$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill github-actionsBuild, test, and deploy applications using GitHub Actions workflows. Create CI/CD pipelines, configure runners, manage secrets, and automate software delivery. Use when working with GitHub repositories, automating builds, running tests, or deploying applications.
| 1 | # GitHub Actions |
| 2 | |
| 3 | Automate software workflows directly in your GitHub repository with GitHub Actions. |
| 4 | |
| 5 | ## When to Use This Skill |
| 6 | |
| 7 | Use this skill when: |
| 8 | - Setting up CI/CD pipelines for GitHub repositories |
| 9 | - Automating build, test, and deployment workflows |
| 10 | - Creating reusable workflow components |
| 11 | - Configuring self-hosted runners |
| 12 | - Managing workflow secrets and variables |
| 13 | - Debugging failed workflow runs |
| 14 | |
| 15 | ## Prerequisites |
| 16 | |
| 17 | - GitHub repository with write access |
| 18 | - Understanding of YAML syntax |
| 19 | - For self-hosted runners: server with Docker (optional) |
| 20 | |
| 21 | ## Workflow File Structure |
| 22 | |
| 23 | Workflows are defined in `.github/workflows/` directory: |
| 24 | |
| 25 | ```yaml |
| 26 | name: CI Pipeline |
| 27 | |
| 28 | on: |
| 29 | push: |
| 30 | branches: [main, develop] |
| 31 | pull_request: |
| 32 | branches: [main] |
| 33 | |
| 34 | jobs: |
| 35 | build: |
| 36 | runs-on: ubuntu-latest |
| 37 | steps: |
| 38 | - uses: actions/checkout@v4 |
| 39 | - name: Setup Node.js |
| 40 | uses: actions/setup-node@v4 |
| 41 | with: |
| 42 | node-version: '20' |
| 43 | cache: 'npm' |
| 44 | - run: npm ci |
| 45 | - run: npm test |
| 46 | ``` |
| 47 | |
| 48 | ## Common Triggers |
| 49 | |
| 50 | ### Push and Pull Request |
| 51 | |
| 52 | ```yaml |
| 53 | on: |
| 54 | push: |
| 55 | branches: [main] |
| 56 | paths: |
| 57 | - 'src/**' |
| 58 | - 'package.json' |
| 59 | pull_request: |
| 60 | branches: [main] |
| 61 | ``` |
| 62 | |
| 63 | ### Scheduled Runs |
| 64 | |
| 65 | ```yaml |
| 66 | on: |
| 67 | schedule: |
| 68 | - cron: '0 2 * * *' # Daily at 2 AM UTC |
| 69 | ``` |
| 70 | |
| 71 | ### Manual Dispatch |
| 72 | |
| 73 | ```yaml |
| 74 | on: |
| 75 | workflow_dispatch: |
| 76 | inputs: |
| 77 | environment: |
| 78 | description: 'Deployment environment' |
| 79 | required: true |
| 80 | default: 'staging' |
| 81 | type: choice |
| 82 | options: |
| 83 | - staging |
| 84 | - production |
| 85 | ``` |
| 86 | |
| 87 | ## Job Configuration |
| 88 | |
| 89 | ### Matrix Builds |
| 90 | |
| 91 | ```yaml |
| 92 | jobs: |
| 93 | test: |
| 94 | runs-on: ubuntu-latest |
| 95 | strategy: |
| 96 | matrix: |
| 97 | node-version: [18, 20, 22] |
| 98 | os: [ubuntu-latest, windows-latest] |
| 99 | steps: |
| 100 | - uses: actions/checkout@v4 |
| 101 | - uses: actions/setup-node@v4 |
| 102 | with: |
| 103 | node-version: ${{ matrix.node-version }} |
| 104 | - run: npm test |
| 105 | ``` |
| 106 | |
| 107 | ### Job Dependencies |
| 108 | |
| 109 | ```yaml |
| 110 | jobs: |
| 111 | build: |
| 112 | runs-on: ubuntu-latest |
| 113 | steps: |
| 114 | - run: npm run build |
| 115 | |
| 116 | test: |
| 117 | needs: build |
| 118 | runs-on: ubuntu-latest |
| 119 | steps: |
| 120 | - run: npm test |
| 121 | |
| 122 | deploy: |
| 123 | needs: [build, test] |
| 124 | runs-on: ubuntu-latest |
| 125 | steps: |
| 126 | - run: ./deploy.sh |
| 127 | ``` |
| 128 | |
| 129 | ### Environment Protection |
| 130 | |
| 131 | ```yaml |
| 132 | jobs: |
| 133 | deploy: |
| 134 | runs-on: ubuntu-latest |
| 135 | environment: |
| 136 | name: production |
| 137 | url: https://example.com |
| 138 | steps: |
| 139 | - run: ./deploy.sh |
| 140 | ``` |
| 141 | |
| 142 | ## Secrets and Variables |
| 143 | |
| 144 | ### Using Secrets |
| 145 | |
| 146 | ```yaml |
| 147 | steps: |
| 148 | - name: Deploy |
| 149 | env: |
| 150 | AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} |
| 151 | AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} |
| 152 | run: aws s3 sync ./dist s3://my-bucket |
| 153 | ``` |
| 154 | |
| 155 | ### Using Variables |
| 156 | |
| 157 | ```yaml |
| 158 | steps: |
| 159 | - name: Build |
| 160 | env: |
| 161 | API_URL: ${{ vars.API_URL }} |
| 162 | run: npm run build |
| 163 | ``` |
| 164 | |
| 165 | ## Caching Dependencies |
| 166 | |
| 167 | ```yaml |
| 168 | - uses: actions/cache@v4 |
| 169 | with: |
| 170 | path: ~/.npm |
| 171 | key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }} |
| 172 | restore-keys: | |
| 173 | ${{ runner.os }}-node- |
| 174 | ``` |
| 175 | |
| 176 | ## Artifacts |
| 177 | |
| 178 | ### Upload Artifacts |
| 179 | |
| 180 | ```yaml |
| 181 | - uses: actions/upload-artifact@v4 |
| 182 | with: |
| 183 | name: build-output |
| 184 | path: dist/ |
| 185 | retention-days: 5 |
| 186 | ``` |
| 187 | |
| 188 | ### Download Artifacts |
| 189 | |
| 190 | ```yaml |
| 191 | - uses: actions/download-artifact@v4 |
| 192 | with: |
| 193 | name: build-output |
| 194 | path: dist/ |
| 195 | ``` |
| 196 | |
| 197 | ## Docker Builds |
| 198 | |
| 199 | ```yaml |
| 200 | jobs: |
| 201 | docker: |
| 202 | runs-on: ubuntu-latest |
| 203 | steps: |
| 204 | - uses: actions/checkout@v4 |
| 205 | |
| 206 | - name: Login to Docker Hub |
| 207 | uses: docker/login-action@v3 |
| 208 | with: |
| 209 | username: ${{ secrets.DOCKER_USERNAME }} |
| 210 | password: ${{ secrets.DOCKER_PASSWORD }} |
| 211 | |
| 212 | - name: Build and push |
| 213 | uses: docker/build-push-action@v5 |
| 214 | with: |
| 215 | context: . |
| 216 | push: true |
| 217 | tags: user/app:latest |
| 218 | ``` |
| 219 | |
| 220 | ## Reusable Workflows |
| 221 | |
| 222 | ### Define Reusable Workflow |
| 223 | |
| 224 | ```yaml |
| 225 | # .github/workflows/reusable-deploy.yml |
| 226 | name: Reusable Deploy |
| 227 | |
| 228 | on: |
| 229 | workflow_call: |
| 230 | inputs: |
| 231 | environment: |
| 232 | required: true |
| 233 | type: string |
| 234 | secrets: |
| 235 | deploy_key: |
| 236 | required: true |
| 237 | |
| 238 | jobs: |
| 239 | deploy: |
| 240 | runs-on: ubuntu-latest |
| 241 | environment: ${{ inputs.environment }} |
| 242 | steps: |
| 243 | - run: echo "Deploying to ${{ inputs.environment }}" |
| 244 | ``` |
| 245 | |
| 246 | ### Call Reusable Workflow |
| 247 | |
| 248 | ```yaml |
| 249 | jobs: |
| 250 | deploy-staging: |
| 251 | uses: ./.github/workflows/reusable-deploy.yml |
| 252 | with: |
| 253 | environment: staging |
| 254 | secrets: |
| 255 | deploy_key: ${{ secrets.STAGING_KEY }} |
| 256 | ``` |
| 257 | |
| 258 | ## Self-Hosted Runners |
| 259 | |
| 260 | ### Register Runner |
| 261 | |
| 262 | ```bash |
| 263 | # Download runner |
| 264 | mkdir actions-runner && cd actions-runner |
| 265 | curl -o actions-runner-linux-x64.tar.gz -L https://github.com/actions/runner/releases/download/v2.311.0/ |