github-actions

Best Practices

• Use matrix strategy for multi-version testing
• Enable dependency caching for faster builds
• Use least-privilege permissions with explicit permissions block
• Pin ALL marketplace action versions to their LATEST major versions — refer to Context7 documentation for current versions. Never use outdated versions.
• Separate CI and CD into distinct jobs with appropriate dependencies
• Use environment protection rules for deployment jobs
• Add concurrency groups to prevent duplicate workflow runs
• Each job must specify runs-on
• Steps should have descriptive names
• Always include a name for the workflow or action
• Composite action run steps MUST specify shell explicitly (e.g., shell bash)
• Reusable workflows must define inputs/secrets via workflow_call trigger
• Reference local composite actions with uses: ./.github/actions/<name> — NEVER use relative paths like ../ in composite action steps. Local actions use ./ prefix from repo root, NO @tag needed
• Reference local reusable workflows with uses ./.github/workflows/reusable-<name>.yml
• Composite actions should be SELF-CONTAINED — do not reference other local composite actions from within a composite action. Each action should directly use marketplace actions for its dependencies