Github Actions Expert

---
name: github-actions-expert
description: "GitHub Actions CI/CD workflows, reusable actions, and OIDC auth / Workflow CI/CD GitHub Actions, reusable actions, dan auth OIDC."
author: "Roedy Rustam"
version: "4.8.0"
---

# GitHub Actions Expert (Enterprise CI/CD Standard 2026)

[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)

---

<a name="english"></a>
## English

### Orchestration & Integration
- **Upstream & Lifecycle**: `zero-to-prod-orchestrator` (Phase 7 deployment), `brainstorming`, `session-memory-manager`.
- **Infrastructure & Cloud Targets**: `ci-cd-devops-architect` (pipeline topology), `docker-container-expert` (container builds & SBOM), `cloud-hosting-expert` (edge & cloud deploys).
- **Security & Secret Vaults**: `zero-trust-secret-vault` (OIDC federated auth), `anti-slop` (pipeline hygiene & strict gate validation).
- **Test Automation & Quality**: `autonomous-tdd-debugger` (test runner execution), `e2e-testing-expert` (Playwright suites), `production-ready-hardener` (pre-flight checks).

### Description
Enterprise-grade guide for engineering hardened, high-performance Continuous Integration & Continuous Delivery (CI/CD) pipelines on **GitHub Actions**. Covers deterministic dependency caching (pnpm/bun/uv/cargo), reusable workflows (`workflow_call`), composite actions (`using: 'composite'`), dynamic multi-platform matrix builds, OpenID Connect (OIDC) cloud federation for AWS/GCP/Azure with zero long-lived credentials, immutable action pinning by commit SHA, fine-grained `GITHUB_TOKEN` permissions, concurrency control, artifact attestation, and npm/OCI provenance publishing.

### Trigger Conditions
- Designing, scaffolding, or modernizing `.github/workflows/` pipelines.
- Implementing automated PR verification: linting, type-checking, unit tests, and E2E gates.
- Setting up reusable workflows (`workflow_call`) or modular composite actions.
- Hardening CI/CD security: replacing long-lived tokens with OIDC federation.
- Pinning third-party GitHub Actions to immutable full commit SHAs.
- Configuring concurrency groups with `cancel-in-progress: true` to prevent queue bloat.
- Generating build provenance and software bills of materials (SBOM).
- Automating multi-platform release builds, semantic versioning, and package publishing.

### What's New in 2026 (Modern GitHub Actions Standard)

#### 1. Security & Governance First
- **Zero Static Credentials**: All cloud deployments must use OpenID Connect (OIDC) federated role assumption via `permissions: id-token: write`.
- **Full SHA Action Pinning**: Never use `@v4` or `@main` tags in production workflows. Pin exact 40-character commit SHAs with inline human-readable comments (e.g. `actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2`).
- **Least-Privilege Token Permissions**: Workflows must declare top-level `permissions: {}` (deny all) and elevate only specific job scopes (`contents: read`, `pull-requests: write`, etc.).
- **Software Supply Chain Provenance**: Automated SLSA Level 3 attestations using `actions/attest-build-provenance`.

#### 2. Speed & Determinism
- **Native Dependency Caching**: Utilize native package manager caching via setup actions (`setup-node` with `cache: 'pnpm'`, `setup-python` with `cache: 'uv'`).
- **Concurrency Cancellation**: Cancel redundant runs on rapid git pushes via `concurrency: group: ${{ github.workflow }}-${{ github.ref }}, cancel-in-progress: true`.
- **Fast-Fail Matrix Strategy**: Optimize CI compute cycles with `strategy: fail-fast: true` during preliminary PR checks and `fail-fast: false` for release suites.

---

### Core Architecture Patterns

#### Pattern 1: Production Hardened CI Pipeline (`.github/workflows/ci.yml`)

```yaml
name: CI Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

# Enforce least-privilege permissions across the entire workflow
permissions: {}

# Cancel obsolete in-flight runs when new commits arrive
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint-and-typecheck:
    name: Code Quality & Type Check
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout Source Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1

      - name: Install pnpm Package Manager
        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
        with:
          version: 9.15.4
          run_install: false

      - name: Setup Node.js Runtime
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: 22
          cache: 'pnpm'

      - name: Install Dependencies
        run: pnpm install --frozen-lockfile

      - name: Run Linter Audit
        run: pnpm run lint

      - name: Run TypeScript Verification
        run: pnpm run typecheck

  test-matrix:
    name: Test Suite Matrix (Node ${{ matrix.node-version }} on ${{ matrix.os }})
    needs: [lint-and-typecheck]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        node-version: [20, 22, 24]
    steps:
      - name: Checkout Source Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install pnpm Package Manager
        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
        with:
          version: 9.15.4

      - name: Setup Node.js Runtime
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'pnpm'

      - name: Install Dependencies
        run: pnpm install --frozen-lockfile

      - name: Execute Automated Unit & Integration Tests
        run: pnpm test -- --coverage

      - name: Upload Test Coverage Artifacts (Ubuntu Node 22 only)
        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 22
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: code-coverage-report
          path: coverage/
          retention-days: 14
```

---

#### Pattern 2: Zero-Secret OIDC Cloud Deployment (`.github/workflows/deploy.yml`)

```yaml
name: Deploy Production Service

on:
  push:
    branches: [main]

permissions: {}

concurrency:
  group: production-deployment
  cancel-in-progress: false

jobs:
  deploy-cloud:
    name: OIDC Authenticated Cloud Deploy
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://api.production.internal
    permissions:
      id-token: write # Required for requesting OpenID Connect JWT tokens
      contents: read
    steps:
      - name: Checkout Source Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Authenticate with AWS via OIDC Role Assumption
        uses: aws-actions/configure-aws-credentials@e3ddf1e3cb0f23561c4d1c6a56b5b9eb29570d8c # v4.0.2
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-production-deployer
          aws-region: ap-southeast-1
          audience: sts.amazonaws.com

      - name: Verify AWS Caller Identity
        run: aws sts get-caller-identity

      - name: Deploy Infrastructure or Edge Worker
        run: |
          echo "Deploying verified release to production..."
          # Application deploy command executed here
```

---

#### Pattern 3: Custom Modular Composite Action (`.github/actions/setup-project/action.yml`)

```yaml
name: Setup Project Environment
description: Reusable composite action to install pnpm, setup Node.js runtime, and hydrate cache.

inputs:
  node-version:
    description: Node.js major version
    required: false
    default: '22'
  pnpm-version:
    description: pnpm package manager version
    required: false
    default: '9.15.4'

runs:
  using: 'composite'
  steps:
    - name: Enable Corepack and Install pnpm
      shell: bash
      run: |
        corepack enable
        corepack prepare pnpm@${{ inputs.pnpm-version }} --activate

    - name: Setup Node.js with Native pnpm Cache
      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
      with:
        node-version: ${{ inputs.node-version }}
        cache: 'pnpm'

    - name: Hydrate Node Modules
      shell: bash
      run: pnpm install --frozen-lockfile
```

### Hard Guardrails (Declarative Invariants)
1. **Mandatory Explicit Permissions Invariant (Least Privilege)**:
   - Workflows MUST declare an explicit `permissions:` block at workflow or job level (e.g. `permissions: { contents: read }`). Omitting permissions or specifying `permissions: write-all` is strictly prohibited.
2. **Third-Party Action Immutable SHA Pinning**:
   - Third-party GitHub Actions (`uses: actions/...`, `uses: docker/...`) in production pipelines MUST be pinned to full 40-character commit hashes (e.g., `uses: actions/checkout@11bd7190... # v4.2.2`). Using mutable branch or release tags (`@v4`, `@main`) is prohibited in release workflows.
3. **Strict Prohibition of Plaintext Secrets in Scripts**:
   - Secrets MUST NEVER be directly interpolated into `run:` shell command blocks (e.g. `run: echo ${{ secrets.TOKEN }}`). Pass secrets exclusively via environment variables (`env: TOKEN: ${{ secrets.TOKEN }}`) to prevent command injection and log leaks.
4. **Concurrency Cancel-In-Progress Gate**:
   - Continuous integration workflows triggered on `pull_request` MUST configure `concurrency:` with `cancel-in-progress: true` scoped to `${{ github.workflow }}-${{ github.ref }}` to prevent redundant builds.

### Sovereign Execution, Token Efficiency & Invariants
| Dimension | Sovereign Mandate & Deterministic Contract |
| :--- | :--- |
| **Frontier Model Cascade** | Medium / High (`GPT-5.6 Sol Medium`, `Gemini 4 Argon`, `Claude Sonnet 5.5 High`, `Grok 4.7 High Fast`) |
| **Availability Fallback** | `Gemini 4 Argon/Pro` -> `Gemini 3.8 Flash`; `Claude Opus 5.5` -> `Claude Opus 4.6` (Zero unhandled missing-model errors) |
| **KV-Cache & Token Protocol** | Pin static instructions & schemas at prompt prefix (`kv-cache-prefix-optimizer`); pass surgical `CONTEXT_MAP.md` slices (<250 tokens/call) during Swarm Fan-Out |
| **SaaT CLI & MCP Dispatch** | CLI: `vibes skill exec github-actions-expert <audit\|eval\|verify\|generate\|blueprint>` / MCP: `vibes_skill_dispatch`, `vibes_ast_query`, `vibes_compile_cache`, `vibes_optimize_budget`, `vibes_verify_gate` |
| **NFR & Anti-Slop Invariants** | CI build duration < 4 mins via cache hydration, 100% SHA pinning on third-party actions, 0 plaintext secret leaks in run steps; 100% complete zero-placeholder output verified via `node scripts/check-anti-slop.js --strict` |

---


---

<a name="bahasa-indonesia"></a>
## Bahasa Indonesia

### Integrasi Orkestrasi
- **Hulu & Siklus Hidup**: `zero-to-prod-orchestrator` (Deployment Fase 7), `brainstorming`, `session-memory-manager`.
- **Infrastruktur & Target Cloud**: `ci-cd-devops-architect` (topologi pipeline), `docker-container-expert` (build kontainer & SBOM), `cloud-hosting-expert` (deploy edge & cloud).
- **Keamanan & Brankas Rahasia**: `zero-trust-secret-vault` (otentikasi federasi OIDC), `anti-slop` (kebersihan pipeline & validasi gerbang ketat).
- **Otomasi Pengujian & Kualitas**: `autonomous-tdd-debugger` (eksekusi pengujian otomatis), `e2e-testing-expert` (suite Playwright), `production-ready-hardener` (pemeriksaan pra-rilis).

### Deskripsi
Panduan standar industri enterprise untuk merancang dan memelihara pipeline Continuous Integration & Continuous Delivery (CI/CD) berperforma tinggi dan aman di **GitHub Actions**. Meliputi optimasi cache dependensi deterministik (pnpm/bun/uv/cargo), workflow pakai ulang (`workflow_call`), aksi komposit modular (`using: 'composite'`), matriks pengujian multi-platform, autentikasi cloud OpenID Connect (OIDC) tanpa kunci statis untuk AWS/GCP/Azure, penguncian aksi pihak ketiga dengan full commit SHA, hak akses minimum `GITHUB_TOKEN`, manajemen konkurensi, atestasi artifak, dan publikasi paket dengan sertifikasi provenance.

### Kondisi Pemicu (Trigger Conditions)
- Membuat, mengonfigurasi, atau memodernisasi pipeline di folder `.github/workflows/`.
- Menerapkan pengujian otomatis pada Pull Request: linter, typecheck TypeScript, unit test, dan E2E test.
- Mengonfigurasi aksi komposit modular atau reusable workflow untuk efisiensi repo.
- Meningkatkan keamanan CI/CD: mengganti secret statis berumur panjang dengan OIDC federation.
- Mengunci third-party action menggunakan 40-karakter commit SHA permanen.
- Mengatur grup konkurensi dengan `cancel-in-progress: true` untuk menghentikan workflow redundan.
- Menghasilkan tanda tangan bukti perangkat lunak (SBOM / SLSA Level 3 Provenance).
- Otomasi rilis versi paket (npm, Docker OCI, VSIX) saat git tag dibuat.

### Aturan Emas Keamanan & Performa 2026

1. **Prinsip Hak Akses Terendah (Least Privilege)**: Tentukan `permissions: {}` di level workflow root, lalu berikan izin spesifik yang diperlukan pada setiap job (`contents: read`, `pull-requests: write`).
2. **Kunci SHA Komit Penuh (Full SHA Pinning)**: Dilarang menggunakan tag yang dapat berubah seperti `@v4` atau `@main`. Selalu gunakan hash 40 karakter commit SHA disertai komentar versi.
3. **Autentikasi Cloud OIDC (Zero-Static Secrets)**: Gunakan OpenID Connect JWT token (`permissions: id-token: write`) untuk berinteraksi dengan AWS/GCP/Azure tanpa menyimpan API Key permanen di repository secrets.
4. **Pencegahan Penumpukan Antrean**: Gunakan blok `concurrency` dengan pembatalan otomatis untuk menghemat menit CI runner pada push beruntun.
5. **Cache Dependensi Terpadu**: Manfaatkan caching bawaan pada runner daripada melakukan download paket berulang dari internet pada setiap langkah pengujian.

### Matriks Eksekusi Berdaulat, Efisiensi Token & Invarian
| Dimensi | Mandat Berdaulat & Kontrak Deterministik |
| :--- | :--- |
| **Kaskade Model Frontier** | Medium / High (`GPT-5.6 Sol Medium`, `Gemini 4 Argon`, `Claude Sonnet 5.5 High`, `Grok 4.7 High Fast`) |
| **Invarian Fallback Ketersediaan** | `Gemini 4 Argon/Pro` -> `Gemini 3.8 Flash`; `Claude Opus 5.5` -> `Claude Opus 4.6` (Bebas gagal saat model belum tersedia/kuota penuh) |
| **Protokol Hemat Token & KV-Cache** | Kunci instruksi & skema statis di prefix awal (`kv-cache-prefix-optimizer`); kirim potongan `CONTEXT_MAP.md` (<250 token/panggilan) saat Fan-Out |
| **Eksekusi SaaT CLI & MCP** | CLI: `vibes skill exec github-actions-expert <audit\|eval\|verify\|generate\|blueprint>` / MCP: `vibes_skill_dispatch`, `vibes_ast_query`, `vibes_compile_cache`, `vibes_optimize_budget`, `vibes_verify_gate` |
| **Invarian NFR & Anti-Slop** | Durasi build CI < 4 menit via hidrasi cache, 100% pinning SHA pada aksi pihak ketiga, 0 kebocoran secret plaintext pada langkah run; kode 100% tuntas tanpa placeholder diverifikasi melalui `node scripts/check-anti-slop.js --strict` |