# Github Actions Pipelines

> GitHub Actions CI/CD Architecture

- Skill: `j4flmao/github-actions-pipelines` (Agent Skill)
- Install (CLI): `npx skillmds@latest add j4flmao/github-actions-pipelines`
- Raw SKILL.md: https://api.skillmd.com/api/skills/j4flmao/github-actions-pipelines/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: j4flmao (https://skillmd.com/u/j4flmao)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/j4flmao/github-actions-pipelines

---

# GitHub Actions CI/CD Architecture

## Core Concepts

GitHub Actions provides native CI/CD. For enterprise systems, pipelines must be modular (Reusable Workflows), optimized (Caching), and secure (OIDC).

### 1. Matrix Builds & Caching
- **Matrix Builds:** Run tests simultaneously across multiple OS/Node versions to save pipeline time.
- **Caching:** Cache dependencies (`npm`, `pip`, Docker layers) to drastically reduce build times. Cache keys must be deterministic (e.g., hash of lockfiles).

### 2. OIDC (OpenID Connect) vs Secrets
Avoid storing long-lived AWS/GCP static credentials in GitHub. Use OIDC to establish trust between GitHub and the Cloud Provider, requesting temporary, short-lived STS tokens.

### Pipeline Architecture Map

```mermaid
%%{init: {"theme": "default", "flowchart": {"useMaxWidth": true}}}%%
flowchart TD
    subgraph Repo ["GitHub Repository"]
        A["Developer Push/PR"]
    end
    
    subgraph Pipeline ["CI Pipeline (GitHub Runners)"]
        B["Checkout Source"]
        C["Restore Cache"]
        D["Lint & Static Analysis (SAST)"]
        E["Unit Tests (Matrix Strategy)"]
        F["Build Container Image"]
    end
    
    subgraph CD_Push ["CD Pipeline & Artifacts"]
        G["OIDC Auth (Assume Role)"]
        H["Push to Container Registry (ECR/GCR)"]
        I["Update GitOps Manifests (Commit)"]
    end
    
    A --> B
    B --> C
    C --> D
    C --> E
    D --> F
    E --> F
    F --> G
    G --> H
    H --> I
```