on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true  # false for releases

permissions:
  contents: read  # Minimal by default

jobs:
  build:
    timeout-minutes: 30  # Never use default 6h

Language Quick Reference

Language	Setup	Template
Rust	`dtolnay/rust-toolchain@stable`	TEMPLATE-RUST
Go	`actions/setup-go@v6`	TEMPLATE-GO
TypeScript	`oven-sh/setup-bun@v2`	TEMPLATE-TS
Bash	—	TEMPLATE-BASH
Python	`astral-sh/setup-uv@v7`	TEMPLATE-PYTHON

Cross-Platform Matrix (Native ARM 2025+)

strategy:
  fail-fast: false
  matrix:
    include:
      - os: ubuntu-latest        # Linux x64
        target: x86_64-unknown-linux-gnu
      - os: ubuntu-24.04-arm     # Linux ARM (native!)
        target: aarch64-unknown-linux-gnu
      - os: macos-14             # Apple Silicon (native!)
        target: aarch64-apple-darwin
      - os: macos-15-intel       # macOS x64
        target: x86_64-apple-darwin
      - os: windows-latest       # Windows x64
        target: x86_64-pc-windows-msvc

Key insight: Native ARM runners are 10x faster than QEMU emulation.

Release Checklist

Cross-platform build matrix
Generate checksums (sha256sum)
Sign artifacts (minisign/cosign)
Create GitHub Release (softprops/action-gh-release@v2)
Notify package managers (Homebrew/Scoop)
Generate SBOM (syft)
Attach SLSA provenance

Patterns: RELEASE-BUILD | RELEASE-EXTRAS | SECURITY-SIGNING

Caching

Language	Action	Notes
Rust	`Swatinem/rust-cache@v2`	Auto-caches cargo + target
Go	`actions/setup-go@v6`	Built-in, enabled by default
Node/Bun	`actions/cache@v4`	Cache `node_modules`

Include arch in cache key for cross-platform:

key: ${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.lock') }}

Security (2025 Best Practices)

Practice	Example
Pin to SHA	`uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683`
OIDC auth	`permissions: { id-token: write }` + cloud provider action
Keyless signing	`sigstore/cosign-installer@v3`
SLSA Level 3	`actions/attest-build-provenance@v2`

Full patterns: SECURITY-CORE | SECURITY-SIGNING

Anti-Patterns

Don't	Do Instead
`@main` for third-party actions	Pin to SHA
Default 6h timeout	Set explicit `timeout-minutes`
QEMU for ARM builds	Native ARM runners
Store secrets in workflow	Use `secrets.*`
Skip concurrency controls	Use `concurrency:` group

Reference Index

By Topic

Topic	Reference
CI essentials (triggers, jobs, env)	CI-CORE
CI advanced (matrix, caching, artifacts)	CI-ADVANCED
Release build workflows	RELEASE-BUILD
Signing, versioning, install scripts	RELEASE-EXTRAS
GoReleaser config	GORELEASER
Security fundamentals	SECURITY-CORE
Signing and provenance	SECURITY-SIGNING
Coverage collection	COVERAGE
Fuzzing, benchmarks, analysis	TESTING
Dependabot configuration	DEPENDABOT
Playwright browser tests	BROWSER-TESTS
Docker/OCI with signing	OCI-PATTERNS
Python wheels (maturin)	PYTHON-WHEELS
Database service containers	SERVICES
ACFS checksum notifications	ACFS-PATTERNS

By Language

Language	Template
Rust	TEMPLATE-RUST
Go	TEMPLATE-GO
TypeScript/Bun	TEMPLATE-TS
Bash	TEMPLATE-BASH
Python/uv	TEMPLATE-PYTHON

Validation

actionlint .github/workflows/*.yml
gh workflow list && gh run list --workflow=ci.yml

Need	Template	Reference
CI on push/PR	`ci.yml`	CI-CORE
Release on tag	`release.yml`	RELEASE-BUILD
Nightly fuzz/bench	`fuzz.yml`	TESTING
Dependency updates	`dependabot.yml`	DEPENDABOT

gh-actions

Optimal GitHub Actions

Quick Start: Which Workflow?

Core Patterns (Every Workflow)