy.yml
name: Reusable Deploy

on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
    secrets:
      deploy_key:
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - name: Report selected environment
        env:
          DEPLOY_ENVIRONMENT: ${{ inputs.environment }}
        run: printf 'Deploying to %s\n' "$DEPLOY_ENVIRONMENT"
```

### Call Reusable Workflow

```yaml
jobs:
  deploy-staging:
    uses: ./.github/workflows/reusable-deploy.yml
    with:
      environment: staging
    secrets:
      deploy_key: ${{ secrets.STAGING_KEY }}
```

## Self-Hosted Runners

Use the selected repository's current runner setup instructions. Verify the official release checksum before extracting or executing it, choose the intended architecture, and use a short-lived registration token without printing it. Do not use a historical hardcoded runner version. Treat self-hosted runner access as highly privileged.

## React Native Mobile Artifact Builds

For React Native iOS simulator and Android emulator cloud builds:

1. Add composite actions for iOS simulator `.app.tar.gz` builds and Android emulator `.apk` builds.
2. Wire them into `.github/workflows/mobile-build.yml`.
3. Upload with `actions/upload-artifact@v4` and capture `artifact-id` output.
4. Download with `gh run download` or `GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/{archive_format}`.

## Debugging Workflows

### Enable Debug Logging

Set repository secrets:
- `ACTIONS_RUNNER_DEBUG`: `true`
- `ACTIONS_STEP_DEBUG`: `true`

### Debug Step

```yaml
- name: Debug
  run: |
    echo "GitHub context: ${{ toJson(github) }}"
    echo "Job context: ${{ toJson(job) }}"
```

## Common Issues

### Workflow Not Triggering
Check branch filters, path filters, and ensure the workflow file is on the default branch.

### Permission Denied
Configure `permissions` in the workflow or update repository settings.

```yaml
permissions:
  contents: write
  pull-requests: write
```