GitHub Actions Templates

Production-ready GitHub Actions workflow patterns for testing, building, and deploying applications.

Do not use this skill when

• The task is unrelated to github actions templates

• You need a different domain or tool outside this scope

Instructions

• Clarify goals, constraints, and required inputs.

• Apply relevant best practices and validate outcomes.

• Provide actionable steps and verification.

• If detailed examples are required, open resources/implementation-playbook.md.

Purpose

Create efficient, secure GitHub Actions workflows for continuous integration and deployment across various tech stacks.

Use this skill when

• Automate testing and deployment

• Build Docker images and push to registries

• Deploy to Kubernetes clusters

• Run security scans

• Implement matrix builds for multiple environments

Common Workflow Patterns

Pattern 1: Test Workflow

name: Test

on:

  push:

    branches: [ main, develop ]

  pull_request:

    branches: [ main ]

jobs:

  test:

    runs-on: ubuntu-latest

    strategy:

      matrix:

        node-version: [18.x, 20.x]

    steps:

    - uses: actions/checkout@v4

    - name: Use Node.js ${{ matrix.node-version }}

      uses: actions/setup-node@v4

      with:

        node-version: ${{ matrix.node-version }}

        cache: 'npm'

    - name: Install dependencies

      run: npm ci

    - name: Run linter

      run: npm run lint

    - name: Run tests

      run: npm test

    - name: Upload coverage

      uses: codecov/codecov-action@v3

      with:

        files: ./coverage/lcov.info

Reference: See assets/test-workflow.yml

Pattern 2: Build and Push Docker Image

name: Build and Push

on:

  push:

    branches: [ main ]

    tags: [ 'v*' ]

env:

  REGISTRY: ghcr.io

  IMAGE_NAME: ${{ github.repository }}

jobs:

  build:

    runs-on: ubuntu-latest

    permissions:

      contents: read

      packages: write

    steps:

    - uses: actions/checkout@v4

    - name: Log in to Container Registry

      uses: docker/login-action@v3

      with:

        registry: ${{ env.REGISTRY }}

        username: ${{ github.actor }}

        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract metadata

      id: meta

      uses: docker/metadata-action@v5

      with:

        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

        tags: |

          type=ref,event=branch

          type=ref,event=pr

          type=semver,pattern={{version}}

          type=semver,pattern={{major}}.{{minor}}

    - name: Build and push

      uses: docker/build-push-action@v5

      with:

        context: .

        push: true

        tags: ${{ steps.meta.outputs.tags }}

        labels: ${{ steps.meta.outputs.labels }}

        cache-from: type=gha

        cache-to: type=gha,mode=max

Reference: See assets/deploy-workflow.yml

Pattern 3: Deploy to Kubernetes

name: Deploy to Kubernetes

on:

  push:

    branches: [ main ]

jobs:

  deploy:

    runs-on: ubuntu-latest

    steps:

    - uses: actions/checkout@v4

    - name: Configure AWS credentials

      uses: aws-actions/configure-aws-credentials@v4

      with:

        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}

        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

        aws-region: us-west-2

    - name: Update kubeconfig

      run: |

        aws eks update-kubeconfig --name production-cluster --region us-west-2

    - name: Deploy to Kubernetes

      run: |

        kubectl apply -f k8s/

        kubectl rollout status deployment/my-app -n production

        kubectl get services -n production

    - name: Verify deployment

      run: |

        kubectl get pods -n production

        kubectl describe deployment my-app -n production

Pattern 4: Matrix Build

name: Matrix Build

on: [push, pull_request]

jobs:

  build:

    runs-on: ${{ matrix.os }}

    strategy:

      matrix:

        os: [ubuntu-latest, macos-latest, windows-latest]

        python-version: ['3.9', '3.10', '3.11', '3.12']

    steps:

    - uses: actions/checkout@v4

    - name: Set up Python

      uses: actions/setup-python@v5

      with:

        python-version: ${{ matrix.python-version }}

    - name: Install dependencies

      run: |

        python -m pip install --upgrade pip

        pip install -r requirements.txt

    - name: Run tests

      run: pytest

Reference: See assets/matrix-build.yml

Workflow Best Practices

• Use specific action versions (@v4, not @latest)

• Cache dependencies to speed up builds

• Use secrets for sensitive data

• Implement status checks on PRs

• Use matrix builds for multi-version testing

• Set appropriate permissions

• Use reusable workflows for common patterns

• Implement approval gates for production

• Add notification steps for failures

• Use self-hosted runners for sensitive workloads

Reusable Workflows

# .github/workflows/reusable-test.yml

name: Reusable Test Workflow

on:

  workflow_call:

    inputs:

      node-version:

        required: true

        type: string

    secrets:

      NPM_TOKEN:

        required: true

jobs:

  test:

    runs-on: ubuntu-latest

    steps:

    - uses: actions/checkout@v4

    - uses: actions/setup-node@v4

      with:

        node-version: ${{ inputs.node-version }}

    - run: npm ci

    - run: npm test

Use reusable workflow:

jobs:

  call-test:

    uses: ./.github/workflows/reusable-test.yml

    with:

      node-version: '20.x'

    secrets:

      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

Security Scanning

name: Security Scan

on:

  push:

    branches: [ main ]

  pull_request:

    branches: [ main ]

jobs:

  security:

    runs-on: ubuntu-latest

    steps:

    - uses: actions/checkout@v4

    - name: Run Trivy vulnerability scanner

      uses: aquasecurity/trivy-action@master

      with:

        scan-type: 'fs'

        scan-ref: '.'

        format: 'sarif'

        output: 'trivy-results.sarif'

    - name: Upload Trivy results to GitHub Security

      uses: github/codeql-action/upload-sarif@v2

      with:

        sarif_file: 'trivy-results.sarif'

    - name: Run Snyk Security Scan

      uses: snyk/actions/node@master

      env:

        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

Deployment with Approvals

name: Deploy to Production

on:

  push:

    tags: [ 'v*' ]

jobs:

  deploy:

    runs-on: ubuntu-latest

    environment:

      name: production

      url: https://app.example.com

    steps:

    - uses: actions/checkout@v4

    - name: Deploy application

      run: |

        echo "Deploying to production..."

        # Deployment commands here

    - name: Notify Slack

      if: success()

      uses: slackapi/slack-github-action@v1

      with:

        webhook-url: ${{ secrets.SLACK_WEBHOOK }}

        payload: |

          {

            "text": "Deployment to production completed successfully!"

          }

Reference Files

• assets/test-workflow.yml - Testing workflow template

• assets/deploy-workflow.yml - Deployment workflow template

• assets/matrix-build.yml - Matrix build template

• references/common-workflows.md - Common workflow patterns

Related Skills

• gitlab-ci-patterns - For GitLab CI workflows

• deployment-pipeline-design - For pipeline architecture

• secrets-management - For secrets handling

Limitations

• Use this skill only when the task clearly matches the scope described above.

• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.

• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.