CI/CD Standards

Standards for CI/CD pipelines and GitHub Actions.

GitHub Actions / Workflows

• Shell script code should NOT be inline in Actions/Workflow YAML files
• Extract scripts to dedicated .sh or .py files in a scripts/ directory
• Reference these scripts from the workflow
• ALWAYS pin actions to full commit SHAs, NOT version tags

Action Pinning

Actions MUST be pinned to SHA hashes for security and reproducibility:

# WRONG - version tag (can be moved, vulnerable to supply chain attacks)
- uses: actions/checkout@v4
- uses: actions/setup-python@v5