DevOps

⚙️ GitHub Actions Workflows

Updated: July 30, 2026
~3 min read

GitHub Actions is Maxi's Computers' primary CI/CD automation platform. Workflows are YAML files stored in .github/workflows/ and run on GitHub-hosted or self-hosted runners in response to repository events.

Workflow Syntax

yaml

## Triggers

Secrets & Variables

Use OIDC for AWS Prefer OpenID Connect (OIDC) over long-lived AWS access keys in secrets. OIDC tokens are short-lived and scoped to the specific workflow run.

yaml

## Matrix Builds

Dependency Caching

yaml

## Reusable Workflows

Environments & Protection Rules

GitHub Environments add protection gates before jobs can run against protected resources:

  • Required reviewers — Designated people must approve before deployment proceeds.
  • Wait timer — Delay deployment by N minutes (useful for canary monitoring).
  • Deployment branches — Restrict which branches can deploy to an environment.
  • Environment secrets — Secrets scoped to a specific environment (e.g., prod DB credentials).

Best Practices

  • Pin action versions to a full SHA: uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 prevents supply-chain attacks.
  • Set timeout-minutes on every job to prevent runaway billing.
  • Use permissions: {} at the workflow level and grant only what's needed per job.
  • Cache aggressively — Use actions/cache or built-in caching in setup actions.
  • Fail fast on PRs, not on main — Use fail-fast: true for PR checks and false for release pipelines.
  • Use concurrency to cancel in-progress runs when new commits are pushed to the same branch.