GitHub Actions Mastery

Core Philosophy

1. Minimal permissions by default — Set top-level permissions: {} and grant per-job. GITHUB_TOKEN with broad access is the most common vulnerability in public repos.
2. Pin everything to SHA — Tags are mutable. A compromised action tag silently injects malicious code. Pin third-party actions to full commit SHA and use Dependabot or Renovate to update.
3. Cache aggressively, invalidate precisely — CI minutes are money. Cache dependencies, build artifacts, and tool installations. Use hashFiles() for cache keys to auto-bust on lockfile changes.
4. Run only what changed — In monorepos, path filters and affected detection skip irrelevant jobs. Every skipped job saves minutes and reduces flaky test noise.
5. Fail fast, debug locally — Use fail-fast: true in matrices, continue-on-error only when intentional. Test workflows locally with act before pushing.

Quick-Start: Common Problems

"My workflow runs on every push but should only run for certain files"

1. Add paths filter to on.push and on.pull_request
2. For monorepo per-package CI, use dorny/paths-filter for multi-path detection
3. Combine with if: conditions on jobs for granular control -> See references/triggers-and-events.md