github-actions-cicd

GitHub Actions CI/CD Skill

Purpose

Defines CI/CD pipeline best practices using GitHub Actions for automated testing, security scanning, and deployment.

Rules

Workflow Structure

MUST INCLUDE:

1. Code quality checks (linting, formatting)
2. Security scanning (CodeQL, Dependabot, ZAP)
3. Performance audits (Lighthouse)
4. Build and minification
5. Deployment (with approval for production)

Example Workflow:

name: CI/CD Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  security-events: write

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate HTML
        run: npm run validate:html
      - name: Lint CSS
        run: npm run lint:css

  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
      - name: ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.10.0
        with:
          target: 'https://www.hack23.com'

  lighthouse:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Lighthouse
        uses: treosh/lighthouse-ci-action@v10
        with:
          urls: |
            https://www.hack23.com/
            https://www.hack23.com/services.html
          budgetPath: ./budget.json
          uploadArtifacts: true

  deploy:
    needs: [validate, security-scan, lighthouse]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1
      - name: Sync to S3
        run: aws s3 sync . s3://${{ secrets.S3_BUCKET }} --delete
      - name: Invalidate CloudFront
        run: aws cloudfront create-invalidation --distribution-id ${{ secrets.CF_DIST_ID }} --paths "/*"

Security Best Practices

MUST:

• Use OIDC for AWS authentication (no long-lived keys)
• Store secrets in GitHub Secrets
• Use least-privilege IAM roles
• Pin action versions with full commit SHA
• Enable Dependabot for action updates
• Use permissions key to minimize token scope

MUST NOT:

• Commit secrets to repository
• Use personal access tokens in workflows
• Grant overly broad permissions

Related Documentation

• aws-s3-cloudfront SKILL.md
• secure-development SKILL.md