GitHub Actions CI/CD Best Practices

Follow these conventions when creating or modifying GitHub Actions workflows to ensure they are secure, maintainable, and performant.

Core Concepts

Workflow Structure

• Use consistent, descriptive names for workflow files (e.g., build-and-test.yml, deploy-prod.yml)
• Choose appropriate triggers: push, pull_request, pull_request_target, workflow_dispatch, schedule, repository_dispatch, workflow_call, workflow_run
• Use concurrency to prevent simultaneous runs for shared resources
• Define permissions at workflow level for least privilege (default to contents: read)
• Leverage reusable workflows (workflow_call) and composite actions to reduce duplication

For detailed guidance and examples, see references/core-concepts.md.