Provides CI/CD pipeline best practices for GitHub Actions, deployment strategies, and pipeline optimization. Use when setting up pipelines, configuring GitHub Actions, managing deployments, or when user mentions 'CI', 'CD', 'pipeline', 'GitHub Actions', 'deploy', 'workflow', 'build'.
Provides CI/CD pipeline best practices for GitHub Actions, deployment strategies, and pipeline optimization. Use when setting up pipelines, configuring GitHub Actions, managing deployments, or when user mentions 'CI', 'CD', 'pipeline', 'GitHub Actions', 'deploy', 'workflow', 'build'.
type
skill
category
patterns
status
stable
origin
tibsfox
modified
false
first_seen
"2026-02-07T00:00:00.000Z"
first_path
examples/ci-cd-patterns/SKILL.md
superseded_by
null
CI/CD Patterns
Best practices for building reliable, secure, and fast CI/CD pipelines with GitHub Actions.
Pipeline Stages
A well-structured pipeline follows this progression. Each stage gates the next.
name:CIon:pull_request:branches: [main]
push:branches: [main]
# Cancel in-progress runs for the same branch/PRconcurrency:group:ci-${{github.ref}}cancel-in-progress:truepermissions:contents:readjobs:lint:runs-on:ubuntu-lateststeps:-uses:actions/checkout@v4-
[, , ]
uses:
actions/setup-node@v4
with:
node-version:
20
cache:
npm
-
run:
npm
ci
-
run:
npm
run
lint
-
run:
npm
run
format:check
test:
runs-on:
ubuntu-latest
needs:
lint
strategy:
matrix:
node-version:
18
20
22
steps:
-
uses:
actions/checkout@v4
-
uses:
actions/setup-node@v4
with:
node-version:
${{
matrix.node-version
}}
cache:
npm
-
run:
npm
ci
-
run:
npm
test
--
--coverage
-
uses:
actions/upload-artifact@v4
if:
matrix.node-version
==
20
with:
name:
coverage-report
path:
coverage/
retention-days:
7
build:
runs-on:
ubuntu-latest
needs:
test
steps:
-
uses:
actions/checkout@v4
-
uses:
actions/setup-node@v4
with:
node-version:
20
cache:
npm
-
run:
npm
ci
-
run:
npm
run
build
-
uses:
actions/upload-artifact@v4
with:
name:
build-output
path:
dist/
retention-days:
7
Deployment Workflow with Approval Gate
name:Deployon:push:branches: [main]
workflow_dispatch:inputs:environment:description:Targetenvironmentrequired:truedefault:stagingtype:choiceoptions:-staging-productionpermissions:contents:readdeployments:writejobs:build:runs-on:ubuntu-lateststeps:-uses:actions/checkout@v4-uses:actions/setup-node@v4with:node-version:20cache:npm-run:npmci-run:npmrunbuild-uses:actions/upload-artifact@v4with:name:deploy-artifactpath:dist/deploy-staging:needs:buildruns-on:ubuntu-latestenvironment:stagingsteps:-uses:actions/download-artifact@v4with:name:deploy-artifactpath:dist/-name:Deploytostagingenv:DEPLOY_TOKEN:${{secrets.STAGING_DEPLOY_TOKEN}}run:|
# Deploy script here -- uses secret, never echo it
echo "Deploying to staging..."
deploy-production:needs:deploy-stagingif:github.ref=='refs/heads/main'runs-on:ubuntu-latest# CRITICAL: Production requires manual approval via GitHub Environmentsenvironment:productionsteps:-uses:actions/download-artifact@v4with:name:deploy-artifactpath:dist/-name:Deploytoproductionenv:DEPLOY_TOKEN:${{secrets.PRODUCTION_DEPLOY_TOKEN}}run:|
echo "Deploying to production..."
steps:-name:Usesecretsafelyenv:# Secret is automatically masked in logsAPI_KEY:${{secrets.API_KEY}}run:|
# NEVER do this:
# echo "Key is $API_KEY"
# SAFE: Use secret in commands without printingcurl-s-H"Authorization: Bearer $API_KEY"https://api.example.com/health-name:Maskdynamicvaluesrun:|
TOKEN=$(generate-token)
echo "::add-mask::$TOKEN"
# Now $TOKEN is masked in all subsequent log output
echo "Token generated successfully"
OIDC for Cloud Providers (No Stored Secrets)
permissions:id-token:writecontents:readsteps:-uses:aws-actions/configure-aws-credentials@v4with:role-to-assume:arn:aws:iam::123456789:role/github-deployaws-region:us-east-1# No AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY needed
Caching Strategies
Dependency Caching
# Node.js -- built into setup-node-uses:actions/setup-node@v4with:node-version:20cache:npm# Python-uses:actions/setup-python@v5with:python-version:'3.12'cache:pip# Go-uses:actions/setup-go@v5with:go-version:'1.22'cache:true# Rust-uses:actions/cache@v4with:path:|
~/.cargo/bin/
~/.cargo/registry/index/
~/.cargo/registry/cache/
target/
key:rust-${{hashFiles('**/Cargo.lock')}}restore-keys:rust-
Two identical environments. Switch traffic atomically.
Current traffic --> Blue (v1.0)
Green (v1.1) <-- Deploy here, test, then switch
After switch:
Current traffic --> Green (v1.1)
Blue (v1.0) <-- Rollback target
Pros
Cons
Instant rollback
Requires 2x infrastructure
Zero downtime
Database migrations need care
Full environment testing
Higher cost
Canary Deployment
Route a small percentage of traffic to the new version.
Test across multiple versions and platforms efficiently.
strategy:fail-fast:false# Don't cancel other jobs if one failsmatrix:os: [ubuntu-latest, macos-latest, windows-latest]
node-version: [18, 20, 22]
exclude:# Skip combinations that don't matter-os:macos-latestnode-version:18include:# Add specific extra combinations-os:ubuntu-latestnode-version:20coverage:truesteps:-run:npmtest-if:matrix.coveragerun:npmruntest:coverage
Pipeline Optimization
Speed Improvements
Technique
Savings
Complexity
Dependency caching
30-60s
Low
Parallel jobs
40-70%
Low
cancel-in-progress
Avoid wasted runs
Low
Docker layer caching
1-5 min
Medium
Selective test running
Variable
Medium
Self-hosted runners
Variable
High
Conditional Execution
# Only run when relevant files changeon:push:paths:-'src/**'-'tests/**'-'package.json'-'package-lock.json'paths-ignore:-'**.md'-'docs/**'# Skip CI for documentation-only changesjobs:test:if:|
!contains(github.event.head_commit.message, '[skip ci]') &&
!contains(github.event.head_commit.message, '[docs only]')
