#GitHub Actions
13 posts
GitHub Actions #10 Operations Patterns: Path Filters, Concurrency, Debugging, and Cost Review
Waking only the workflows for changed paths in a monorepo with paths filters — and where they fall short; how to decide on concurrency groups and cancel-in-progress to clean up overlapping runs; and why timeout-minutes should be a default habit. We also cover debugging tools like debug logs and re-runs, plus cost review on the usage screen, gathering the patterns of day-to-day operations to close out the series.
GitHub Actions #9 Security Hardening: Minimal permissions, SHA Pinning, and pull_request_target
Starting from shrinking the GITHUB_TOKEN default permissions to read-only and opening write access only on the jobs that need it, we cover the supply chain risk of third-party actions whose tags are mutable, SHA pinning, and pairing it with Dependabot auto-updates. We also map out the pull_request_target trap — a classic route for secret exposure — and defending against the script injection that interpolated titles and branch names create.
GitHub Actions #8 Self-Hosted Runners: When to Adopt, Registration, and Security Principles
Three situations where hosted runners fall short — internal network access, cost, and special hardware — organized into adoption criteria, plus the registration procedure and routing jobs with labels. We cover why self-hosted runners must never be connected to public repositories, the ephemeral runner operating principle, and actions-runner-controller for auto-scaling runners on Kubernetes.
GitHub Actions #7 AWS Deploys and OIDC: Credentials Without Access Keys
We look at the leak and rotation problems of storing access keys in secrets, then explain how a workflow assumes an AWS role with short-lived tokens through OIDC, walking the token exchange flow step by step. We cover the AWS-side trust configuration and sub claim restrictions, the configure-aws-credentials action and the id-token permission, and finish with an S3 static site deploy — closing out the credential problem in the deploy pipeline.
GitHub Actions #6 Docker Build and GHCR Push: Tag Strategy and Build Cache
We assemble the standard pipeline that builds a container image and pushes it to GitHub Container Registry. From GHCR login with nothing but GITHUB_TOKEN, to how metadata-action decides tags automatically per event, to cutting build time with build-push-action and the gha cache — plus the practical baseline for branch, tag, and SHA tag strategies.
GitHub Actions #5 Reuse: Composite Actions and Reusable Workflows
Two ways to turn the step bundles repeated across workflows and repositories into components. We cover how to write action.yml for a composite action that packages a bundle of steps, reusable workflows that expose an entire job via workflow_call with inputs and secrets passing, the criteria for choosing between the two, and the pattern of standardizing on a shared repository at the organization level.
GitHub Actions #4 Matrix, Cache, and Artifacts: Combination Runs and Saving Time and Money
We expand a single job definition into combinations of versions and operating systems with the matrix strategy, covering the include, exclude, and fail-fast options, then cut dependency install time with the key and restore-keys design of actions/cache and the built-in cache options of the setup actions. We finish with artifacts for passing files between jobs — upload, download, and retention settings — all through the lens of reducing run time and runner cost.
GitHub Actions #3 Secrets, Variables, and Environments: secrets vs vars and Environment Approval Gates
The two channels for feeding secret and configuration values into workflows — secrets and vars — with the rule for choosing between them, and the priority across the organization, repository, and environment layers. We cover what log masking protects and why not to over-trust it, how environment protection rules put required reviewers and wait timers in front of deploys, and what the automatically issued GITHUB_TOKEN really is.
GitHub Actions #2 Core Syntax: Contexts, Expressions, if Conditions, and Passing Values
A systematic pass over workflow YAML syntax. We cover contexts like github, env, and steps along with expression syntax, if conditions with the success, failure, and always functions for running steps selectively, passing values between steps with GITHUB_OUTPUT, and wiring order and data between jobs with needs and outputs.
GitHub Actions #1 Anatomy of a Workflow: Events, Jobs, Runners, and Your First Run
Automating the tests and builds you have been repeating by hand on every push. We map out the five concepts that make up GitHub Actions — workflow, event, job, step, runner — write a first workflow that runs Python tests, and learn to read results in the Actions tab, add a status badge, survey the trigger events, and understand the runner free-tier basics.
K8s Practice #4: CI/CD Pipeline — GitHub Actions / ECR / ArgoCD
The `myshop-api` built in [#3](/en/posts/k8s-practice-3) still relies on manual steps whenever a new version is released. This post automates that process. GitHub Actions pushes container images to AWS ECR via OIDC without static keys, auto-commits Helm values in the manifest repo so the ArgoCD covered in [Advanced #6](/en/posts/k8s-advanced-6) can detect the change and sync to the cluster, and keeps PR approval gates, dev/prod branching, and canary deployment in one flow.
AWS in Practice #3: CI/CD — GitHub Actions + ECR + ECS
GitHub Actions without access keys via OIDC, ECR push, automatic Task Definition updates, ECS Service rolling deployments, deployment circuit breakers and auto-rollback, and a touch of CodeDeploy blue/green — a deployment flow that ends with a single git push.