What Is GitHub Actions? Benefits, Use Cases, and Best Practices (2025)

Workflow (CI Pipeline)
├── Job 1: Build (runs-on: ubuntu-latest)
│   ├── Step 1: Checkout code
│   ├── Step 2: Setup Node.js
│   └── Step 3: Run npm build
└── Job 2: Test (runs-on: ubuntu-latest, needs: build)
    ├── Step 1: Checkout code
    ├── Step 2: Setup Node.js
    └── Step 3: Run npm test

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 2 * * *'  # 2 AM daily
  workflow_dispatch:
    inputs:
      environment:
        description: 'Deployment environment'
        required: true
        default: 'staging'

my-repo/
├── .github/
│   └── workflows/
│       ├── ci.yml
│       ├── deploy.yml
│       └── scheduled-cleanup.yml
├── src/
├── tests/
└── package.json

# .github/workflows/ci.yml
name: CI Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      
      - name: Install dependencies
        run: npm ci
      
      - name: Run linter
        run: npm run lint
      
      - name: Run tests
        run: npm test
      
      - name: Build application
        run: npm run build
      
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-output
          path: dist/
          retention-days: 7

✓ Checkout repository (2s)
✓ Setup Node.js (5s)
✓ Install dependencies (23s)
✓ Run linter (4s)
✓ Run tests (18s)
✓ Build application (12s)
✓ Upload build artifacts (3s)

Total duration: 1m 7s

# .github/workflows/matrix-ci.yml
name: Matrix CI

on: [push, pull_request]

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        node-version: [18, 20, 22]
        exclude:
          - os: macos-latest
            node-version: 18
      fail-fast: false
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
      
      - run: npm ci
      - run: npm test

✓ test (ubuntu-latest, 18) - 1m 12s
✓ test (ubuntu-latest, 20) - 1m 15s
✓ test (ubuntu-latest, 22) - 1m 18s
✓ test (windows-latest, 18) - 2m 3s
✓ test (windows-latest, 20) - 2m 8s
✓ test (windows-latest, 22) - 2m 5s
✓ test (macos-latest, 20) - 1m 45s
✓ test (macos-latest, 22) - 1m 52s

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1
      
      - name: Deploy to S3
        env:
          BUCKET_NAME: ${{ vars.PRODUCTION_BUCKET }}
        run: |
          aws s3 sync ./dist s3://$BUCKET_NAME --delete

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/
  
  test:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm test
  
  deploy:
    needs: [build, test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
      - run: echo "Deploying artifacts..."

build (runs first)
  ↓
test (waits for build)
  ↓
deploy (waits for both build and test)

name: Reusable Deploy

on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
      artifact-name:
        required: true
        type: string
    secrets:
      deploy-token:
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: ${{ inputs.artifact-name }}
      - name: Deploy
        env:
          TOKEN: ${{ secrets.deploy-token }}
        run: ./deploy.sh ${{ inputs.environment }}

name: Production Deploy

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build
      - uses: actions/upload-artifact@v4
        with:
          name: production-build
          path: dist/
  
  deploy:
    needs: build
    uses: ./.github/workflows/reusable-deploy.yml
    with:
      environment: production
      artifact-name: production-build
    secrets:
      deploy-token: ${{ secrets.PRODUCTION_TOKEN }}

# .github/actions/setup-project/action.yml
name: 'Setup Project'
description: 'Setup Node.js and install dependencies with caching'

inputs:
  node-version:
    description: 'Node.js version'
    required: false
    default: '20'

runs:
  using: 'composite'
  steps:
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: ${{ inputs.node-version }}
        cache: 'npm'
    
    - name: Install dependencies
      shell: bash
      run: |
        if [ -f package-lock.json ]; then
          npm ci
        else
          npm install
        fi
    
    - name: Display versions
      shell: bash
      run: |
        node --version
        npm --version

steps:
  - uses: actions/checkout@v4
  - uses: ./.github/actions/setup-project
    with:
      node-version: '22'

steps:
  - name: Deploy to production
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    run: ./deploy-prod.sh
  
  - name: Deploy to staging
    if: github.ref == 'refs/heads/develop'
    run: ./deploy-staging.sh
  
  - name: Notify on failure
    if: failure()
    run: |
      curl -X POST ${{ secrets.SLACK_WEBHOOK }} \
        -H 'Content-Type: application/json' \
        -d '{"text":"Workflow failed!"}'

jobs:
  deploy:
    runs-on: ubuntu-latest
    concurrency:
      group: production-deploy
      cancel-in-progress: false
    steps:
      - run: echo "Deploying to production..."

name: Auto Label Issues

on:
  issues:
    types: [opened]

jobs:
  label:
    runs-on: ubuntu-latest
    permissions:
      issues: write
    steps:
      - uses: actions/github-script@v7
        with:
          script: |
            const issue = context.payload.issue;
            const labels = [];
            
            if (issue.body.includes('bug')) labels.push('bug');
            if (issue.body.includes('feature')) labels.push('enhancement');
            
            if (labels.length > 0) {
              await github.rest.issues.addLabels({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: issue.number,
                labels: labels
              });
            }

name: PR Quality Gate

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
      
      - name: Check code coverage
        run: |
          COVERAGE=$(npm run test:coverage | grep "All files" | awk '{print $10}' | sed 's/%//')
          if (( $(echo "$COVERAGE < 80" | bc -l) )); then
            echo "Coverage $COVERAGE% is below 80% threshold"
            exit 1
          fi
      
      - name: Check bundle size
        run: |
          npm run build
          SIZE=$(du -k dist/ | cut -f1)
          if [ $SIZE -gt 5000 ]; then
            echo "Bundle size ${SIZE}KB exceeds 5MB limit"
            exit 1
          fi

name: Cleanup Stale Branches

on:
  schedule:
    - cron: '0 0 * * 0'  # Weekly on Sunday
  workflow_dispatch:

jobs:
  cleanup:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      
      - name: Delete merged branches
        run: |
          git branch -r --merged origin/main | \
            grep -v 'main\|develop\|master' | \
            sed 's/origin\///' | \
            xargs -I {} git push origin --delete {}

name: Manual Deployment

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Target environment'
        required: true
        type: choice
        options:
          - development
          - staging
          - production
      version:
        description: 'Version to deploy'
        required: true
        type: string
      dry-run:
        description: 'Perform dry run?'
        required: false
        type: boolean
        default: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy ${{ inputs.version }} to ${{ inputs.environment }}
        run: |
          echo "Environment: ${{ inputs.environment }}"
          echo "Version: ${{ inputs.version }}"
          echo "Dry run: ${{ inputs.dry-run }}"
          
          if [ "${{ inputs.dry-run }}" = "true" ]; then
            ./deploy.sh --dry-run ${{ inputs.environment }} ${{ inputs.version }}
          else
            ./deploy.sh ${{ inputs.environment }} ${{ inputs.version }}
          fi

# ❌ BAD: Duplicated across repos
jobs:
  build:
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - run: npm ci
      - run: npm run lint
      - run: npm test
      - run: npm run build
      # ... 50 more lines

# ✅ GOOD: Single source of truth
jobs:
  build:
    uses: my-org/.github/.github/workflows/node-ci.yml@v1
    with:
      node-version: '20'

# ✅ Pinned to specific commit
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1

# ❌ Unpinned - may break unexpectedly
- uses: actions/checkout@v4

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    commit-message:
      prefix: "ci"

on:
  push:
    branches:
      - main
      - 'feature/**'  # Test workflow changes in feature branches

name: Production Deployment
# Purpose: Deploys to production after approval
# Triggers: Manual only (workflow_dispatch)
# Secrets required: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
# Estimated duration: 8-12 minutes
# Rollback: Run workflow_dispatch with previous version tag

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version tag to deploy (e.g., v1.2.3)'
        required: true

jobs:
  notify-on-failure:
    if: failure()
    runs-on: ubuntu-latest
    needs: [build, test, deploy]
    steps:
      - name: Send Slack notification
        env:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
        run: |
          curl -X POST $SLACK_WEBHOOK \
            -H 'Content-Type: application/json' \
            -d @- << EOF
          {
            "text": "❌ Workflow Failed",
            "blocks": [
              {
                "type": "section",
                "text": {
                  "type": "mrkdwn",
                  "text": "*Repository:* ${{ github.repository }}\n*Workflow:* ${{ github.workflow }}\n*Branch:* ${{ github.ref_name }}\n*Run:* <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Details>"
                }
              }
            ]
          }
          EOF

Error: Resource not accessible by integration

jobs:
  deploy:
    permissions:
      contents: read
      packages: write
      id-token: write

Error: Secret AWS_ACCESS_KEY_ID not found

environment: production  # Secrets from 'production' environment

Error: No space left on device

steps:
  - name: Free up disk space
    run: |
      sudo rm -rf /usr/share/dotnet
      sudo rm -rf /opt/ghc
      sudo rm -rf /usr/local/share/boost
      df -h

test (ubuntu-latest, 18) ✓
test (ubuntu-latest, 20) ✗  ← Failed here
test (ubuntu-latest, 22) ✓

NODE_VERSION=20 npm test

# macOS
brew install act

# Linux
curl https://raw.githubusercontent.com/nektos/act/master/install.sh | sudo bash

# Windows
choco install act-cli

# List available jobs
act -l

# Run push event (default)
act push

# Run specific job
act -j test

# Run with secrets
act -s GITHUB_TOKEN=ghp_xxx -s AWS_KEY=AKIAIOSFODNN7EXAMPLE

# Use specific Docker image
act -P ubuntu-latest=catthehacker/ubuntu:full-latest

[CI Pipeline/build-and-test] 🚀  Start image=catthehacker/ubuntu:act-latest
[CI Pipeline/build-and-test]   🐳  docker pull image=catthehacker/ubuntu:act-latest
[CI Pipeline/build-and-test]   ⭐ Run Checkout repository
[CI Pipeline/build-and-test]   ✅  Success - Checkout repository
[CI Pipeline/build-and-test]   ⭐ Run Setup Node.js
[CI Pipeline/build-and-test]   ✅  Success - Setup Node.js
...

- name: Debug Docker build
  run: |
    docker buildx create --use
    docker buildx build --progress=plain --no-cache .

- name: Build Docker image
  uses: docker/build-push-action@v5
  with:
    context: .
    push: false
    cache-from: type=gha
    cache-to: type=gha,mode=max
    no-cache: ${{ github.event_name == 'workflow_dispatch' }}

# On runner machine
sudo ./svc.sh status
journalctl -u actions.runner.* -n 50

# /etc/cron.daily/cleanup-runner
#!/bin/bash
cd /home/runner/actions-runner/_work
find . -type d -name "_temp" -mtime +7 -exec rm -rf {} +
docker system prune -af --volumes

- name: Benchmark steps
  run: |
    time npm ci
    time npm test

- uses: actions/setup-node@v4
  with:
    node-version: '20'
    cache: 'npm'
    cache-dependency-path: '**/package-lock.json'

permissions:
  contents: read  # Default for new repos

jobs:
  release:
    permissions:
      contents: write      # Create releases
      packages: write      # Push to GitHub Packages
      issues: write        # Comment on issues
      pull-requests: write # Comment on PRs
      id-token: write      # OIDC for AWS/GCP/Azure

# ❌ DANGEROUS
- name: Debug
  run: echo "API Key is ${{ secrets.API_KEY }}"

# ✅ Use without echoing
- name: Call API
  env:
    API_KEY: ${{ secrets.API_KEY }}
  run: curl -H "Authorization: Bearer $API_KEY" https://api.example.com

# ✅ Mask custom values
- name: Set custom secret
  run: |
    TEMP_TOKEN=$(generate_token)
    echo "::add-mask::$TEMP_TOKEN"
    echo "TEMP_TOKEN=$TEMP_TOKEN" >> $GITHUB_ENV

# ✅ Pinned and auditable
- uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c8ed4a150a2a5f8a76  # v4.0.2

# ❌ Unpinned - vulnerable to supply chain attacks
- uses: aws-actions/configure-aws-credentials@v4

# Organization-level required workflows
required_workflows:
  - .github/workflows/security-scan.yml
  - .github/workflows/compliance-check.yml

# Prevent dangerous patterns
prohibited_patterns:
  - pattern: '\$\{\{\s*secrets\.[A-Z_]+\s*\}\}'
    context: run
    message: "Never echo secrets in run commands"

name: Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 0 * * 1'  # Weekly

jobs:
  codeql:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: javascript, python
          queries: security-extended
      
      - name: Autobuild
        uses: github/codeql-action/autobuild@v3
      
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3

jobs:
  deploy-production:
    environment:
      name: production
      url: https://prod.example.com
    steps:
      - run: ./deploy.sh

Branch name pattern: main
☑ Require pull request before merging
  ☑ Require approvals (2)
  ☑ Dismiss stale approvals
☑ Require status checks to pass
  - CI Pipeline
  - Security Scan
  - Code Coverage
☑ Require conversation resolution
☑ Require signed commits
☑ Require linear history
☑ Include administrators

jobs:
  deploy-production:
    runs-on: ubuntu-latest
    environment: production  # Requires manual approval
    steps:
      - name: Deploy
        run: |
          echo "Deploying to production after approval..."
          ./deploy-prod.sh

⏸  Waiting for approval from production environment reviewers
   Requested at: 2025-10-02 14:23:15 UTC
   Reviewers: @alice, @bob
   [Review deployment] [Cancel workflow]

my-org/.github/
├── .github/
│   └── workflows/
│       ├── shared-ci.yml
│       ├── shared-deploy.yml
│       └── shared-security.yml
└── README.md

name: Shared CI Workflow

on:
  workflow_call:
    inputs:
      language:
        required: true
        type: string
      version:
        required: false
        type: string
        default: 'latest'

jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup ${{ inputs.language }}
        uses: actions/setup-${{ inputs.language }}@v4
        with:
          ${{ inputs.language }}-version: ${{ inputs.version }}
      
      - name: Install and test
        run: |
          if [ "${{ inputs.language }}" = "node" ]; then
            npm ci && npm test
          elif [ "${{ inputs.language }}" = "python" ]; then
            pip install -r requirements.txt && pytest
          fi

name: CI

on: [push, pull_request]

jobs:
  ci:
    uses: my-org/.github/.github/workflows/shared-ci.yml@main
    with:
      language: node
      version: '20'

# Export audit log via API
gh api /orgs/my-org/audit-log \
  --method GET \
  --field per_page=100 \
  --field phrase="action:workflows" \
  > audit.json

# Analyze workflow modifications
cat audit.json | jq '.[] | select(.action == "workflows.workflow_created" or .action == "workflows.workflow_updated")'

name: Compliance Check

on:
  workflow_run:
    workflows: ["CI Pipeline"]
    types: [completed]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - name: Verify workflow used approved actions
        run: |
          ALLOWED_ACTIONS="actions/checkout actions/setup-node aws-actions/"
          
          # Download workflow file
          gh api repos/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }} \
            --jq '.path' > workflow.yml
          
          # Extract actions used
          USED_ACTIONS=$(grep 'uses:' workflow.yml | awk '{print $2}')
          
          # Verify against allowlist
          echo "$USED_ACTIONS" | while read action; do
            if ! echo "$ALLOWED_ACTIONS" | grep -q "$(echo $action | cut -d@ -f1)"; then
              echo "❌ Unapproved action: $action"
              exit 1
            fi
          done

# dashboard.py
import requests
import os

GITHUB_TOKEN = os.getenv('GITHUB_TOKEN')
ORG = 'my-org'

headers = {'Authorization': f'token {GITHUB_TOKEN}'}

# Get all repos
repos = requests.get(f'https://api.github.com/orgs/{ORG}/repos', headers=headers).json()

for repo in repos:
    repo_name = repo['name']
    
    # Get workflow runs
    runs = requests.get(
        f"https://api.github.com/repos/{ORG}/{repo_name}/actions/runs",
        headers=headers,
        params={'per_page': 10}
    ).json()
    
    if runs.get('workflow_runs'):
        success_rate = sum(1 for r in runs['workflow_runs'] if r['conclusion'] == 'success') / len(runs['workflow_runs']) * 100
        print(f"{repo_name}: {success_rate:.1f}% success rate")

frontend-app: 94.5% success rate
backend-api: 89.2% success rate
data-pipeline: 100.0% success rate
mobile-app: 76.8% success rate ⚠️

# Type comment, get workflow suggestion:
# "Create a workflow that deploys to AWS Lambda on main branch push"

# Copilot generates:
name: Deploy to Lambda

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1
      - run: |
          zip -r function.zip .
          aws lambda update-function-code \
            --function-name my-function \
            --zip-file fileb://function.zip

# GitHub CLI with AI assistant (experimental)
gh actions debug --run-id 1234567890

# AI Analysis:
# "Failure detected in step 'Build application'
# Root cause: Node.js version mismatch
# Fix: Update setup-node action to specify node-version: '20'
# Confidence: 94%"

name: GitOps Sync

on:
  push:
    branches: [main]
    paths:
      - 'k8s/**'

jobs:
  sync:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Deploy to Kubernetes
        uses: azure/k8s-deploy@v4
        with:
          manifests: |
            k8s/deployment.yaml
            k8s/service.yaml
          images: |
            myapp:${{ github.sha }}
          kubectl-version: 'latest'

name: Terraform Validation

on:
  pull_request:
    paths:
      - 'terraform/**'

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - uses: hashicorp/setup-terraform@v3
      
      - name: Terraform Init
        run: terraform init
      
      - name: Terraform Validate
        run: terraform validate
      
      - name: Terraform Plan
        run: terraform plan -out=tfplan
      
      - name: Cost Estimation
        uses: infracost/actions/comment@v1
        with:
          path: tfplan
          github-token: ${{ secrets.GITHUB_TOKEN }}

# Workflow metadata
name: Workflow Name
run-name: Custom run name with ${{ github.actor }}

# Triggers
on:
  push:
    branches: [main, develop]
    paths: ['src/**']
  pull_request:
    types: [opened, synchronize]
  schedule:
    - cron: '0 0 * * *'
  workflow_dispatch:
    inputs:
      environment:
        required: true
        type: choice
        options: [dev, staging, prod]

# Jobs
jobs:
  job-id:
    name: Job Display Name
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: [dependency-job]
    if: github.ref == 'refs/heads/main'
    environment: production
    concurrency:
      group: prod-deploy
      cancel-in-progress: false
    permissions:
      contents: read
      packages: write
    
    # Strategy for matrix builds
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
        version: [18, 20, 22]
      fail-fast: false
    
    # Environment variables
    env:
      NODE_ENV: production
      API_URL: ${{ vars.API_URL }}
    
    # Steps
    steps:
      - name: Step name
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      
      - name: Run command
        run: echo "Hello World"
        env:
          SECRET: ${{ secrets.MY_SECRET }}
      
      - name: Multi-line script
        run: |
          echo "Line 1"
          echo "Line 2"
      
      - name: Conditional step
        if: success() && github.event_name == 'push'
        run: echo "Conditional"

strategy:
  matrix:
    os: [ubuntu-latest, windows-latest, macos-latest]
    node-version: [18, 20, 22]

steps:
  - uses: actions/checkout@v4
  
  - uses: actions/setup-node@v4
    with:
      node-version: ${{ matrix.node-version }}
      cache: 'npm'
  
  - run: npm ci
  - run: npm test

steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      aws-region: us-east-1
  
  - run: aws s3 ls

- uses: actions/cache@v4
  with:
    path: |
      ~/.npm
      node_modules
    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-node-

┌─────────────────────────────────────────────────────────────┐
│                    GITHUB ACTIONS LIFECYCLE                  │
└─────────────────────────────────────────────────────────────┘

    [Event Triggered]
         │
         │ (push, PR, schedule, manual)
         ↓
    [Workflow Queued]
         │
         │ → Waiting for available runner
         ↓
    [Runner Assigned]
         │
         │ → Downloads workflow definition
         ↓
    [Job 1 Starts]────┐
         │            │
    [Step 1]          │  (Parallel execution)
    [Step 2]          │
    [Step 3]          ↓
         │       [Job 2 Starts]
         │            │
         │       [Step 1]
         │       [Step 2]
         ↓            ↓
    [Job 1 Complete] [Job 2 Complete]
         │                 │
         └────────┬────────┘
                  ↓
         [All Jobs Complete]
                  │
                  ├─→ Success: ✓ (green check)
                  ├─→ Failure: ✗ (red X)
                  └─→ Cancelled: ⊘ (gray circle)
                  │
                  ↓
         [Notifications Sent]
                  │
                  ↓
         [Artifacts Retained]
         (7-90 days)

name: Microservice CI/CD

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  ECR_REPOSITORY: my-microservice
  ECS_SERVICE: my-service
  ECS_CLUSTER: production-cluster
  AWS_REGION: us-east-1

jobs:
  test:
    name: Test & Quality Checks
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      
      - name: Install dependencies
        run: npm ci
      
      - name: Run linter
        run: npm run lint
      
      - name: Run unit tests
        run: npm run test:unit -- --coverage
      
      - name: Run integration tests
        run: npm run test:integration
      
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./coverage/coverage-final.json
          fail_ci_if_error: true
      
      - name: SonarCloud Scan
        uses: SonarSource/sonarcloud-github-action@master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  
  security-scan:
    name: Security Scanning
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Run npm audit
        run: npm audit --audit-level=moderate
      
      - name: Run Snyk security scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high
      
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
      
      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'
  
  build:
    name: Build & Push Docker Image
    needs: [test, security-scan]
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    outputs:
      image-tag: ${{ steps.meta.outputs.tags }}
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
      
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
      
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}
          tags: |
            type=ref,event=branch
            type=sha,prefix={{branch}}-
            type=semver,pattern={{version}}
      
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      
      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            NODE_ENV=production
            BUILD_DATE=${{ github.event.head_commit.timestamp }}
            VCS_REF=${{ github.sha }}
  
  deploy-staging:
    name: Deploy to Staging
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/develop'
    environment:
      name: staging
      url: https://staging.myapp.com
    
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
      
      - name: Deploy to ECS
        run: |
          aws ecs update-service \
            --cluster staging-cluster \
            --service ${{ env.ECS_SERVICE }} \
            --force-new-deployment \
            --region ${{ env.AWS_REGION }}
      
      - name: Wait for deployment
        run: |
          aws ecs wait services-stable \
            --cluster staging-cluster \
            --services ${{ env.ECS_SERVICE }} \
            --region ${{ env.AWS_REGION }}
      
      - name: Run smoke tests
        run: |
          curl -f https://staging.myapp.com/health || exit 1
          curl -f https://staging.myapp.com/api/v1/status || exit 1
  
  deploy-production:
    name: Deploy to Production
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    environment:
      name: production
      url: https://myapp.com
    
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: ${{ secrets.AWS_ROLE_PRODUCTION }}
          role-duration-seconds: 1200
      
      - name: Create deployment marker
        run: |
          aws cloudwatch put-metric-data \
            --namespace MyApp/Deployments \
            --metric-name DeploymentStarted \
            --value 1 \
            --timestamp $(date -u +%Y-%m-%dT%H:%M:%S)
      
      - name: Deploy to ECS (Blue/Green)
        run: |
          TASK_DEFINITION=$(aws ecs describe-task-definition \
            --task-definition ${{ env.ECS_SERVICE }} \
            --query 'taskDefinition' \
            --region ${{ env.AWS_REGION }})
          
          NEW_TASK_DEF=$(echo $TASK_DEFINITION | \
            jq --arg IMAGE "${{ needs.build.outputs.image-tag }}" \
            '.containerDefinitions[0].image = $IMAGE')
          
          aws ecs register-task-definition \
            --cli-input-json "$NEW_TASK_DEF" \
            --region ${{ env.AWS_REGION }}
          
          aws ecs update-service \
            --cluster ${{ env.ECS_CLUSTER }} \
            --service ${{ env.ECS_SERVICE }} \
            --task-definition ${{ env.ECS_SERVICE }} \
            --force-new-deployment \
            --region ${{ env.AWS_REGION }}
      
      - name: Monitor deployment
        run: |
          aws ecs wait services-stable \
            --cluster ${{ env.ECS_CLUSTER }} \
            --services ${{ env.ECS_SERVICE }} \
            --region ${{ env.AWS_REGION }}
      
      - name: Run production smoke tests
        run: |
          for i in {1..5}; do
            if curl -f https://myapp.com/health; then
              echo "Health check passed"
              exit 0
            fi
            echo "Attempt $i failed, retrying..."
            sleep 10
          done
          exit 1
      
      - name: Notify Slack
        if: always()
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "${{ job.status == 'success' && '✅' || '❌' }} Production Deployment ${{ job.status }}",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*Deployment Status:* ${{ job.status }}\n*Commit:* ${{ github.sha }}\n*Author:* ${{ github.actor }}\n*Run:* <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Details>"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

[Push to main]
     ↓
[test] + [security-scan] (parallel)
     ↓
[build] (after both complete)
     ↓
[deploy-production] (with approval gate)
     ↓
[Slack notification]

Total Duration: ~8-12 minutes

name: Terraform Infrastructure Pipeline

on:
  pull_request:
    paths:
      - 'terraform/**'
      - '.github/workflows/terraform.yml'
  push:
    branches: [main]
    paths:
      - 'terraform/**'

permissions:
  id-token: write
  contents: read
  pull-requests: write

jobs:
  terraform-validate:
    name: Validate Terraform
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./terraform
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.6.0
      
      - name: Terraform Format Check
        run: terraform fmt -check -recursive
      
      - name: Terraform Init
        run: terraform init -backend=false
      
      - name: Terraform Validate
        run: terraform validate
      
      - name: Run tflint
        uses: terraform-linters/setup-tflint@v4
        with:
          tflint_version: latest
      
      - run: tflint --init
        working-directory: ./terraform
      
      - run: tflint -f compact
        working-directory: ./terraform
  
  terraform-plan:
    name: Plan Infrastructure Changes
    needs: terraform-validate
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    defaults:
      run:
        working-directory: ./terraform
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Configure AWS Credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsTerraform
          aws-region: us-east-1
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.6.0
      
      - name: Terraform Init
        run: |
          terraform init \
            -backend-config="bucket=my-terraform-state" \
            -backend-config="key=prod/terraform.tfstate" \
            -backend-config="region=us-east-1"
      
      - name: Terraform Plan
        id: plan
        run: |
          terraform plan -no-color -out=tfplan
          terraform show -no-color tfplan > plan.txt
        continue-on-error: true
      
      - name: Cost Estimation with Infracost
        uses: infracost/actions/comment@v1
        with:
          path: terraform/plan.txt
          behavior: update
        env:
          INFRACOST_API_KEY: ${{ secrets.INFRACOST_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Post Plan to PR
        uses: actions/github-script@v7
        if: github.event_name == 'pull_request'
        env:
          PLAN: "${{ steps.plan.outputs.stdout }}"
        with:
          script: |
            const output = `#### Terraform Plan 📝
            
            <details><summary>Show Plan</summary>
            
            \`\`\`terraform
            ${process.env.PLAN}
            \`\`\`
            
            </details>
            
            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`;
            
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })
      
      - name: Upload Plan Artifact
        uses: actions/upload-artifact@v4
        with:
          name: terraform-plan
          path: terraform/tfplan
          retention-days: 5
  
  terraform-apply:
    name: Apply Infrastructure Changes
    needs: terraform-validate
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    environment: production-infrastructure
    defaults:
      run:
        working-directory: ./terraform
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Configure AWS Credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsTerraform
          aws-region: us-east-1
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.6.0
      
      - name: Terraform Init
        run: |
          terraform init \
            -backend-config="bucket=my-terraform-state" \
            -backend-config="key=prod/terraform.tfstate" \
            -backend-config="region=us-east-1"
      
      - name: Terraform Apply
        run: terraform apply -auto-approve -input=false
      
      - name: Save Terraform Outputs
        id: outputs
        run: |
          terraform output -json > outputs.json
          echo "vpc_id=$(terraform output -raw vpc_id)" >> $GITHUB_OUTPUT
          echo "cluster_endpoint=$(terraform output -raw eks_cluster_endpoint)" >> $GITHUB_OUTPUT
      
      - name: Notify Infrastructure Changes
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "🏗️ Infrastructure Updated",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*Infrastructure Applied*\n*VPC:* ${{ steps.outputs.outputs.vpc_id }}\n*Cluster:* ${{ steps.outputs.outputs.cluster_endpoint }}\n*Commit:* ${{ github.sha }}"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

name: Optimized Build

on: [push, pull_request]

jobs:
  build:
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
      
      # Multi-layer caching for Node.js
      - name: Cache Node modules
        uses: actions/cache@v4
        id: cache-node-modules
        with:
          path: node_modules
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-
      
      # Skip npm ci if cache hit
      - name: Install dependencies
        if: steps.cache-node-modules.outputs.cache-hit != 'true'
        run: npm ci
      
      # Cache build outputs
      - name: Cache build
        uses: actions/cache@v4
        with:
          path: |
            dist
            .next/cache
          key: ${{ runner.os }}-build-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-build-
      
      - name: Build application
        run: npm run build
      
      # Cache Docker layers
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      
      - name: Build Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          cache-from: type=gha
          cache-to: type=gha,mode=max

name: Smart CI

on: [push, pull_request]

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      frontend: ${{ steps.filter.outputs.frontend }}
      backend: ${{ steps.filter.outputs.backend }}
      docs: ${{ steps.filter.outputs.docs }}
    steps:
      - uses: actions/checkout@v4
      
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            frontend:
              - 'frontend/**'
              - 'package.json'
            backend:
              - 'backend/**'
              - 'requirements.txt'
            docs:
              - 'docs/**'
              - '**.md'
  
  test-frontend:
    needs: changes
    if: needs.changes.outputs.frontend == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm test
  
  test-backend:
    needs: changes
    if: needs.changes.outputs.backend == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pip install -r requirements.txt && pytest
  
  build-docs:
    needs: changes
    if: needs.changes.outputs.docs == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: mkdocs build