In Present Time software teams need fast, secure, and automated delivery.
Earlier, release flow looked like this:
Developer writes code
↓
Manual build
↓
Manual test
↓
Manual deployment
↓
Production issue
Today, GitHub Actions can automate this entire process directly from your GitHub repository.
🔗 Resources
- ** Support the Journey on GitHub:
If you're following along, consider starring and forking the repo:**
What is GITHUB_TOKEN?
GITHUB_TOKENis an automatically generated token available in workflows.
It can be used for GitHub API operations like:
- Checkout
- Comment on PR
- Create releases
- Push tags
- Update repo content
GitHub provides documentation explaining how
GITHUB_TOKENworks for secure automation.
Example:
CODEpermissions:
contents: read
packages: write
What is OIDC in GitHub Actions?
OIDC means OpenID Connect.
It allows GitHub Actions to authenticate with cloud providers without storing long-lived access keys.
Old approach:
CODEStore AWS_ACCESS_KEY_ID
Store AWS_SECRET_ACCESS_KEY
Better approach:
CODEGitHub Actions
↓
OIDC Token
↓
AWS IAM Role
↓
Temporary Credentials
Benefits:
- No long-lived cloud keys
- Short-lived credentials
- Better security
- Easier rotation
- Least privilege
AWS OIDC Example
CODEpermissions:
id-token: write
contents: read
CODE- name: Configure AWS Credentials using OIDC
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy-role
aws-region: ap-south-1
What is a Webhook?
A webhook is an event notification sent from GitHub to another system.
Example:
CODEGitHub Push Event
↓
Webhook
↓
External System
Use cases:
- Trigger Jenkins pipeline
- Notify Slack
- Trigger deployment platform
- Send events to security tools
Branch Rules and Rulesets
Rules protect important branches.
Example:
CODEmain branch
should not allow direct push.
Common rules:
- Require pull request
- Require approvals
- Require status checks
- Require signed commits
- Restrict force pushes
- Restrict deletions
- Require linear history
Why Rulesets Matter
Rulesets enforce governance.
Example:
CODEDeveloper opens PR
↓
CI pipeline runs
↓
Tests pass
↓
Security scan passes
↓
Approval received
↓
Merge allowed
Without rulesets, someone may directly push insecure code to production branch.
Environment Protection Rules
GitHub Actions can control deployments using environments, concurrency groups, and protection rules.
Example:
CODEenvironment:
name: production
You can configure:
- Required reviewers
- Wait timer
- Deployment branches
- Environment secrets
Environment secrets and protection rules are available depending on repository type and plan.
Full GitHub Actions CI/CD Pipeline Example
This example does:
CODECheckout
Install dependencies
Run tests
Run SAST
Build Docker image
Push to Amazon ECR
Deploy to Kubernetes
CODEname: GitHub Actions CI/CD Pipeline
on:
push:
branches: [ main ]
pull_request:
branches: [ main ]
permissions:
contents: read
id-token: write
packages: write
env:
AWS_REGION: ap-south-1
ECR_REPOSITORY: my-node-app
IMAGE_TAG: ${{ github.sha }}
jobs:
ci:
name: Build, Test and Scan
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
- name: Install Dependencies
run: npm ci
- name: Run Unit Tests
run: npm test
- name: Run Semgrep SAST
uses: semgrep/semgrep-action@v1
with:
config: auto
- name: Build Docker Image
run: |
docker build -t $ECR_REPOSITORY:$IMAGE_TAG .
deploy:
name: Build Image and Deploy
needs: ci
runs-on: [self-hosted, linux, x64]
if: github.ref == 'refs/heads/main'
environment:
name: production
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Configure AWS Credentials using OIDC
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy-role
aws-region: ${{ env.AWS_REGION }}
- name: Login to Amazon ECR
run: |
aws ecr get-login-password --region $AWS_REGION | \
docker login --username AWS --password-stdin \
123456789012.dkr.ecr.$AWS_REGION.amazonaws.com
- name: Build and Push Docker Image
run: |
IMAGE_URI=123456789012.dkr.ecr.$AWS_REGION.amazonaws.com/$ECR_REPOSITORY:$IMAGE_TAG
docker build -t $IMAGE_URI .
docker push $IMAGE_URI
echo "IMAGE_URI=$IMAGE_URI" >> $GITHUB_ENV
- name: Deploy to Kubernetes
run: |
kubectl set image deployment/my-node-app \
my-node-app=$IMAGE_URI \
-n production
kubectl rollout status deployment/my-node-app -n production
Pipeline Flow Explained
CODEDeveloper Pushes Code
↓
GitHub Actions Triggered
↓
CI Job Runs on GitHub Runner
↓
Tests + SAST
↓
Deploy Job Runs on Private Runner
↓
OIDC Authenticates to AWS
↓
Docker Image Pushed to ECR
↓
Kubernetes Deployment Updated
Build Automation
Build automation means converting source code into a deployable artifact.
Examples:
CODEJava → JAR/WAR
Node.js → Bundle
Dockerfile → Docker Image
Helm Chart → Versioned Package
Example:
CODE- name: Build Docker Image
run: docker build -t my-app:${{ github.sha }} .
Deploy Automation
Deploy automation means moving the artifact to the target environment.
Examples:
CODEECR → EKS
ACR → AKS
Docker Hub → Kubernetes
S3 → CloudFront
Lambda ZIP → AWS Lambda
Example:
CODE- name: Deploy to Kubernetes
run: kubectl apply -f k8s/
GitOps Deployment Alternative
In modern Kubernetes setups, GitHub Actions should often do only CI.
CD should be handled by ArgoCD or Flux.
Flow:
CODEGitHub Actions
↓
Build Image
↓
Push to Registry
↓
Update GitOps Repo
↓
ArgoCD / Flux Deploys
This avoids giving CI pipeline direct cluster-admin deployment access.
GitOps Example Step
CODE- name: Update GitOps Manifest
run: |
git config user.name "github-actions"
git config user.email "[email protected]"
sed -i "s|image: .*|image: $IMAGE_URI|g" k8s/deployment.yaml
git add k8s/deployment.yaml
git commit -m "Update image to $IMAGE_TAG"
git push
Then ArgoCD or Flux detects the manifest change and deploys it.
Recommended Pre Production Pipeline
GitHub Actions Best Practices
Use:
CODEOIDC instead of access keys
Environment approvals for production
Branch rulesets
Private runners for private infra
Least privilege permissions
Pinned action versions
Secrets only for sensitive values
Variables for non-sensitive config
Concurrency control
Artifact retention policies
Final Thoughts
GitHub Actions is more than a CI/CD tool.
It is an automation platform tightly integrated with GitHub.
It can handle:
- CI pipelines
- Security scanning
- Docker builds
- Cloud authentication
- Kubernetes deployment
- Release automation
- GitOps workflows
For modern DevOps and DevSecOps teams, GitHub Actions becomes even more powerful when combined with:
CODEPrivate runners
OIDC
Rulesets
Environment approvals
ArgoCD / Flux
Security scanning
A strong production pipeline is not only about deploying fast.
It is about deploying:
CODEFast
Securely
Repeatably
With control
↗ Original-Artikel auf dev.to lesenVollständiger Original-BerichtAusführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf dev.to.
SOCIAL SHARE CARD GENERATOR