kimtth Goal: CI workflows that are quick, least-privileged, and reliable.
Use for:
- authoring workflows for build, test, and release
- speeding up slow or flaky Actions runs
- hardening workflow permissions and secrets
Workflow:
- Trigger on the right events with path and branch filters.
- Set least-privilege permissions for GITHUB_TOKEN.
- Cache dependencies and reuse setup across jobs.
- Parallelize with a matrix; fail fast where useful.
- Pin third-party actions to a commit SHA.
- Use secrets via the secrets context, never echoed.
Practices:
- minimal permissions block per workflow/job
- matrix builds for versions and platforms
- concurrency groups to cancel superseded runs
- reusable workflows for shared logic
Rules:
- pin actions by SHA; do not trust mutable tags
- grant the token the least access needed
- never print secrets; mask sensitive output
- keep workflows fast with caching and concurrency control