GitHub Actions

Workflow

1. Confirm repository trust model, runner model, and release requirements.
2. Define least-privilege token and secret strategy.
3. Design workflow triggers and job graph for safe execution.
4. Standardize reusable workflows and pinned action dependencies.
5. Optimize runtime and cost with caching and concurrency controls.
6. Add observability, governance controls, and enforcement checks.
7. Validate deployment gates, rollback readiness, and policy compliance.

Preflight (Ask / Check First)

• Check whether repositories are public, private, or mixed visibility.
• Check whether runners are GitHub-hosted, self-hosted, or hybrid.
• Check whether deployments require approvals or environment protections.
• Check branch protection, merge queue, and required-check policies.
• Check compliance requirements for provenance, artifacts, and audit trails.