GitHub Actions Complete Guide

WORKFLOW# .github/workflows/ci.yml name: CI Pipeline # Display name in GitHub UI on: # WHEN to run push: branches: [main, develop] pull_request: branches: [main] jobs: # WHAT to run build: runs-on: ubuntu-latest # WHERE to run steps: - uses: actions/checkout@v4 # Step 1: checkout code - uses: actions/setup-java@v4 # Step 2: install Java with: java-version: '17' distribution: 'temurin' - run: mvn clean package # Step 3: build - run: mvn test # Step 4: test

YAML# Push to specific branches on: push: branches: [main, release/*] paths: ['src/**', 'pom.xml'] # Only when these files change # Pull request events on: pull_request: types: [opened, synchronize, reopened] # Scheduled (cron) on: schedule: - cron: '0 2 * * *' # Every day at 2 AM UTC # Manual trigger (button in GitHub UI) on: workflow_dispatch: inputs: environment: type: choice options: [staging, production] # On release published on: release: types: [published]

YAMLjobs: test: runs-on: ubuntu-latest strategy: matrix: java: [11, 17, 21] # Test on 3 Java versions os: [ubuntu-latest, windows-latest] steps: - uses: actions/checkout@v4 - uses: actions/setup-java@v4 with: java-version: ${{ matrix.java }} - run: mvn test # Runs 6 combinations: Java11-ubuntu, Java11-windows, Java17-ubuntu... deploy: needs: test # Wait for ALL test jobs to pass if: github.ref == 'refs/heads/main' # Only on main branch runs-on: ubuntu-latest steps: - run: echo "Deploying..."

YAMLname: Java CI on: { push: { branches: [main] } } jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-java@v4 with: { java-version: '17', distribution: 'temurin' } - run: mvn clean package # Artifact: target/app.jar (fat JAR ~40MB)

YAMLname: Node CI on: { push: { branches: [main] } } jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: { node-version: '20' } - run: npm ci - run: npm run lint - run: npm test -- --coverage --watchAll=false - run: npm run build # React artifact: build/ folder (static HTML/JS/CSS ~5MB) # Node artifact: dist/ folder (compiled TypeScript)

YAMLname: Python CI on: { push: { branches: [main] } } jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-python@v5 with: { python-version: '3.12' } - run: pip install -r requirements.txt - run: python -m pytest tests/ --junitxml=results.xml

YAMLname: Flutter CI on: { push: { branches: [main] } } jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: subosito/flutter-action@v2 with: { flutter-version: '3.19' } - run: flutter pub get - run: flutter test - run: flutter build apk --release # Artifact: build/app/outputs/flutter-apk/app-release.apk

YAMLname: Docker Build on: { push: { branches: [main] } } jobs: docker: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 # Login to registry - uses: docker/login-action@v3 with: registry: ghcr.io # GitHub Container Registry username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} # Auto-provided! # Build and push - uses: docker/build-push-action@v5 with: push: true tags: ghcr.io/${{ github.repository }}:${{ github.sha }} # For AWS ECR: - uses: aws-actions/amazon-ecr-login@v2 # For Azure ACR: - uses: docker/login-action@v3 with: registry: myacr.azurecr.io username: ${{ secrets.ACR_USERNAME }} password: ${{ secrets.ACR_PASSWORD }}

YAML# SonarQube SAST sonarqube: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: { fetch-depth: 0 } - uses: SonarSource/sonarqube-scan-action@master env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_HOST_URL: ${{ vars.SONAR_URL }} # Trivy Container Scan trivy: runs-on: ubuntu-latest steps: - uses: aquasecurity/trivy-action@master with: image-ref: ghcr.io/myorg/myapp:${{ github.sha }} severity: CRITICAL,HIGH exit-code: '1' # Fail if critical vulns found # GitHub CodeQL (free built-in SAST) codeql: runs-on: ubuntu-latest permissions: { security-events: write } steps: - uses: actions/checkout@v4 - uses: github/codeql-action/init@v3 with: { languages: javascript } - uses: github/codeql-action/analyze@v3

YAML# Deploy to AWS EKS deploy-eks: needs: [build, security] runs-on: ubuntu-latest if: github.ref == 'refs/heads/main' environment: production # Requires approval! steps: - uses: aws-actions/configure-aws-credentials@v4 with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }} aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }} aws-region: ap-south-1 - run: aws eks update-kubeconfig --name my-cluster - run: | kubectl set image deployment/order-service \ app=$ECR_REGISTRY/order-service:${{ github.sha }} \ -n production kubectl rollout status deployment/order-service -n production

YAMLdeploy-frontend: needs: build runs-on: ubuntu-latest if: github.ref == 'refs/heads/main' steps: - uses: actions/download-artifact@v4 with: { name: frontend-build } - uses: aws-actions/configure-aws-credentials@v4 with: aws-access-key-id: ${{ secrets.AWS_KEY }} aws-secret-access-key: ${{ secrets.AWS_SECRET }} aws-region: ap-south-1 - run: aws s3 sync build/ s3://my-frontend-bucket --delete - run: aws cloudfront create-invalidation --distribution-id E12345 --paths '/*'

YAML# .github/workflows/reusable-docker.yml (in shared repo) on: workflow_call: # Makes this workflow callable inputs: image_name: type: string required: true secrets: registry_password: required: true jobs: docker: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: docker build -t ghcr.io/org/${{ inputs.image_name }}:${{ github.sha }} . - run: docker push ghcr.io/org/${{ inputs.image_name }}:${{ github.sha }} # ═══ Calling it from another repo ═══ # .github/workflows/ci.yml jobs: build-docker: uses: myorg/shared-workflows/.github/workflows/reusable-docker.yml@main with: image_name: order-service secrets: registry_password: ${{ secrets.GHCR_TOKEN }}