GitHub Actions Workflow Generator

GitHub Actions is GitHub's built-in CI/CD platform. Workflows are defined as YAML files in .github/workflows/ and triggered by events like push, pull_request, or schedule. Each workflow runs on a runner (ubuntu-latest, windows-latest, macos-latest) and consists of jobs, which contain steps — individual commands or reusable actions from the GitHub Marketplace. Workflows run on GitHub's servers at no cost for public repositories (private repos get 2,000 free minutes/month on the free plan).

Modern setup actions like actions/setup-node@v4, actions/setup-python@v5, and actions/setup-go@v5 have a built-in cache parameter that automatically caches the relevant package manager's dependencies (node_modules, pip, Go module cache). This is the preferred approach — it handles cache key generation automatically based on lock files. The standalone actions/cache@v4 action gives you more control for custom caching scenarios but requires manual key configuration. For standard setups, always prefer the built-in cache option.

Never put secrets in YAML files. Use GitHub repository secrets: go to Settings → Secrets and variables → Actions → New repository secret. Reference them in workflows as $\{\{ secrets.MY_SECRET \}\}. For Docker Hub, create DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets. For Vercel, add VERCEL_TOKEN, VERCEL_ORG_ID, and VERCEL_PROJECT_ID. For Fly.io, add FLY_API_TOKEN. The GITHUB_TOKEN secret is automatically available for GitHub Container Registry — no setup needed.

Use an if condition on the job or step: if: github.ref == 'refs/heads/main'. This is essential for deployment steps — you want tests to run on every PR, but deployments should only happen when code merges to main. For Docker pushes, use push: $\{\{ github.ref == 'refs/heads/main' \}\} in the build-push-action to build on all branches but only push the image when on main. Alternatively, put deploy logic in a separate job that depends on the build job and has the if condition.