GitHub Actions Templates

Production-ready GitHub Actions workflow patterns for testing, building, and deploying applications.

Purpose

Create efficient, secure GitHub Actions workflows for continuous integration and deployment across various tech stacks.

When to Use Automate testing and deployment Build Docker images and push to registries Deploy to Kubernetes clusters Run security scans Implement matrix builds for multiple environments Common Workflow Patterns Pattern 1: Test Workflow name: Test

on: push: branches: [main, develop] pull_request: branches: [main]

jobs: test: runs-on: ubuntu-latest

strategy:
  matrix:
    node-version: [18.x, 20.x]

steps:
  - uses: actions/checkout@v4

  - name: Use Node.js ${{ matrix.node-version }}
    uses: actions/setup-node@v4
    with:
      node-version: ${{ matrix.node-version }}
      cache: "npm"

  - name: Install dependencies
    run: npm ci

  - name: Run linter
    run: npm run lint

  - name: Run tests
    run: npm test

  - name: Upload coverage
    uses: codecov/codecov-action@v3
    with:
      files: ./coverage/lcov.info

Reference: See assets/test-workflow.yml

Pattern 2: Build and Push Docker Image name: Build and Push

on: push: branches: [main] tags: ["v*"]

env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }}

jobs: build: runs-on: ubuntu-latest permissions: contents: read packages: write

steps:
  - uses: actions/checkout@v4

  - name: Log in to Container Registry
    uses: docker/login-action@v3
    with:
      registry: ${{ env.REGISTRY }}
      username: ${{ github.actor }}
      password: ${{ secrets.GITHUB_TOKEN }}

  - name: Extract metadata
    id: meta
    uses: docker/metadata-action@v5
    with:
      images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
      tags: |
        type=ref,event=branch
        type=ref,event=pr
        type=semver,pattern={{version}}
        type=semver,pattern={{major}}.{{minor}}

  - name: Build and push
    uses: docker/build-push-action@v5
    with:
      context: .
      push: true
      tags: ${{ steps.meta.outputs.tags }}
      labels: ${{ steps.meta.outputs.labels }}
      cache-from: type=gha
      cache-to: type=gha,mode=max

Reference: See assets/deploy-workflow.yml

Pattern 3: Deploy to Kubernetes name: Deploy to Kubernetes

on: push: branches: [main]

jobs: deploy: runs-on: ubuntu-latest

steps:
  - uses: actions/checkout@v4

  - name: Configure AWS credentials
    uses: aws-actions/configure-aws-credentials@v4
    with:
      aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      aws-region: us-west-2

  - name: Update kubeconfig
    run: |
      aws eks update-kubeconfig --name production-cluster --region us-west-2

  - name: Deploy to Kubernetes
    run: |
      kubectl apply -f k8s/
      kubectl rollout status deployment/my-app -n production
      kubectl get services -n production

  - name: Verify deployment
    run: |
      kubectl get pods -n production
      kubectl describe deployment my-app -n production

Pattern 4: Matrix Build name: Matrix Build

on: [push, pull_request]

jobs: build: runs-on: ${{ matrix.os }}

strategy:
  matrix:
    os: [ubuntu-latest, macos-latest, windows-latest]
    python-version: ["3.9", "3.10", "3.11", "3.12"]

steps:
  - uses: actions/checkout@v4

  - name: Set up Python
    uses: actions/setup-python@v5
    with:
      python-version: ${{ matrix.python-version }}

  - name: Install dependencies
    run: |
      python -m pip install --upgrade pip
      pip install -r requirements.txt

  - name: Run tests
    run: pytest

Reference: See assets/matrix-build.yml

Workflow Best Practices Use specific action versions (@v4, not @latest) Cache dependencies to speed up builds Use secrets for sensitive data Implement status checks on PRs Use matrix builds for multi-version testing Set appropriate permissions Use reusable workflows for common patterns Implement approval gates for production Add notification steps for failures Use self-hosted runners for sensitive workloads Reusable Workflows

.github/workflows/reusable-test.yml

name: Reusable Test Workflow

on: workflow_call: inputs: node-version: required: true type: string secrets: NPM_TOKEN: required: true

jobs: test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: ${{ inputs.node-version }} - run: npm ci - run: npm test

Use reusable workflow:

jobs: call-test: uses: ./.github/workflows/reusable-test.yml with: node-version: "20.x" secrets: NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

Security Scanning name: Security Scan

on: push: branches: [main] pull_request: branches: [main]

jobs: security: runs-on: ubuntu-latest

steps:
  - uses: actions/checkout@v4

  - name: Run Trivy vulnerability scanner
    uses: aquasecurity/trivy-action@master
    with:
      scan-type: "fs"
      scan-ref: "."
      format: "sarif"
      output: "trivy-results.sarif"

  - name: Upload Trivy results to GitHub Security
    uses: github/codeql-action/upload-sarif@v2
    with:
      sarif_file: "trivy-results.sarif"

  - name: Run Snyk Security Scan
    uses: snyk/actions/node@master
    env:
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

Deployment with Approvals name: Deploy to Production

on: push: tags: ["v*"]

jobs: deploy: runs-on: ubuntu-latest environment: name: production url: https://app.example.com

steps:
  - uses: actions/checkout@v4

  - name: Deploy application
    run: |
      echo "Deploying to production..."
      # Deployment commands here

  - name: Notify Slack
    if: success()
    uses: slackapi/slack-github-action@v1
    with:
      webhook-url: ${{ secrets.SLACK_WEBHOOK }}
      payload: |
        {
          "text": "Deployment to production completed successfully!"
        }

Reference Files assets/test-workflow.yml - Testing workflow template assets/deploy-workflow.yml - Deployment workflow template assets/matrix-build.yml - Matrix build template references/common-workflows.md - Common workflow patterns Related Skills gitlab-ci-patterns - For GitLab CI workflows deployment-pipeline-design - For pipeline architecture secrets-management - For secrets handling