GitHub workflow parts

GitHub workflow components for code repositories.

Important

Keep pipelines safe and DRY!

Reusable workflows

Tip

Rather than copying and pasting from one workflow to another, you can make workflows reusable.
Source: Reusing workflow configurations

Containers:

• Publish an image
• Scan an image

.NET:

• Ensure the quality of the code

Git:

• Tell what changed, the version and the branch slug, for the jobs that follow

GitHub Pages:

• Build a site and deploy it

Helm:

• Publish the new chart versions as GitHub releases and a chart repository on GitHub Pages

Markup (Markdown, YAML, shell scripts):

• Ensure the quality of the content

Node.js:

• Lint, build, test and analyze the code
• Publish a package to npmjs.org or GitHub Packages

Terraform:

• Deploy or destroy an environment
• Ensure the quality of the infrastructure code

Composite actions

Tip

Composite actions allow you to collect a series of workflow job steps into a single action which you can then run as a single job step in multiple workflows. Source: Creating a composite action

Containers:

• Build and push an image for one or more platforms
• Sign an image with Cosign
• Setup QEMU to build images for other platforms
• Scan an image or a directory with Trivy
• Setup Trivy

.NET:

• Build, test the code and analyze it with Sonar
• Build and test the code
• Install the SDK, lint the code and restore NuGet packages
• Package the projects and push them to a NuGet registry

Git:

• Tell whether a commit changes some paths

Go:

• Lint the code with the Go toolchain
• Scan the code with govulncheck
• Setup GoReleaser

Helm:

• Setup Helm
• Setup chart-releaser
• Setup chart-testing
• Setup helm-repo-html
• Setup helm-unittest
• Setup kube-linter
• Setup kubeconform

Kubernetes:

• Setup kind and kubectl

License compliance:

• Analyze the dependencies with FOSSA

MongoDB:

• Add the runner IP address to the Atlas access list
• Start a server in the pipeline

Node.js:

• Publish a package unless its version already is
• Install the Playwright browsers

Search engines:

• Submit the pages of a sitemap to IndexNow

Code scanning:

• Setup CodeQL
• Setup Opengrep

Sonar:

• Analyze the code of a project other than .NET

SBOM:

• Generate a SBOM with Syft

Task:

• Setup Task

Terraform:

• Setup Terraform
• Setup TFLint

Note

These composite actions download official release binaries directly (with SHA256 checksum verification) instead of relying on third-party marketplace actions, reducing supply-chain exposure. Linux runners only (for example ubuntu-latest).