github-actions-workflows

# GitHub Actions Workflows Skill ## Purpose Create and maintain secure, efficient CI/CD pipelines using GitHub Actions for the CIA platform. Covers build, test, security scanning, deployment, and agentic workflow integration. ## When to Use - ✅ Setting up or modifying CI/CD pipelines - ✅ Automating security scans (CodeQL, OWASP, SonarCloud) - ✅ Implementing deployment pipelines - ✅ Scheduling periodic tasks - ✅ Integrating with GitHub Agentic Workflows (`gh-aw`) ## Current CIA Build Environment | Component | Version | Notes | |-----------|---------|-------| | **Java JDK** | 26 (Temurin) | Source level 21 | | **Maven** | 3.9.15 | Multi-module reactor build | | **PostgreSQL** | 18 | Extensions: pgaudit, pgcrypto, pg_stat_statements | | **Node.js** | 24 | MCP servers, Playwright | | **Runner** | ubuntu-latest | GitHub Actions hosted | ## CI/CD Pipeline Template ```yaml name: CI/CD Pipeline on: push: branches: [master] pull_request: branches: [master] permissions: contents: read security-events: write actions: read jobs: build: permissions: contents: read runs-on: ubuntu-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Set up JDK 26 uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1 with: java-version: '26' distribution: 'temurin' cache: 'maven' - name: Build with Maven run: mvn clean install -DskipTests - name: Run Tests run: mvn test -Dtest='!**ITest*,!**/XmlDateTypeAdapterTest,!**/XmlTimeTypeAdapterTest,!**/XmlDateTimeTypeAdapterTest' - name: Upload Coverage uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3 with: files: '**/target/site/jacoco/jacoco.xml' security: runs-on: ubuntu-latest needs: build steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Initialize CodeQL uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18 with: languages: java - name: Autobuild uses: github/codeql-action/autobuild@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18 # Note: The actual codeql-analysis.yml uses a custom Maven build instead of autobuild. # Replace this step with a manual build if autobuild fails for your project. - name: CodeQL Analysis uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18 - name: OWASP Dependency Check run: mvn org.owasp:dependency-check-maven:check deploy: runs-on: ubuntu-latest needs: [build, security] if: github.ref == 'refs/heads/master' permissions: id-token: write # Required for OIDC contents: read steps: - name: Deploy to AWS uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0 with: role-to-assume: ${{ secrets.AWS_ROLE_ARN }} aws-region: eu-north-1 ``` ## Security Best Practices ### Action Pinning Always pin actions to full SHA commit hashes, never tags: ```yaml # ✅ Correct - pinned to SHA - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 # ❌ Wrong - mutable tag - uses: actions/checkout@v4 ``` ### Permissions Always declare minimal permissions at workflow and job level: ```yaml permissions: contents: read # Default for most jobs security-events: write # Only for security scan uploads issues: write # Only for issue management jobs ``` ### Secrets Management ```yaml # ✅ Use GitHub secrets env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} # ✅ Use OIDC for cloud access (no long-lived keys) - uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0 with: role-to-assume: ${{ secrets.AWS_ROLE_ARN }} # ❌ Never hardcode credentials ``` ### Supply Chain Security ```yaml # SLSA 3 build provenance (pin to a specific commit SHA) - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_maven.yml@3c58c41cab36161dc53f223132d1f59f1df67cf9 # v2 with: rekor-log-public: true ``` ## CIA-Specific Workflows ### Existing Workflows | Workflow | Purpose | Trigger | |----------|---------|---------| | `codeql-analysis.yml` | Security vulnerability scanning | Push/PR to master + scheduled | | `dependency-review.yml` | Dependency security checks | PR only | | `scorecards.yml` | OpenSSF Scorecard assessment | Scheduled | | `release.yml` | Build artifacts + SLSA attestations | Manual (`workflow_dispatch`) | | `copilot-setup-steps.yml` | Copilot agent build environment | Copilot sessions | | `javadoc-generation.yml` | JavaDoc generation | Push/scheduled | | `site-generation.yml` | Maven site generation | Push/scheduled | | `zap-scan.yml` | OWASP ZAP security scan | Scheduled | | `generate-intelligence-changelog.yml` | Intelligence changelog generation | Manual (`workflow_dispatch`) | | `labeler.yml` | Pull request auto-labeling | `pull_request_target` | | `validate-field-completeness.yml` | JSON export field completeness | Push (path-filtered) | | `validate-json-schemas.yml` | JSON schema validation | Push/PR (path-filtered) + scheduled | | `validate-view-documentation.yml` | View documentation validation | Scheduled (monthly) + PR (path-filtered) | ### PostgreSQL Setup Pattern ```yaml services: postgres: image: postgres:18 env: POSTGRES_USER: eris POSTGRES_PASSWORD: ${{ secrets.DB_PASSWORD }} POSTGRES_DB: cia_dev options: >- --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5 ports: - 5432:5432 ``` ### Maven Build Optimization ```yaml # Multi-level caching for resilience - name: Cache Maven repository uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: ~/.m2/repository key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} restore-keys: | ${{ runner.os }}-maven- # Parallel builds for multi-module projects - name: Build run: mvn -T 1C clean install -DskipTests ``` ## Integration with Agentic Workflows GitHub Agentic Workflows (`gh-aw`) complement traditional Actions: | Aspect | Traditional Actions | Agentic Workflows | |--------|-------------------|-------------------| | **Logic** | Deterministic YAML | Natural language AI | | **Decisions** | Pre-programmed conditionals | Context-aware reasoning | | **Format** | `.yml` files | `.md` files → compiled to `.lock.yml` | | **Security** | Manual permission management | Built-in 5-layer security | | **Best for** | Build, test, deploy | Triage, review, docs, analysis | Use both together: traditional Actions for deterministic build/test/deploy, agentic workflows for intelligent automation. ## ISMS Control Mapping | Control | Implementation | |---------|---------------| | **ISO 27001 A.8.8** | Change management via PR-gated workflow changes | | **ISO 27001 A.8.15** | Audit logging via Actions run logs | | **NIST CSF PR.IP-1** | Baseline configuration via pinned action versions | | **CIS Control 16** | Application security via CodeQL + OWASP in pipeline | ## References - GitHub Actions: https://docs.github.com/en/actions - Action Security Hardening: https://docs.github.com/en/actions/security-for-github-actions - SLSA Framework: https://slsa.dev/ - OpenSSF Scorecard: https://securityscorecards.dev/ - CIA Workflows: `.github/workflows/`