Mastering GitHub Actions Workflow Triggers (2025): Common Mistakes and How to Avoid Them

# .github/workflows/example.yml
name: Example Workflow

on:
  # Single event (string)
  push

# OR multiple events (array)
on: [push, pull_request]

# OR detailed configuration (object)
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

on:
  push:
    branches:
      - main
      - 'release/**'  # Glob pattern: any branch starting with release/
    tags:
      - 'v*'          # Any tag starting with v (e.g., v1.0.0)

on:
  pull_request:
    types: [opened, reopened, synchronize]  # Default types
    branches:
      - main
    paths:
      - 'src/**'     # Only trigger if src/ files change
      - '!src/docs/**'  # Exclude docs subdirectory

on:
  schedule:
    # Run every day at 2 AM UTC
    - cron: '0 2 * * *'
    # Run every Monday at 9 AM UTC
    - cron: '0 9 * * 1'

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Deployment environment'
        required: true
        default: 'staging'
        type: choice
        options:
          - staging
          - production
      debug:
        description: 'Enable debug logging'
        required: false
        type: boolean

on:
  repository_dispatch:
    types: [deploy-backend, deploy-frontend]

on:
  push:
    branches:
      - main
      - develop
      - 'feature/**'    # All feature branches
      - '!feature/experimental'  # Exclude specific branch
    branches-ignore:
      - 'dependabot/**'  # Alternative: ignore pattern

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'  # Semantic versions like v1.2.3
      - 'release-*'               # Release tags
    tags-ignore:
      - 'beta-*'                  # Ignore beta tags

on:
  push:
    paths:
      - 'src/**'           # Any file in src directory
      - 'package.json'     # Specific file
      - '**.js'            # All JavaScript files (recursive)
    paths-ignore:
      - 'docs/**'          # Ignore documentation changes
      - '**.md'            # Ignore markdown files
      - '.github/**'       # Ignore workflow changes

# .github/workflows/backend.yml
name: Backend CI

on:
  pull_request:
    paths:
      - 'backend/**'
      - 'shared/**'
      - 'package.json'
    paths-ignore:
      - 'backend/docs/**'
      - '**.md'

on:
  pull_request:
    types:
      - opened          # New PR created
      - reopened        # Closed PR reopened
      - synchronize     # New commits pushed to PR
      - ready_for_review  # Draft converted to ready
  
  issues:
    types: [opened, labeled]
  
  release:
    types: [published, created]

on:
  push:
    branches: [main]     # AND
    paths: ['src/**']    # Must match BOTH conditions
  
  pull_request:
    branches: [main]     # OR (separate event)
    paths: ['src/**']

name: Go Build

on:
  push:
    branches:
      - main
      - 'release/**'
    paths:
      - '**.go'
      - 'go.mod'
      - 'go.sum'
      - '.github/workflows/go-build.yml'  # Re-run if workflow changes

# ❌ WRONG: Doesn't match subdirectories
paths: ['src/*.js']

# ✅ CORRECT: Matches all JS in src tree
paths: ['src/**.js']

# ❌ WRONG: Negation not at start of pattern
paths: ['src/!test/**']

# ✅ CORRECT: Use paths-ignore instead
paths: ['src/**']
paths-ignore: ['src/test/**']

# .github/workflows/deploy.yml
name: Deploy to Production

on:
  workflow_run:
    workflows: ["CI Build"]  # Name of the prerequisite workflow
    types: [completed]
    branches: [main]

jobs:
  deploy:
    # Only deploy if the CI workflow succeeded
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    steps:
      - name: Deploy application
        run: |
          echo "CI passed, deploying..."
          # Deployment logic here

# .github/workflows/reusable-build.yml
name: Reusable Build

on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
      version:
        required: false
        type: string
        default: 'latest'
    outputs:
      artifact-url:
        description: "URL of the built artifact"
        value: ${{ jobs.build.outputs.url }}

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      url: ${{ steps.upload.outputs.artifact-url }}
    steps:
      - name: Build for ${{ inputs.environment }}
        run: echo "Building version ${{ inputs.version }}"

# .github/workflows/caller.yml
name: Main Pipeline

on: [push]

jobs:
  staging-build:
    uses: ./.github/workflows/reusable-build.yml
    with:
      environment: staging
      version: '1.2.3'
  
  production-build:
    uses: ./.github/workflows/reusable-build.yml
    with:
      environment: production
    secrets: inherit  # Pass secrets to reusable workflow

# Repository A: .github/workflows/notify.yml
name: Notify Other Repos

on: [push]

jobs:
  dispatch:
    runs-on: ubuntu-latest
    steps:
      - name: Trigger workflow in Repository B
        run: |
          curl -X POST \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer ${{ secrets.PAT_TOKEN }}" \
            https://api.github.com/repos/org/repo-b/dispatches \
            -d '{"event_type":"deploy-backend","client_payload":{"version":"1.0.0"}}'

# Repository B: .github/workflows/deploy.yml
name: Deploy Backend

on:
  repository_dispatch:
    types: [deploy-backend]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy version ${{ github.event.client_payload.version }}
        run: echo "Deploying backend"

name: Conditional Pipeline

on: [push, pull_request]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Run tests
        run: npm test
  
  deploy:
    needs: test
    # Only deploy on push to main, not on PRs
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to production
        run: echo "Deploying..."

name: Manual Deployment

on:
  workflow_dispatch:  # No inputs, just a manual trigger button

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy
        run: echo "Manually triggered deployment"

gh workflow run "Manual Deployment" \
  --ref main

name: Parameterized Deploy

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Target environment'
        required: true
        type: choice
        options:
          - development
          - staging
          - production
        default: staging
      
      version:
        description: 'Version to deploy'
        required: true
        type: string
      
      dry_run:
        description: 'Perform dry run only'
        required: false
        type: boolean
        default: false
      
      log_level:
        description: 'Logging verbosity'
        type: choice
        options:
          - debug
          - info
          - warning
        default: info

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy ${{ inputs.version }} to ${{ inputs.environment }}
        run: |
          echo "Environment: ${{ inputs.environment }}"
          echo "Version: ${{ inputs.version }}"
          echo "Dry run: ${{ inputs.dry_run }}"
          echo "Log level: ${{ inputs.log_level }}"
          
          if [ "${{ inputs.dry_run }}" = "true" ]; then
            echo "DRY RUN MODE - No actual deployment"
          else
            echo "Deploying for real..."
          fi

gh workflow run "Parameterized Deploy" \
  --ref main \
  -f environment=production \
  -f version=v2.5.0 \
  -f dry_run=false \
  -f log_level=debug

name: Flexible Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      skip_tests:
        description: 'Skip test suite'
        type: boolean
        default: false

jobs:
  test:
    # Skip tests if manually triggered with skip_tests=true
    if: github.event_name != 'workflow_dispatch' || !inputs.skip_tests
    runs-on: ubuntu-latest
    steps:
      - name: Run tests
        run: npm test
  
  build:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - name: Build application
        run: npm run build

# ❌ Can cause duplicate runs
on:
  pull_request:
  workflow_dispatch:

# If you manually trigger this workflow while a PR is open,
# you might get two concurrent runs

on:
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true  # Cancel older runs

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: echo "Building..."

# ❌ Triggers on EVERY push to ANY branch
on: push

# ✅ Specific branches and paths
on:
  push:
    branches: [main, develop]
    paths:
      - 'src/**'
      - 'package.json'
    paths-ignore:
      - '**.md'
      - 'docs/**'

# ❌ Generic name
name: CI

# ✅ Descriptive name
name: Backend API - Test & Build

git commit -m "Update README [skip ci]"
git push

name: Deploy Pipeline

on:
  push:
    branches: [main]

concurrency:
  group: production-deploy  # Only one production deploy at a time
  cancel-in-progress: false  # Wait for current deploy to finish

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - run: echo "Deploying..."

concurrency:
  group: pr-${{ github.event.pull_request.number }}
  cancel-in-progress: true  # Cancel outdated PR builds

jobs:
  deploy-production:
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - name: Deploy
        run: echo "Deploying to production"
  
  notify-failure:
    if: failure()  # Only runs if previous jobs failed
    runs-on: ubuntu-latest
    steps:
      - name: Send alert
        run: echo "Deployment failed!"

# .github/workflows/service-a.yml
name: Service A - CI/CD

on:
  push:
    branches: [main]
    paths:
      - 'services/service-a/**'
      - 'shared/**'
      - 'package.json'
  pull_request:
    paths:
      - 'services/service-a/**'
      - 'shared/**'

# ✅ Separate workflows
# .github/workflows/ci.yml - runs on all PRs
# .github/workflows/cd.yml - runs on main branch only

# Use workflow_run to chain them

# Workflow only runs on main, but you pushed to develop
on:
  push:
    branches: [main]

# This only monitors the default branch for changes
on:
  schedule:
    - cron: '0 0 * * *'

# Won't run when PR is labeled unless you add it
on:
  pull_request:
    types: [opened, synchronize, reopened, labeled]

# Both triggers fire on a push to main
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
# Solution: Be more specific or use concurrency groups

# ❌ Matches ALL files (double star matches everything)
paths: ['**']

# ✅ Be specific
paths: ['src/**/*.js']

# Add a check to see if the job is too delayed
jobs:
  scheduled-task:
    runs-on: ubuntu-latest
    steps:
      - name: Check if we're on time
        run: |
          SCHEDULED_TIME="0 2 * * *"  # Expected 2 AM
          CURRENT_HOUR=$(date +%H)
          
          if [ $CURRENT_HOUR -gt 3 ]; then
            echo "::warning::Scheduled job ran late (expected 2 AM, now ${CURRENT_HOUR}:00)"
          fi

# Their configuration
on:
  pull_request:
  workflow_dispatch:

# What happened:
# 1. PR opened → workflow runs (correct)
# 2. They manually triggered the workflow via UI to debug
# 3. Two workflows ran concurrently on the same commit

on:
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  debug:
    runs-on: ubuntu-latest
    steps:
      - name: Dump GitHub context
        run: echo '${{ toJSON(github) }}'
      
      - name: Show event name
        run: echo "Triggered by: ${{ github.event_name }}"
      
      - name: Show ref
        run: echo "Ref: ${{ github.ref }}"

gh run list --workflow="CI Build"
gh run view <run-id>

git checkout -b test-workflow-triggers
# Make test changes
git push origin test-workflow-triggers
# Observe which workflows trigger

# Install actionlint
brew install actionlint

# Validate workflow files
actionlint .github/workflows/*.yml

on:
  pull_request:  # Runs from fork, NO write access to base repo

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Run tests
        run: npm test
      # ✅ Safe: No secrets exposed, read-only access

on:
  pull_request_target:  # ⚠️ Runs with base repo permissions

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}  # Checking out PR code
      
      - name: Run untrusted code
        run: npm test  # ❌ DANGER: Running potentially malicious code with secrets

on:
  pull_request_target:

jobs:
  label-pr:
    runs-on: ubuntu-latest
    steps:
      # ✅ Safe: Not checking out PR code
      - name: Add label
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              labels: ['needs-review']
            })

jobs:
  deploy:
    environment: production  # Requires manual approval
    runs-on: ubuntu-latest
    steps:
      - name: Deploy with secrets
        run: |
          echo "Deploying with ${{ secrets.PROD_API_KEY }}"

on:
  push:
    branches: [main]  # Only main branch can trigger deployment

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy
        env:
          API_KEY: ${{ secrets.PROD_API_KEY }}
        run: ./deploy.sh

on:
  workflow_dispatch:  # Manual approval required

jobs:
  privileged-task:
    runs-on: ubuntu-latest
    steps:
      - name: Access sensitive resources
        env:
          SECRET: ${{ secrets.ADMIN_TOKEN }}
        run: echo "Performing privileged operation"

50 developers × 5 PRs/week × 3 commits/PR = 750 commits/week

If each commit triggers 3 workflows (lint, test, build):
750 × 3 = 2,250 workflow runs/week

At 5 minutes per workflow:
2,250 × 5 = 11,250 minutes/week ≈ 45,000 minutes/month

For private repos: $0.008/minute = $360/month

on:
  pull_request:
    paths:
      - 'src/**'      # Only source code
      - 'package.json'
    paths-ignore:
      - '**.md'       # Skip documentation

concurrency:
  group: pr-${{ github.event.pull_request.number }}
  cancel-in-progress: true  # Cancel older runs when new commits pushed

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-npm-
      
      - run: npm install
      - run: npm test

# ❌ Inefficient: 3 separate workflows
# - lint.yml
# - test.yml
# - build.yml

# ✅ Efficient: 1 workflow with 3 jobs
name: CI Pipeline

on:
  pull_request:

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - run: npm run lint
  
  test:
    runs-on: ubuntu-latest
    steps:
      - run: npm test
  
  build:
    runs-on: ubuntu-latest
    needs: [lint, test]  # Only build if lint & test pass
    steps:
      - run: npm run build

# .github/workflows/service-matrix.yml
name: Monorepo CI

on:
  pull_request:
    paths:
      - 'services/**'

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      services: ${{ steps.filter.outputs.changes }}
    steps:
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            service-a:
              - 'services/service-a/**'
            service-b:
              - 'services/service-b/**'
            service-c:
              - 'services/service-c/**'
  
  build:
    needs: detect-changes
    if: needs.detect-changes.outputs.services != '[]'
    strategy:
      matrix:
        service: ${{ fromJSON(needs.detect-changes.outputs.services) }}
    runs-on: ubuntu-latest
    steps:
      - name: Build ${{ matrix.service }}
        run: echo "Building ${{ matrix.service }}"

concurrency:
  # Limit concurrent runs per branch
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15  # Prevent stuck jobs from blocking queue
    steps:
      - run: npm test

# .github/workflows/monorepo-ci.yml
name: Monorepo CI/CD

on:
  pull_request:
    paths:
      - 'services/**'
      - 'shared/**'
  push:
    branches: [main]
    paths:
      - 'services/**'
      - 'shared/**'

jobs:
  # Detect which services changed
  changes:
    runs-on: ubuntu-latest
    outputs:
      frontend: ${{ steps.filter.outputs.frontend }}
      backend: ${{ steps.filter.outputs.backend }}
      api: ${{ steps.filter.outputs.api }}
    steps:
      - uses: actions/checkout@v4
      
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            frontend:
              - 'services/frontend/**'
              - 'shared/**'
            backend:
              - 'services/backend/**'
              - 'shared/**'
            api:
              - 'services/api/**'
              - 'shared/**'
  
  # Build frontend only if changed
  build-frontend:
    needs: changes
    if: needs.changes.outputs.frontend == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build frontend
        run: |
          cd services/frontend
          npm install
          npm run build
  
  # Build backend only if changed
  build-backend:
    needs: changes
    if: needs.changes.outputs.backend == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build backend
        run: |
          cd services/backend
          go build ./...
  
  # Build API only if changed
  build-api:
    needs: changes
    if: needs.changes.outputs.api == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build API
        run: |
          cd services/api
          mvn clean package

# Repository: service-a
# .github/workflows/deploy.yml
name: Deploy Service A

on:
  push:
    branches: [main]
    paths:
      - 'src/**'
      - 'Dockerfile'

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Build and deploy Service A
        run: |
          docker build -t service-a:${{ github.sha }} .
          # Deployment logic
      
      - name: Trigger Service B rebuild
        run: |
          curl -X POST \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer ${{ secrets.DISPATCH_TOKEN }}" \
            https://api.github.com/repos/myorg/service-b/dispatches \
            -d '{
              "event_type": "service-a-updated",
              "client_payload": {
                "service_a_version": "${{ github.sha }}",
                "triggered_by": "${{ github.actor }}"
              }
            }'

# Repository: service-b
# .github/workflows/rebuild.yml
name: Rebuild Service B

on:
  repository_dispatch:
    types: [service-a-updated]
  push:
    branches: [main]

jobs:
  rebuild:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Update Service A dependency
        if: github.event_name == 'repository_dispatch'
        run: |
          echo "Service A updated to: ${{ github.event.client_payload.service_a_version }}"
          # Update dependency reference
      
      - name: Build Service B
        run: docker build -t service-b:${{ github.sha }} .

# .github/workflows/release.yml
name: Release Pipeline

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'  # Matches v1.0.0, v2.3.4, etc.

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Validate tag format
        run: |
          TAG="${{ github.ref_name }}"
          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Invalid tag format: $TAG"
            exit 1
          fi
      
      - name: Check if tag matches package.json version
        run: |
          TAG="${{ github.ref_name }}"
          PACKAGE_VERSION=$(node -p "require('./package.json').version")
          
          if [ "$TAG" != "v$PACKAGE_VERSION" ]; then
            echo "Tag $TAG doesn't match package.json version v$PACKAGE_VERSION"
            exit 1
          fi
  
  build:
    needs: validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Build release artifact
        run: npm run build
      
      - name: Create release archive
        run: tar -czf release-${{ github.ref_name }}.tar.gz dist/
      
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: release-artifact
          path: release-${{ github.ref_name }}.tar.gz
  
  deploy-production:
    needs: build
    runs-on: ubuntu-latest
    environment: production  # Requires manual approval
    steps:
      - name: Download artifact
        uses: actions/download-artifact@v4
        with:
          name: release-artifact
      
      - name: Deploy to production
        run: |
          echo "Deploying version ${{ github.ref_name }} to production"
          # Deployment commands
      
      - name: Create GitHub Release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ github.ref_name }}
          release_name: Release ${{ github.ref_name }}
          draft: false
          prerelease: false

# Ensure version is updated in package.json
git tag v1.2.3
git push origin v1.2.3

# .github/workflows/maintenance.yml
name: Scheduled Maintenance

on:
  schedule:
    # Daily at 2 AM UTC - database cleanup
    - cron: '0 2 * * *'
    # Weekly on Monday at 6 AM UTC - dependency updates
    - cron: '0 6 * * 1'
  
  workflow_dispatch:  # Allow manual runs
    inputs:
      task:
        description: 'Maintenance task to run'
        type: choice
        options:
          - database-cleanup
          - dependency-update
          - both
        default: both

jobs:
  database-cleanup:
    # Run daily or when manually triggered
    if: |
      (github.event.schedule == '0 2 * * *') ||
      (github.event_name == 'workflow_dispatch' && 
       (inputs.task == 'database-cleanup' || inputs.task == 'both'))
    runs-on: ubuntu-latest
    steps:
      - name: Clean old database records
        run: |
          echo "Cleaning records older than 90 days"
          # Cleanup logic
  
  dependency-update:
    # Run weekly or when manually triggered
    if: |
      (github.event.schedule == '0 6 * * 1') ||
      (github.event_name == 'workflow_dispatch' && 
       (inputs.task == 'dependency-update' || inputs.task == 'both'))
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Update dependencies
        run: |
          npm update
          npm audit fix
      
      - name: Create PR if changes exist
        run: |
          if [[ -n $(git status -s) ]]; then
            git config user.name "github-actions[bot]"
            git config user.email "github-actions[bot]@users.noreply.github.com"
            git checkout -b dependency-update-$(date +%Y%m%d)
            git add package.json package-lock.json
            git commit -m "chore: update dependencies"
            git push origin dependency-update-$(date +%Y%m%d)
            
            gh pr create \
              --title "chore: weekly dependency update" \
              --body "Automated dependency update" \
              --base main
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# .github/workflows/node-matrix.yml
name: Node.js Multi-Version Tests

on:
  pull_request:
    paths:
      - '**.js'
      - '**.ts'
      - 'package.json'
      - 'package-lock.json'
      - '.github/workflows/node-matrix.yml'
  push:
    branches: [main]
    paths:
      - '**.js'
      - '**.ts'
      - 'package.json'

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        node-version: [18.x, 20.x, 22.x]
        # Exclude some combinations to reduce runs
        exclude:
          - os: windows-latest
            node-version: 18.x
          - os: macos-latest
            node-version: 18.x
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
      
      - name: Install dependencies
        run: npm ci
      
      - name: Run tests
        run: npm test
      
      - name: Report coverage
        if: matrix.os == 'ubuntu-latest' && matrix.node-version == '20.x'
        run: npm run coverage

on:
  workflow_run:
    workflows: ["CI"]
    types: [completed]

on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string

# All JavaScript files recursively
paths: ['**.js']

# Only root-level JavaScript
paths: ['*.js']

# Everything in src except tests
paths:
  - 'src/**'
paths-ignore:
  - 'src/**/*.test.js'
  - 'src/__tests__/**'

# Multiple file types
paths:
  - '**.js'
  - '**.ts'
  - '**.jsx'
  - '**.tsx'

# Specific directories
paths:
  - 'services/*/src/**'  # Any service's src directory

┌─────────────────┐
│   GitHub Event  │
│  (push, PR,     │
│   schedule...)  │
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│  Trigger Check  │
│   (`on:` key)   │
│                 │
│ • Branch match? │
│ • Path match?   │
│ • Type match?   │
└────────┬────────┘
         │
    ┌────┴────┐
    │  Match? │
    └────┬────┘
         │
    ┌────▼────┐
    │   Yes   │         ┌──────┐
    └────┬────┘         │  No  │──> Workflow skipped
         │              └──────┘
         ▼
┌─────────────────┐
│ Workflow Starts │
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│   Job 1 runs    │
│  (if condition  │
│   evaluates)    │
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│  Steps execute  │
│   sequentially  │
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│ Workflow Result │
│ (success/fail)  │
└─────────────────┘

on:
  push:
    branches: [main]

on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Target environment'
        required: true
        type: choice
        options: [staging, production]

curl -X POST \
  -H "Authorization: Bearer $TOKEN" \
  https://api.github.com/repos/owner/repo/dispatches \
  -d '{"event_type":"deploy","client_payload":{"version":"1.0"}}'

on:
  repository_dispatch:
    types: [deploy]

════════════════════════════════════════════════════════════════════
                    GITHUB ACTIONS TRIGGER FLOW
════════════════════════════════════════════════════════════════════

    ┌──────────────────────────────────────────────────────────┐
    │                    GITHUB EVENT SOURCES                   │
    └──────────────────────────────────────────────────────────┘
              │            │            │            │
              ▼            ▼            ▼            ▼
         ┌────────┐  ┌────────┐  ┌────────┐  ┌────────┐
         │  Push  │  │   PR   │  │Schedule│  │ Manual │
         │ Event  │  │ Event  │  │ (Cron) │  │Trigger │
         └────┬───┘  └────┬───┘  └────┬───┘  └────┬───┘
              │            │            │            │
              └────────────┴────────────┴────────────┘
                            │
                            ▼
              ┌─────────────────────────┐
              │   WORKFLOW YAML FILE    │
              │  .github/workflows/*.yml │
              └────────────┬─────────────┘
                           │
                           ▼
              ┌─────────────────────────┐
              │    `on:` SECTION        │
              │  Trigger Definition     │
              └────────────┬─────────────┘
                           │
                           ▼
              ┌─────────────────────────┐
              │   FILTER EVALUATION     │
              │                         │
              │  • Branch filter        │
              │  • Path filter          │
              │  • Event type filter    │
              │  • Tag filter           │
              └────────────┬─────────────┘
                           │
                    ┌──────┴──────┐
                    │  All Match? │
                    └──────┬──────┘
                           │
              ┌────────────┴────────────┐
              │                         │
             YES                       NO
              │                         │
              ▼                         ▼
    ┌──────────────────┐      ┌─────────────────┐
    │  START WORKFLOW  │      │ SKIP EXECUTION  │
    └────────┬─────────┘      └─────────────────┘
             │
             ▼
    ┌──────────────────┐
    │  JOB EVALUATION  │
    │   (if: condition) │
    └────────┬─────────┘
             │
             ▼
    ┌──────────────────┐
    │  EXECUTE STEPS   │
    │                  │
    │  1. Checkout     │
    │  2. Setup        │
    │  3. Build        │
    │  4. Test         │
    │  5. Deploy       │
    └────────┬─────────┘
             │
             ▼
    ┌──────────────────┐
    │ WORKFLOW RESULT  │
    │ ✓ Success / ✗ Fail │
    └──────────────────┘

════════════════════════════════════════════════════════════════════

on:
  pull_request:
    branches: [main, develop]
    types: [opened, synchronize, reopened]

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'

on:
  push:
    branches: [main]
    paths:
      - 'services/api/**'
      - 'shared/**'
    paths-ignore:
      - '**.md'
      - 'docs/**'

on:
  workflow_dispatch:
    inputs:
      environment:
        type: choice
        options: [staging, production]
      version:
        type: string
        required: true

on:
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM UTC
  workflow_dispatch:     # Also allow manual runs

on:
  workflow_run:
    workflows: ["CI Build"]
    types: [completed]
    branches: [main]

jobs:
  deploy:
    if: github.event.workflow_run.conclusion == 'success'

on:
  repository_dispatch:
    types: [deploy-service]

jobs:
  deploy:
    steps:
      - run: echo "Version: ${{ github.event.client_payload.version }}"

on:
  pull_request:
  push:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - '**.js'
      - '**.ts'
      - '**.jsx'
      - '**.tsx'
      - 'package.json'

on:
  push:
    branches: [main]
    paths: ['src/**']
  
  pull_request:
    branches: [main, develop]
    paths: ['src/**', 'tests/**']
  
  workflow_dispatch:

name: Debug Triggers

on: [push, pull_request, workflow_dispatch]

jobs:
  debug:
    runs-on: ubuntu-latest
    steps:
      - name: Dump all contexts
        run: |
          echo "Event name: ${{ github.event_name }}"
          echo "Ref: ${{ github.ref }}"
          echo "SHA: ${{ github.sha }}"
          echo "Actor: ${{ github.actor }}"
          echo "Base ref: ${{ github.base_ref }}"
          echo "Head ref: ${{ github.head_ref }}"
      
      - name: Dump full GitHub context
        env:
          GITHUB_CONTEXT: ${{ toJSON(github) }}
        run: echo "$GITHUB_CONTEXT"
      
      - name: Dump event payload
        env:
          EVENT_CONTEXT: ${{ toJSON(github.event) }}
        run: echo "$EVENT_CONTEXT"
      
      - name: Show environment variables
        run: env | sort

# List recent workflow runs
gh run list --workflow="CI Build" --limit 20

# View specific run details
gh run view 1234567890

# View run with event details
gh run view 1234567890 --json event,conclusion,headBranch

# Download logs for analysis
gh run download 1234567890

# Re-run failed workflows
gh run rerun 1234567890

# Watch workflow run in real-time
gh run watch 1234567890

# .github/workflows/trigger-test.yml
name: Trigger Test

on:
  push:
    branches: ['test-triggers']
  pull_request:
    branches: ['test-triggers']

jobs:
  test-filters:
    runs-on: ubuntu-latest
    steps:
      - name: Test branch filter
        run: |
          echo "Branch: ${{ github.ref }}"
          echo "Expected: refs/heads/test-triggers"
          if [[ "${{ github.ref }}" == "refs/heads/test-triggers" ]]; then
            echo "✓ Branch filter working"
          else
            echo "✗ Branch filter failed"
            exit 1
          fi
      
      - name: Test event type
        run: |
          echo "Event: ${{ github.event_name }}"
          if [[ "${{ github.event_name }}" == "push" || "${{ github.event_name }}" == "pull_request" ]]; then
            echo "✓ Event filter working"
          else
            echo "✗ Unexpected event type"
            exit 1
          fi

# ❌ BEFORE: Runs on every push to any branch
name: Inefficient CI

on: push

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - run: npm run lint
  
  test:
    runs-on: ubuntu-latest
    steps:
      - run: npm test
  
  build:
    runs-on: ubuntu-latest
    steps:
      - run: npm run build

# ✅ AFTER: Optimized with filters and concurrency
name: Efficient CI

on:
  push:
    branches: [main, develop]
    paths:
      - 'src/**'
      - 'tests/**'
      - 'package.json'
      - 'package-lock.json'
    paths-ignore:
      - '**.md'
      - 'docs/**'
  
  pull_request:
    branches: [main, develop]
    paths:
      - 'src/**'
      - 'tests/**'
      - 'package.json'

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  quality-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
      
      - run: npm ci
      
      # Run all checks in one job (saves setup time)
      - name: Lint
        run: npm run lint
      
      - name: Test
        run: npm test
      
      - name: Build
        run: npm run build

name: Secure Production Deploy

on:
  push:
    branches:
      - main                      # ✓ Only protected branch
    paths:
      - 'src/**'                  # ✓ Only relevant changes
    tags:
      - 'v*'                      # ✓ Only version tags
  
  workflow_dispatch:              # ✓ Manual trigger option
    inputs:
      confirm:
        description: 'Type "DEPLOY" to confirm'
        required: true

# Limit permissions to minimum necessary
permissions:
  contents: read                  # ✓ Read-only by default
  deployments: write              # ✓ Only what's needed

concurrency:
  group: production-deploy
  cancel-in-progress: false       # ✓ Never cancel prod deploys

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Validate manual confirmation
        if: github.event_name == 'workflow_dispatch'
        run: |
          if [[ "${{ inputs.confirm }}" != "DEPLOY" ]]; then
            echo "Deployment not confirmed"
            exit 1
          fi
      
      - name: Verify production branch
        run: |
          if [[ "${{ github.ref }}" != "refs/heads/main" ]]; then
            echo "Can only deploy from main branch"
            exit 1
          fi
  
  deploy:
    needs: validate
    runs-on: ubuntu-latest
    environment: production        # ✓ Requires approval
    steps:
      - name: Deploy to production
        env:
          DEPLOY_KEY: ${{ secrets.PRODUCTION_DEPLOY_KEY }}
        run: |
          echo "Deploying to production..."
          # Deployment logic

# ❌ DANGEROUS: Exposes secrets to fork PRs
on:
  pull_request_target:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      
      # DANGER: Running potentially malicious code with secrets
      - run: npm install
      - run: npm test
        env:
          API_KEY: ${{ secrets.API_KEY }}  # ❌ Secret exposed!

# ✅ SAFE: Validate first, then act with privileges
name: Safe PR Workflow

on:
  pull_request:                   # Runs from fork, no secrets
    types: [opened, synchronize]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm test              # ✓ No secrets, safe to run fork code

---

# Separate workflow for privileged operations
name: Add PR Label

on:
  pull_request_target:            # Has write access
    types: [opened]

jobs:
  label:
    runs-on: ubuntu-latest
    steps:
      # ✓ NOT checking out PR code
      - uses: actions/github-script@v7
        with:
          script: |
            await github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.payload.pull_request.number,
              labels: ['needs-review']
            })

Workflow didn't trigger?
│
├─> Check 1: Does workflow file exist in target branch?
│   ├─> NO → Add workflow file to branch and push
│   └─> YES → Continue
│
├─> Check 2: Is YAML syntax valid?
│   ├─> NO → Run `actionlint` to find syntax errors
│   └─> YES → Continue
│
├─> Check 3: Do branch filters match?
│   ├─> NO → Adjust `branches:` filter or push to correct branch
│   └─> YES → Continue
│
├─> Check 4: Do path filters match?
│   ├─> NO → Check if changed files match `paths:` patterns
│   └─> YES → Continue
│
├─> Check 5: Is event type included in workflow?
│   ├─> NO → Add event to `on:` section
│   └─> YES → Continue
│
├─> Check 6: For PRs, are activity types correct?
│   ├─> NO → Add required types (e.g., `[opened, synchronize]`)
│   └─> YES → Continue
│
├─> Check 7: Is workflow enabled in repo settings?
│   ├─> NO → Go to Settings → Actions → Enable workflow
│   └─> YES → Continue
│
└─> Check 8: Check Actions tab for error messages
    └─> Review logs for specific error details

name: Development CI

on:
  push:
    branches:
      - 'feature/**'
      - 'bugfix/**'
      - 'hotfix/**'
  pull_request:
    types: [opened, synchronize]

jobs:
  fast-checks:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Quick validation
        run: |
          npm run lint
          npm run test:unit  # Only unit tests, skip integration

name: Staging Deploy

on:
  push:
    branches: [develop, staging]
  workflow_dispatch:
    inputs:
      environment:
        default: 'staging'

jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - name: Deploy to staging
        run: echo "Deploying to staging"
      
      - name: Run smoke tests
        run: npm run test:smoke

name: Production Release

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
  workflow_dispatch:
    inputs:
      version:
        required: true
        description: 'Version to deploy'

concurrency:
  group: production
  cancel-in-progress: false  # Never cancel production deploys

jobs:
  deploy-production:
    runs-on: ubuntu-latest
    environment: production  # Requires approval
    steps:
      - name: Deploy to production
        run: echo "Deploying version ${{ github.ref_name }}"