GitHub Actions Advanced Workflows: Building Efficient CI/CD Pipelines

GitHub Actions is GitHub's built-in CI/CD platform, flexible and powerful. This article introduces advanced workflow patterns to help you build more efficient automation pipelines.

1. Matrix Build Strategy

Matrix builds can run tests in parallel across multiple operating systems and language versions.

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        node: [18, 20, 22]
        exclude:
          - os: windows-latest
            node: 22
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
      - run: npm ci
      - run: npm test

2. Reusable Workflows

Abstract common workflows into reusable modules.

# .github/workflows/deploy.yml
on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
    secrets:
      DEPLOY_TOKEN:
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - uses: actions/checkout@v4
      - run: ./deploy.sh
        env:
          TOKEN: ${{ secrets.DEPLOY_TOKEN }}

3. Environments & Approvals

jobs:
  deploy-production:
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://example.com
    steps:
      - run: ./deploy-prod.sh

4. OIDC Authentication

Use OpenID Connect to replace long-lived secrets:

jobs:
  deploy-to-aws:
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789:role/github-actions
          aws-region: us-east-1
      - run: aws s3 sync ./dist s3://my-bucket

5. Best Practices

  1. Cache Dependencies: Use actions/cache to speed up builds
  2. Parallel Execution: Use matrices and parallel jobs effectively
  3. Conditional Execution: Based on branches, tags, or file changes
  4. Security Scanning: Integrate CodeQL and Dependabot