domains / devops / github-actions-templates / github-actions-templates

github-actions-templates

Skill card

combined

The two copies overlap in purpose (GitHub Actions workflow templates) but disagree on the core procedure. The first copy is a catalog of ready-to-paste YAML patterns (test, Docker, K8s, matrix, reusable, security) with generic best practices. The second copy is a security-hardened procedure that forbids the first copy's style: it requires inspecting the repo, reading specific local resources, pinning actions to full commit SHAs, setting persist-credentials: false, adding timeouts, and explicitly warns against publishing untrusted artifacts or labeling placeholders as deployments. Crowning the first copy would hide the second's mandatory security constraints and verification steps; crowning the second would hide the first's concrete multi-stack templates. They must be combined.

Repositories

Other copies

Combined skill

---
name: github-actions-templates
description: Create production-ready, security-hardened GitHub Actions workflows for testing, building, and deploying applications.
---

# GitHub Actions Templates

## When to Use
- Automate testing, building, and deployment.
- Build Docker images and push to registries.
- Deploy to Kubernetes or other targets.
- Implement matrix builds for multiple environments.

## Do Not Use When
- The task is unrelated to GitHub Actions.
- You need a different CI/CD tool.

## Inputs & Preparation
1. Inspect the repository's actual scripts, lockfile, supported runtimes, required check names, and release policy.
2. Read `resources/implementation-playbook.md` and `references/common-workflows.md` if available before choosing job boundaries.
3. Identify the immutable artifact, destination, workload identity, rollout, and rollback checks for deployment.

## Security Requirements
- Pin all third-party actions to full commit SHAs (e.g., `actions/checkout@93cb6efe...`), not major versions.
- Set `persist-credentials: false` on checkout steps.
- Set `timeout-minutes` on all jobs.
- Use secrets for sensitive data; keep production credentials absent from untrusted validation jobs.
- Review every third-party action at its full commit SHA.
- Treat logs and uploaded artifacts as possible data-exposure paths.
- Do not publish artifacts produced by arbitrary untrusted code in a privileged context.
- Bind accepted artifacts to their exact source and producing workflow.

## Workflow Patterns

### Test Workflow
```yaml
name: Test
on:
  pull_request:
  push:
    branches: [main]
permissions:
  contents: read
jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@<FULL_SHA>
        with:
          persist-credentials: false
      - uses: actions/setup-node@<FULL_SHA>
        with:
          node-version: '22'
          cache: npm
      - run: npm ci
      - run: npm test
```

### Matrix Builds
- Add a matrix only for versions and operating systems the project supports.
- Keep dependencies reproducible.
- Identify failing combinations.
- Avoid hiding failures with blanket `continue-on-error`.
- Test required-check behavior when jobs are conditionally skipped.

### Build and Publication
- Build an artifact from the tested commit and record its identity.
- Publication needs a separate trusted job with the minimum registry permission.
- Do not add registry credentials to the matrix.

### Deployment
- Use the project's protected release path.
- Verify that a named GitHub environment actually configures reviewers.
- Do not label a placeholder echo command as a successful deployment.
- For Kubernetes: configure AWS credentials, update kubeconfig, apply manifests, and verify rollout status.

### Reusable Workflows
- Use `workflow_call` for common patterns.
- Pass inputs and secrets explicitly.

## Verification
1. Exercise one passing change and one deliberate test failure on a topic branch.
2. Confirm the failing check prevents downstream publication.
3. Inspect tokens, runner isolation, caches, and artifact boundaries.

## Limitations
- This skill supplies patterns, not an installed deployment program.
- Repository policy, runner trust, and environment settings must be inspected.

## Sources
- [GitHub secure workflow guidance](https://docs.github.com/en/actions/reference/security/secure-use)