GitHub Actions CI/CD Guide
Quick Reference
| Topic | Reference |
|---|---|
| E2E tests, containers, expect | testing-patterns.md |
| Permissions, secrets, security | security.md |
| Debugging, caching, performance | optimization.md |
Triggers: push, pull_request, release, workflow_dispatch, schedule Runners: ubuntu-latest, macos-latest, macos-13, windows-latest Contexts: ${{github.event_name}}, ${{github.ref}}, ${{runner.os}}, ${{matrix.*}}
Project Workflows
- installer-ci.yml: Build → test → E2E (matrix: ubuntu, debian, fedora, centos containers + macOS)
- release.yml: GoReleaser on version tags
Core Template
name: CI
on:
pull_request:
paths: ["component/**", ".github/workflows/ci.yml"]
push:
branches: [main]
paths: ["component/**"]
concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
cancel-in-progress: true
permissions: {}
jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
- run: go build -v ./...Essential Patterns
Concurrency Control
concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
cancel-in-progress: truePermissions (least privilege)
permissions: {} # Top-level default
jobs:
build:
permissions:
contents: read # Job-level grantsCaching
- uses: actions/cache@v4
with:
path: |
~/.cache/go-build
~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
restore-keys: ${{ runner.os }}-go-Artifacts
- uses: actions/upload-artifact@v4
with:
name: build-artifacts
path: dist/
retention-days: 1
if-no-files-found: error
- uses: actions/download-artifact@v4
with:
name: build-artifacts
path: dist/Matrix Builds
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
platform: ubuntu
- os: ubuntu-latest
platform: debian
container: debian:bookworm
- os: macos-latest
platform: macos
runs-on: ${{ matrix.os }}
container: ${{ matrix.container }}Common Actions
- uses: actions/checkout@v4
with:
fetch-depth: 0 # Full history
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
- uses: goreleaser/goreleaser-action@v6
with:
version: latest
args: build --clean --snapshot
workdir: installer