Github Actions Il

GitHub Actions for Israeli Teams

Instructions

Step 1: Choose the Right Workflow Pattern

Match the team's need to the appropriate workflow template. Use this table as a starting point, then customize based on the project's stack and deployment target.

If the team has multiple needs, compose workflows by reusing composite actions from references/workflow-templates.md.

Step 2: Set Up Shabbat/Holiday-Aware Scheduling

Israeli teams need deployment schedules that respect Shabbat (Friday afternoon through Saturday night) and Jewish holidays. This is not just cultural preference; deploying during Shabbat means no one is available to respond to incidents.

Approach: Hebcal API + Environment Protection Rules

1. Create a reusable workflow that checks whether the current time falls within a freeze window:

# .github/actions/shabbat-check/action.yml
name: 'Shabbat/Holiday Check'
description: 'Check if current time is during Shabbat or Israeli holiday'
outputs:
  is_frozen:
    description: 'true if deploys should be frozen'
    value: ${{ steps.check.outputs.frozen }}
  reason:
    description: 'Why deploys are frozen (e.g., Shabbat, Yom Kippur)'
    value: ${{ steps.check.outputs.reason }}
runs:
  using: 'composite'
  steps:
    - id: check
      shell: bash
      run: |
        # ONE feed covers Shabbat AND holidays. The /shabbat endpoint honours maj=on and
        # returns `holiday` items together with their candle-lighting times, including the
        # EREV entries (Erev Yom Kippur, Erev Sukkot) that the /hebcal feed omits entirely.
        # Ask for TODAY in Israel time: runners are UTC, so a bare `date` is still yesterday
        # between 00:00 and 03:00 Israel time and would miss the chag.
        export TZ=Asia/Jerusalem
        CURL_OK=0
        FEED=$(curl -sf --max-time 10 --retry 2 \
          "https://www.hebcal.com/shabbat?cfg=json&geonameid=281184&M=on&maj=on&gy=$(date +%Y)&gm=$(date +%-m)&gd=$(date +%-d)") || CURL_OK=$?

        # Fail CLOSED: a deploy freeze is a safety gate, so an unreachable API means frozen.
        if [ "$CURL_OK" -ne 0 ] || [ -z "$FEED" ]; then
          echo "frozen=true" >> $GITHUB_OUTPUT
          echo "reason=Could not reach hebcal to verify the Shabbat/holiday window; failing closed. Override with force_deploy." >> $GITHUB_OUTPUT
          exit 0
        fi

        # Walk the feed in order, pairing each candle-lighting with the havdalah that follows
        # it, and compare in EPOCH SECONDS. hebcal returns offset-aware times (+03:00 summer,
        # +02:00 winter); comparing those as strings against a UTC clock is wrong by exactly
        # the offset and leaves the gate open for the first hours of every Shabbat.
        # A 200 with an unexpected shape must freeze too: pipefail does not propagate out
        # of the process substitution below, so an empty item list would silently open the gate.
        ITEM_COUNT=$(echo "$FEED" | jq -r '.items | length' 2>/dev/null || echo 0)
        if [ -z "$ITEM_COUNT" ] || [ "$ITEM_COUNT" = "0" ] || [ "$ITEM_COUNT" = "null" ]; then
          echo "frozen=true" >> $GITHUB_OUTPUT
          echo "reason=hebcal returned no calendar items; failing closed. Override with force_deploy." >> $GITHUB_OUTPUT
          exit 0
        fi

        # Rule 1: any FULL yom tov dated today. A feed requested for the chag itself starts
        # that morning, so the previous evening's candle-lighting is outside its range and the
        # window walk below cannot see it. `yomtov: true` marks exactly the days on which work
        # is prohibited (Yom Kippur, Shavuot, both days of Rosh Hashana, Sukkot I, Shmini
        # Atzeret) and is absent on chol hamoed, fast days and Shabbat Shuva.
        TODAY=$(date +%Y-%m-%d)
        YOMTOV=$(echo "$FEED" | jq -r --arg d "$TODAY" '[.items[] | select(.yomtov == true and (.date | startswith($d)))] | first | .title // empty')
        if [ -n "$YOMTOV" ]; then
          # The chag ends at havdalah, not at midnight. If today's closing havdalah has
          # already passed, fall through to rule 2 rather than freezing until 00:00.
          END_TODAY=$(echo "$FEED" | jq -r --arg d "$TODAY" '[.items[] | select(.category=="havdalah" and (.date | startswith($d)))] | first | .date // empty')
          END_EPOCH=""
          [ -n "$END_TODAY" ] && END_EPOCH=$(date -d "$END_TODAY" +%s 2>/dev/null || echo "")
          # No havdalah today, or we could not parse it, means still yom tov: freeze.
          if [ -z "$END_EPOCH" ] || [ "$(date +%s)" -le "$END_EPOCH" ]; then
            echo "frozen=true" >> $GITHUB_OUTPUT
            echo "reason=$YOMTOV (yom tov)" >> $GITHUB_OUTPUT
            exit 0
          fi
        fi

        # Rule 2: inside a candle-lighting to havdalah window (Shabbat, and the evening a chag
        # begins, which is dated the day BEFORE the yom tov and so is not caught by rule 1).
        NOW_EPOCH=$(date +%s)
        FROZEN=false
        REASON=none
        START=""
        LABEL="Shabbat"
        PENDING="Shabbat"

        while IFS=$'\t' read -r CAT WHEN TITLE; do
          case "$CAT" in
            holiday)  PENDING="$TITLE" ;;
            candles)
              # Keep the EARLIEST unclosed candle-lighting. A two-day yom tov (Rosh Hashana,
              # or any chag adjacent to Shabbat) emits TWO candle-lightings before a single
              # havdalah; overwriting here would test only the second night and leave the
              # gate open for the whole of day one.
              if [ -z "$START" ]; then
                START="$WHEN"
                LABEL="$PENDING"
              fi
              ;;
            havdalah)
              EE=$(date -d "$WHEN" +%s)
              if [ -z "$START" ]; then
                # A havdalah with no candle-lighting before it means the window opened
                # before this feed's range started, i.e. we are already inside it. This is
                # the chag-daytime case (querying on Yom Kippur itself returns the closing
                # havdalah but not the previous evening's candles). Freeze.
                if [ "$NOW_EPOCH" -le "$EE" ]; then
                  FROZEN=true
                  REASON="$PENDING (in progress, ends $WHEN)"
                  break
                fi
              else
                SE=$(date -d "$START" +%s)
                if [ "$NOW_EPOCH" -ge "$SE" ] && [ "$NOW_EPOCH" -le "$EE" ]; then
                  FROZEN=true
                  REASON="$LABEL (frozen from $START until $WHEN)"
                  break
                fi
              fi
              START=""
              LABEL="Shabbat"
              PENDING="Shabbat"
              ;;
          esac
        done < <(echo "$FEED" | jq -r '.items[] | [.category, .date, .title] | @tsv')

        echo "frozen=$FROZEN" >> $GITHUB_OUTPUT
        echo "reason=$REASON" >> $GITHUB_OUTPUT

2. Use this action as a gate in deployment workflows:

jobs:
  check-deploy-window:
    runs-on: ubuntu-latest
    outputs:
      is_frozen: ${{ steps.shabbat.outputs.is_frozen }}
      reason: ${{ steps.shabbat.outputs.reason }}
    steps:
      - uses: actions/checkout@v7
      - id: shabbat
        uses: ./.github/actions/shabbat-check

  deploy:
    needs: check-deploy-window
    if: needs.check-deploy-window.outputs.is_frozen != 'true'
    runs-on: ubuntu-latest
    steps:
      - run: echo "Deploying..."

  notify-frozen:
    needs: check-deploy-window
    if: needs.check-deploy-window.outputs.is_frozen == 'true'
    runs-on: ubuntu-latest
    steps:
      - env:
          # The reason string carries a title from hebcal's HTTP response, so bind it to an
          # env var rather than interpolating ${{ }} into the script.
          FREEZE_REASON: ${{ needs.check-deploy-window.outputs.reason }}
        run: |
          echo "Deploy frozen: $FREEZE_REASON"
          # Send notification (see Step 3)

3. Emergency override: Add a workflow_dispatch input for overriding the freeze:

on:
  workflow_dispatch:
    inputs:
      force_deploy:
        description: 'Override Shabbat/holiday freeze (emergency only)'
        required: false
        type: boolean
        default: false

Then modify the deploy job condition:

if: >
  needs.check-deploy-window.outputs.is_frozen != 'true' ||
  github.event.inputs.force_deploy == 'true'

Note: The composite action above is the working reference implementation: it pairs each candle-lighting with the havdalah that follows it and compares in epoch seconds, it asks hebcal for TODAY in Asia/Jerusalem rather than the runner's UTC date, and it fails closed when hebcal is unreachable. references/shabbat-deploy-freeze.md adds a configurable pre-Shabbat buffer, per-city geonameids, multi-environment strategies and the emergency-override workflow. Two things this gate does NOT cover: minor fasts and Chanukah/Purim (min=on) and the modern civil days Yom HaZikaron and Yom HaAtzmaut (mod=on). Israeli teams commonly freeze on Yom HaZikaron too; add the parameter if you observe them.

For the full implementation guide with edge cases and timezone handling, consult references/shabbat-deploy-freeze.md.

Step 3: Configure Hebrew Notifications

Hebrew text in webhook payloads requires explicit RTL handling. Slack and Teams handle this differently.

Slack (Incoming Webhook):

- name: Notify Slack (Hebrew)
  if: always()
  env:
    SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
    # NEVER interpolate ${{ }} directly into a run: script. GitHub substitutes it as raw
    # text BEFORE bash parses the line, so a commit message containing a backtick or
    # $(...) executes in a job that holds your deploy tokens. Bind untrusted context to
    # env vars, then read them as ordinary shell variables.
    STATUS: ${{ job.status }}
    REPO: ${{ github.repository }}
    BRANCH: ${{ github.ref_name }}
    RAW_COMMIT_MSG: ${{ github.event.head_commit.message }}
    ACTOR: ${{ github.actor }}
  run: |
    COMMIT_MSG=$(printf '%s' "$RAW_COMMIT_MSG" | head -1)

    if [ "$STATUS" = "success" ]; then
      EMOJI=":white_check_mark:"
      STATUS_HE="הצליח"
      COLOR="#36a64f"
    elif [ "$STATUS" = "failure" ]; then
      EMOJI=":x:"
      STATUS_HE="נכשל"
      COLOR="#dc3545"
    else
      EMOJI=":warning:"
      STATUS_HE="בוטל"
      COLOR="#ffc107"
    fi

    # RTL marker ensures Hebrew renders correctly in Slack
    RTL=$'\u200F'

    curl -s -X POST "$SLACK_WEBHOOK" \
      -H 'Content-Type: application/json' \
      -d @- <<EOF
    {
      "attachments": [{
        "color": "$COLOR",
        "blocks": [
          {
            "type": "section",
            "text": {
              "type": "mrkdwn",
              "text": "$EMOJI ${RTL}*פריסה ${STATUS_HE}*\n${RTL}ריפו: \`${REPO}\`\n${RTL}ענף: \`${BRANCH}\`\n${RTL}קומיט: ${COMMIT_MSG}\n${RTL}מפתח: ${ACTOR}"
            }
          }
        ]
      }]
    }
    EOF

Key points for Hebrew in Slack:

• Prefix Hebrew lines with the RTL mark character (U+200F) to force correct display
• Keep repository names, branch names, and technical identifiers in English (no translation needed)
• Slack mrkdwn formatting (*bold*, `code`) works fine with Hebrew text

Teams (Adaptive Card):

- name: Notify Teams (Hebrew)
  if: always()
  env:
    TEAMS_WEBHOOK: ${{ secrets.TEAMS_WEBHOOK_URL }}
  run: |
    STATUS="${{ job.status }}"
    # ... same status mapping as Slack ...

    curl -s -X POST "$TEAMS_WEBHOOK" \
      -H 'Content-Type: application/json' \
      -d @- <<EOF
    {
      "type": "message",
      "attachments": [{
        "contentType": "application/vnd.microsoft.card.adaptive",
        "content": {
          "type": "AdaptiveCard",
          "version": "1.4",
          "body": [
            {
              "type": "TextBlock",
              "text": "פריסה ${STATUS_HE}",
              "weight": "Bolder",
              "size": "Medium"
            },
            {
              "type": "FactSet",
              "facts": [
                {"title": "ריפו", "value": "${REPO}"},
                {"title": "ענף", "value": "${BRANCH}"},
                {"title": "מפתח", "value": "${ACTOR}"}
              ]
            }
          ]
        }
      }]
    }
    EOF

Monday.com status update:

- name: Update Monday.com item
  env:
    MONDAY_TOKEN: ${{ secrets.MONDAY_API_TOKEN }}
    # A fork's branch name is attacker-controlled; bind it rather than interpolating it.
    REF_NAME: ${{ github.ref_name }}
    BOARD_ID: ${{ vars.MONDAY_BOARD_ID }}
  run: |
    # Extract Monday.com item ID from branch name or commit message
    # Convention: branch names like "feat/MON-12345-feature-name"
    ITEM_ID=$(printf '%s' "$REF_NAME" | grep -oP 'MON-\K\d+' || true)

    if [ -n "$ITEM_ID" ]; then
      STATUS_LABEL="${{ job.status == 'success' && 'Deployed' || 'Failed' }}"

      curl -s -X POST "https://api.monday.com/v2" \
        -H "Authorization: Bearer $MONDAY_TOKEN" \
        -H "Content-Type: application/json" \
        -d "{\"query\": \"mutation { change_simple_column_value(item_id: $ITEM_ID, board_id: $BOARD_ID, column_id: \\\"status\\\", value: \\\"$STATUS_LABEL\\\") { id } }\"}"
    fi

Step 4: Add Israeli Compliance Checks

IS-5568 Accessibility (Israeli Standard)

IS-5568 is the Israeli web-accessibility standard made binding by the Equal Rights for Persons with Disabilities (accessibility of a service) regulations. It adopts WCAG with additional requirements for Hebrew/RTL content. The WCAG edition it points at has moved between revisions of the standard, so confirm the level your obligation is assessed against with the Standards Institution of Israel rather than assuming; scanning against WCAG 2.1 AA satisfies 2.0 AA as a superset, which is why the axe configuration below passes all three tag sets. Key differences from WCAG alone:

Add to your CI pipeline:

accessibility-check:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v7
    - uses: actions/setup-node@v7
      with:
        node-version: '24'

    - name: Install accessibility tools
      run: npm install -g @axe-core/cli pa11y-ci

    - name: Build project
      run: npm run build && npm run start &
      # Wait for server to be ready
    - name: Wait for server
      run: npx wait-on http://localhost:3000 --timeout 60000

    - name: Run axe-core scan
      run: |
        axe http://localhost:3000 \
          --tags wcag2a,wcag2aa,wcag21aa \
          --locale he \
          --exit

    - name: Check RTL and lang attributes (IS-5568 specific)
      run: |
        # Verify root element has dir="rtl" and lang="he"
        HTML=$(curl -s http://localhost:3000)

        if ! echo "$HTML" | grep -q 'dir="rtl"'; then
          echo "::error::Missing dir=\"rtl\" on root element (IS-5568 requirement)"
          exit 1
        fi

        if ! echo "$HTML" | grep -q 'lang="he"'; then
          echo "::error::Missing lang=\"he\" attribute (IS-5568 requirement)"
          exit 1
        fi

        echo "IS-5568 RTL/lang checks passed"

Privacy Protection Authority (PPA) compliance checks:

The Israeli Privacy Protection Authority (Rashut HaHagana al HaPratiut) requires specific handling of personal data. Add these automated checks:

privacy-check:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v7

    - name: Scan for exposed PII patterns
      run: |
        # Israeli ID number pattern (9 digits with Luhn check)
        if grep -rn '[0-9]\{9\}' src/ --include="*.ts" --include="*.tsx" | \
           grep -v 'test\|mock\|spec\|\.d\.ts'; then
          echo "::warning::Potential Israeli ID numbers found in source code. Verify these are not real PII."
        fi

    - name: Check for privacy policy route
      run: |
        # Israeli law requires accessible privacy policy
        if ! find src -name "privacy*" -o -name "פרטיות*" | grep -q .; then
          echo "::warning::No privacy policy page detected. Israeli PPA requires one."
        fi

    - name: Audit dependencies for data collection
      run: |
        # Flag known analytics/tracking packages that may need PPA disclosure
        TRACKERS="google-analytics|segment|mixpanel|amplitude|hotjar|fullstory"
        if grep -E "$TRACKERS" package.json; then
          echo "::notice::Analytics dependencies detected. Ensure PPA-compliant consent banner is implemented."
        fi

Step 5: Deploy to Israeli-Friendly Cloud Targets

Israeli projects should deploy to regions with low latency to Israel. Here are the recommended targets and how to configure them in workflows.

The latency column is a relative ranking, not measured figures: an in-country region beats a European one, which beats anything further out. Measure from your own users before committing to a region, and weigh it against il-central-1 and me-west1 carrying a thinner service catalogue than the mature European regions.

Vercel deployment with fra1 pinning:

deploy-vercel:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v7
    - name: Deploy to Vercel
      env:
        VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
        VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
        VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
      run: |
        npx vercel pull --yes --token=$VERCEL_TOKEN
        npx vercel build --token=$VERCEL_TOKEN
        npx vercel deploy --prebuilt --token=$VERCEL_TOKEN --regions fra1

AWS deployment with region selection:

deploy-aws:
  runs-on: ubuntu-latest
  permissions:
    id-token: write   # REQUIRED for OIDC role assumption; without it the action fails with "Unable to get OIDC token"
    contents: read
  env:
    AWS_DEFAULT_REGION: il-central-1  # AWS Tel Aviv (lowest latency to Israel); eu-west-1 is an alternative
  steps:
    - uses: aws-actions/configure-aws-credentials@v6
      with:
        role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
    # ... deployment steps

Token permissions and security hardening. Since February 2023 the default GITHUB_TOKEN is read-only, so any job that writes (commenting on a PR, pushing a commit, creating a release) must declare an explicit permissions: block, and OIDC cloud auth (above) requires id-token: write. Set least-privilege permissions per job:

permissions:
  contents: read          # safe baseline
# add only what a job needs, for example:
# pull-requests: write    # for github-script PR comments
# id-token: write         # for OIDC to AWS/GCP (no long-lived secret keys)

Additional hardening for an Israeli team's repos:

• Pin third-party actions to a full commit SHA (uses: owner/action@<40-char-sha>), not a moving tag. A moving tag was the vector in the 2025 tj-actions/changed-files supply-chain compromise. First-party actions/* are lower risk, but SHA-pinning is the standard.
• Enable Dependabot for actions (.github/dependabot.yml with package-ecosystem: "github-actions") so pinned versions stay current automatically. This is the maintenance answer to action staleness.
• actions/checkout refuses fork checkouts under pull_request_target by default. From v7 (and backported to v4/v5/v6) the action rejects the classic "pwn request" patterns, including ref: ${{ github.event.pull_request.head.sha }} and repository: ${{ github.event.pull_request.head.repo.full_name }}, because those workflows run with the base repo's GITHUB_TOKEN and secrets. The action exposes allow-unsafe-pr-checkout: true as an explicit opt-out; treat it as a last resort, and prefer the pull_request trigger plus a separate privileged workflow_run job. If an older workflow of yours suddenly fails at the checkout step, this is why.
• Set timeout-minutes on every job. The default is 360 (six hours). It matters here specifically because the Shabbat gate makes a network call to a third-party API on the critical path of every production deploy: --max-time bounds the curl, but only timeout-minutes bounds the job. timeout-minutes: 10 on the gate job and 30 on a deploy job are sane starting points.

Step 6: Configure Israeli Work Week Scheduling

Israeli work week is Sunday through Thursday. Friday is a half-day (typically until 13:00-14:00). Cron schedules in GitHub Actions use UTC, so convert accordingly (Israel is UTC+2, or UTC+3 during DST).

Common Israeli cron patterns (UTC times):

Handling DST transitions: Israel enters DST on the Friday before the last Sunday of March, and returns to standard time on the last Sunday of October (27 Mar and 25 Oct in 2026; 26 Mar and 31 Oct in 2027). Rather than maintaining two cron schedules, use the hebcal API to determine the current UTC offset dynamically, or accept a 1-hour drift during transition weeks.

on:
  schedule:
    # Sunday-Thursday at 09:00 Israel time (winter UTC+2)
    - cron: '0 7 * * 0-4'
    # Friday at 12:00 Israel time (last deploy before Shabbat)
    - cron: '0 10 * * 5'

Step 7: Create Reusable Composite Actions

Build a library of composite actions that encode Israeli startup conventions. These live in .github/actions/ and can be shared across repositories.

Hebrew i18n validation action:

# .github/actions/i18n-validate/action.yml
name: 'Validate Hebrew i18n'
description: 'Check that all i18n keys exist in both he and en locales'
inputs:
  locales_dir:
    description: 'Path to locales directory'
    default: 'src/locales'
runs:
  using: 'composite'
  steps:
    - shell: bash
      run: |
        HE_FILE="${{ inputs.locales_dir }}/he.json"
        EN_FILE="${{ inputs.locales_dir }}/en.json"

        if [ ! -f "$HE_FILE" ] || [ ! -f "$EN_FILE" ]; then
          echo "::error::Missing locale files. Expected $HE_FILE and $EN_FILE"
          exit 1
        fi

        # Extract keys from both files
        HE_KEYS=$(jq -r '[paths(scalars)] | map(join(".")) | sort[]' "$HE_FILE")
        EN_KEYS=$(jq -r '[paths(scalars)] | map(join(".")) | sort[]' "$EN_FILE")

        # Find missing keys
        MISSING_HE=$(comm -23 <(echo "$EN_KEYS") <(echo "$HE_KEYS"))
        MISSING_EN=$(comm -23 <(echo "$HE_KEYS") <(echo "$EN_KEYS"))

        if [ -n "$MISSING_HE" ]; then
          echo "::error::Keys in en.json missing from he.json:"
          echo "$MISSING_HE" | while read key; do
            echo "  - $key"
          done
          exit 1
        fi

        if [ -n "$MISSING_EN" ]; then
          echo "::warning::Keys in he.json missing from en.json:"
          echo "$MISSING_EN"
        fi

        echo "i18n validation passed"

For complete workflow YAML templates, consult references/workflow-templates.md.

Examples

Example 1: Set Up Shabbat-Aware Deployment

User says: "Add a Shabbat deploy freeze to our production deployment workflow"

Actions:

1. Create .github/actions/shabbat-check/action.yml with the hebcal integration from Step 2
2. Add the SLACK_WEBHOOK_URL secret to the repository
3. Modify the existing deploy workflow to gate on the shabbat-check output
4. Add workflow_dispatch with force_deploy input for emergencies
5. Add Hebrew Slack notification for frozen deploys

Result: Production deploys automatically pause from candle lighting Friday through havdalah Saturday, with Hebrew notifications explaining the freeze and an emergency override option.

Example 2: Add Israeli Compliance to CI Pipeline

User says: "We need IS-5568 accessibility checks in our pull request CI"

Actions:

1. Add the accessibility-check job from Step 4 to the PR workflow
2. Configure axe-core with WCAG 2.1 AA + Hebrew locale
3. Add the RTL/lang attribute check specific to IS-5568
4. Add the privacy policy route check
5. Set the job as a required status check in branch protection rules

Result: Every PR is checked for IS-5568 compliance, RTL correctness, and privacy policy presence. Failures block merge.

Example 3: Configure Hebrew Slack Notifications with Monday.com Sync

User says: "Set up Hebrew deploy notifications in Slack and update Monday.com tickets"

Actions:

1. Add SLACK_WEBHOOK_URL and MONDAY_API_TOKEN as repository secrets
2. Add the Hebrew Slack notification step from Step 3
3. Add the Monday.com status update step, using branch naming convention feat/MON-{id}-description
4. Configure both notifications in the if: always() block so they fire on success and failure

Result: Deploy status appears in Slack with RTL Hebrew text, and the corresponding Monday.com item moves to "Deployed" or "Failed" status.

Example 4: Israeli Startup Full CI/CD Setup

User says: "We're an Israeli startup using Next.js + Supabase + Vercel. Set up our entire CI/CD."

Actions:

1. Create lint/test/build workflow running on Sunday-Thursday schedule
2. Add Supabase migration diff check on PRs
3. Add Hebrew i18n validation (he.json / en.json key parity)
4. Add IS-5568 accessibility scan on PRs
5. Create Vercel deploy workflow with fra1 region pinning
6. Gate production deploys on Shabbat/holiday check
7. Add Hebrew Slack notifications for all pipeline stages

Result: Complete CI/CD pipeline respecting Israeli work culture, with compliance checks, bilingual i18n validation, and Shabbat-aware production deploys.

Bundled Resources

References

• references/workflow-templates.md -- Complete, copy-paste-ready YAML workflow templates for Israeli startup CI/CD: lint-test-deploy, Supabase migration CI, i18n validation, and full Israeli compliance pipeline. Consult when setting up a new project's workflows from scratch.
• references/shabbat-deploy-freeze.md -- Detailed implementation guide for Shabbat and holiday deploy freezes, including hebcal API usage, timezone edge cases, multi-environment strategies, and emergency override procedures. Consult when implementing or debugging the deploy freeze system.

Recommended MCP Servers

• hebcal: Hebrew/Jewish calendar and Shabbat times. An MCP alternative to calling the Hebcal HTTP API inside a composite action, useful when an agent needs holiday data while authoring or reasoning about a workflow rather than at runtime.

Reference Links

Gotchas

• Cron schedules use UTC, not Israel time. Agents default to writing cron schedules in local time. Israel is UTC+2 (winter) or UTC+3 (summer/DST). A 0 9 * * 0-4 cron means 09:00 UTC, which is 11:00 or 12:00 in Israel. Always convert.
• Israeli work week is Sunday-Thursday, not Monday-Friday. Agents consistently write 1-5 for weekday cron (Monday-Friday). For Israeli teams, use 0-4 (Sunday-Thursday) or 0-5 (Sunday-Friday half-day).
• Shabbat times vary weekly and by city. Agents tend to hardcode "Friday 18:00" as Shabbat start. In reality, candle lighting across Israeli cities runs from about 15:55 (Jerusalem, early-to-mid December) to about 19:30 (Tel Aviv, June), and Jerusalem lights roughly 20 minutes earlier than the coastal cities because it keeps a 40-minute-before-sunset custom. Always use the hebcal API for accurate times.
• Three ways an agent silently breaks the freeze while the workflow still looks correct. First, hebcal returns offset-aware times (2026-08-28T18:28:00+03:00); comparing that lexicographically against date -u is wrong by the offset and leaves the gate open for the first hours of Shabbat. Convert both bounds to epoch seconds with date -d. Second, /shabbat defaults to the UPCOMING weekend, so pass gy/gm/gd for today, computed under TZ=Asia/Jerusalem: a runner's bare date is still yesterday between 00:00 and 03:00 Israel time. Third, a two-day yom tov emits TWO candle-lightings before a single havdalah, so keep the EARLIEST unclosed one; overwriting it tests only the second night and deploys run through the whole of Rosh Hashana day one.
• Hebrew text in YAML needs RTL markers. Without the RTL mark character (U+200F), Hebrew text in Slack payloads renders with punctuation in the wrong position. Always prefix Hebrew lines with \u200F.
• IS-5568 is not just WCAG 2.1 AA. Agents treat IS-5568 as a synonym for WCAG. IS-5568 has additional Israeli-specific requirements around bilingual content, government logos, and contact accessibility.
• me-south-1 (Bahrain) is NOT available to all AWS accounts. This region requires opt-in activation. Do not assume it is available. Fall back to eu-west-1 if the user has not explicitly enabled it.
• Monday.com API v2 uses GraphQL only. Agents sometimes try REST endpoints for Monday.com. The API is exclusively GraphQL at https://api.monday.com/v2.
• GitHub Actions schedule event runs on the default branch only. Agents sometimes add scheduled workflows on feature branches and wonder why they do not trigger.

Troubleshooting

Error: "Hebcal API returns empty items"

Cause: The geonameid parameter is wrong, or the date range has no Shabbat (edge case in query timing). Solution: Use geonameid=281184 for Jerusalem. Verify by opening https://www.hebcal.com/shabbat?cfg=json&geonameid=281184 in a browser. If items are empty, check that the request is not cached from a previous week.

Error: "Hebrew text appears reversed in Slack"

Cause: Missing RTL mark character in the payload. Slack does not auto-detect text direction. Solution: Prefix every Hebrew line with $'\u200F' in bash, or \u200F in JSON strings. Test by sending a simple Hebrew message to the webhook first.

Error: "Cron schedule fires at wrong time"

Cause: Schedule written in Israel time instead of UTC. Solution: Subtract 2 hours (winter) or 3 hours (summer) from the desired Israel time. Use date -u to verify current UTC time. For DST-proof scheduling, accept the 1-hour drift or add a runtime check.

Error: "axe-core scan finds no violations but site is not accessible"

Cause: Automated scanning catches only a minority of accessibility issues (commonly cited as roughly a third). IS-5568 requires manual testing for reading order, screen reader behavior, and bilingual content flow. Solution: Use axe-core as a baseline, not a complete check. Add manual accessibility review as a PR checklist item alongside the automated scan.

Error: "Monday.com mutation returns 'unauthorized'"

Cause: The API token does not have permission for the target board, or the board_id is wrong. Solution: Verify the token has write access to the board. Check MONDAY_BOARD_ID in repository variables. Test with a simple query first: { boards(ids: [BOARD_ID]) { name } }.