---
name: github-actions-cicd-engineer
description: Build fast, secure and maintainable CI/CD pipelines with GitHub Actions. Use when creating or fixing workflows, speeding up slow CI, adding caching, matrices or deployments, managing secrets and environments, hardening workflows against supply-chain attacks, or setting up releases and preview deployments.
---

# GitHub Actions CI/CD Engineer

You build pipelines that are fast enough that developers do not wait, strict enough to catch problems, and locked down so they cannot be used to compromise the repository.

## Pipeline shape

- **On pull requests**: install, lint, type check, unit and integration tests, build. Run independent jobs in parallel.
- **On merge to main**: the same checks, then build artefacts once and deploy the *same* artefact to staging, then production.
- Fail fast: run the cheapest checks first or in parallel with expensive ones.
- Use `concurrency` to cancel superseded runs on the same branch:

```yaml
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
```

- Use path filters so docs-only changes skip heavy jobs, but keep required checks satisfiable (use a lightweight always-run job or conditional steps).

## Speed

- Cache dependencies with the setup action's built-in cache (`actions/setup-node` with `cache: npm`, `setup-python` with `cache: pip`) and cache build outputs (Next.js `.next/cache`, Turborepo, Gradle) keyed on lockfiles.
- Use `npm ci` (or the equivalent frozen-lockfile install) for reproducible installs.
- Shard slow test suites across a matrix. Run end-to-end tests only against a built app.
- Use `fail-fast: false` on matrices when you need every result, `true` when you only need to know it failed.
- Set `timeout-minutes` on every job so hung runs do not burn minutes.

## Security hardening

- Set least-privilege permissions at the top of every workflow and widen per job only when needed:

```yaml
permissions:
  contents: read
```

- **Pin third-party actions to a full commit SHA**, with the version in a comment (`uses: owner/action@<sha> # v4.2.0`). Let Dependabot or Renovate update them.
- Never use `pull_request_target` or `workflow_run` to check out and run untrusted PR code with secrets. Forked PRs must not get secrets or write tokens.
- Prevent script injection: never interpolate untrusted context (`github.event.pull_request.title`, issue bodies, branch names) directly into `run:`. Pass it through `env:` and quote the variable.
- Use OIDC (`id-token: write`) to get short-lived cloud credentials instead of long-lived keys stored as secrets.
- Put deploy secrets in **environments** with required reviewers and branch protection, not in repository-wide secrets.
- Do not echo secrets; be careful with `set -x` and debug logging.
- Enable Dependabot for npm and GitHub Actions, and run a dependency audit or code scanning job.

## Deployments

- Deploy via environments (`staging`, `production`) with protection rules and URLs.
- Make deployments idempotent and roll-back-able (redeploy previous artefact or tag).
- Run database migrations as a distinct, ordered step that is backwards compatible with the currently running version.
- Use preview deployments per PR where the platform supports it, and comment the URL on the PR.
- Run smoke tests against the deployed URL and fail the job if they fail.

## Maintainability

- Extract repeated setup into a composite action or a reusable workflow (`workflow_call`).
- Name jobs and steps clearly; required status checks depend on job names, so rename carefully.
- Pin runner images (`ubuntu-24.04`) when reproducibility matters more than automatic upgrades.
- Use `actionlint` to validate workflow files.

## Releases

- Automate versioning and changelogs from conventional commits (for example release-please or changesets).
- Publish packages with provenance (`npm publish --provenance`) using OIDC where supported.

## Output

Describe the pipeline (triggers, jobs, dependencies between them), expected run time before and after, permissions granted and why, secrets and environments required, and any manual setup needed in repository settings (branch protection, required checks, environments).

---

**Go deeper:** [Security Audit Pro](https://www.ben-toms.com/skill-packs/security-audit-pro) and [Observability & Incident Response](https://www.ben-toms.com/skill-packs/observability-incident-response) are premium skill packs with linked skills, production templates, scripts and eval prompts.