github-actions-cilisted

# GitHub Actions CI/CD Patterns Practical patterns for reliable, secure, and efficient GitHub Actions workflows. ## Workflow Anatomy & Sane Defaults Every production workflow needs three top-level settings that GitHub omits by default: ```yaml # ❌ WRONG: No permissions, no timeout, no concurrency control jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 # ✅ CORRECT: Locked down from the start permissions: contents: read # only what this job actually needs # add pull-requests: write only if the job posts PR comments, etc. concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true # kill stale PR runs, save runner minutes jobs: build: runs-on: ubuntu-latest timeout-minutes: 15 # default is 360 — a hung job silently burns quota steps: - uses: actions/checkout@v4 ``` - `permissions: contents: read` at the workflow level sets the floor; individual jobs can widen it. The default `read-all` is too broad and violates least privilege. - `timeout-minutes` on every job prevents a runaway process from consuming the monthly runner budget. - `cancel-in-progress: true` is correct for PR branches; for the default branch use `cancel-in-progress: false` so deploys are not interrupted mid-flight. ## Trigger Patterns ### pull_request vs push, and path filters ```yaml # ❌ WRONG: Runs CI on every push including docs-only changes on: push: branches: [main] pull_request: # ✅ C