GitHub Actions
GitHub Actions Automation & DevOps CI/CD

GitHub Actions CI/CD Workflow YAML Generator

Build production GitHub Actions workflow YAML pipelines for Node.js, Go, Python, Docker builds, unit tests, and automated releases.

100% Client-Side Privacy
Zero Server Transmission
Presets:
Event Triggers & Branches
Active Triggers:
Runtime & Matrix Strategy
Build, Test & Cache Steps
Security, Secrets & Concurrency
.github/workflows/nodejs-ci.yml Syntax Verified (v4)
name: Node.js CI/CD Pipeline

on:
  push:
    branches:
      - 'main'
      - 'master'
  pull_request:
    branches:
      - 'main'
      - 'master'
  workflow_dispatch:
  release:
    types: [published]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: write

jobs:
  build-and-test:
    name: NODE Test & Build
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        node-version: ['18.x', '20.x', '22.x']
    steps:
      - name: Checkout code repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Install pnpm package manager
        uses: pnpm/action-setup@v4
        with:
          version: 'latest'

      - name: Set up Node.js runtime environment
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'pnpm'

      - name: Install project dependencies
        run: pnpm install --frozen-lockfile

      - name: Run code linter and style check
        run: pnpm run lint

      - name: Run static typecheck
        run: pnpm run typecheck

      - name: Run automated test suite
        run: pnpm test -- --coverage

      - name: Compile and build production bundle
        run: pnpm run build

      - name: Upload build artifact
        uses: actions/upload-artifact@v4
        with:
          name: node-js-ci-cd-pipeline-artifact
          path: dist/
          retention-days: 7

      - name: Create GitHub Release on tag
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: dist/**
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Target Runtime
NODE • ubuntu
Pipeline Steps
9 Steps • ~5.2m run
Security Score
100/100 • Least-Privilege

Zero-Latency Local Compilation

Instantly synthesizes hardened GitHub Actions workflows in browser memory without sending private repo architecture to external servers.

Enterprise Security Hardening

Enforces least-privilege token permissions, concurrent job cancellation, step timeouts, and action version pinning against supply-chain attacks.

Multi-Language & Matrix Support

Tailored continuous integration templates for Node.js, Python, Go, Rust, Docker, and GitHub Pages with automated package caching.

Technical Reference & Architecture Guide

GitHub Actions CI/CD Workflow YAML Generator — Reference Guide

Build production GitHub Actions workflow YAML pipelines for Node.js, Go, Python, Docker builds, unit tests, and automated releases.

Key Parameters & Controls

namestring

The workflow identifier displayed in GitHub Actions run tabs, commit status badges, and pull request check summaries.

Default: CI / CD Pipeline
onstring | object

Defines webhook events triggering the workflow, including push, pull_request, scheduled cron intervals, and manual workflow_dispatch.

Default: push, pull_request
runs-onstring | array

Specifies the virtual runner host OS (ubuntu-latest, macos-latest, windows-latest) or custom self-hosted runner labels.

Default: ubuntu-latest
permissionsobject | string

Enforces least-privilege security access granted to the ephemeral GITHUB_TOKEN (e.g., contents: read, packages: write, id-token: write).

Default: contents: read
concurrencyobject | string

Prevents redundant simultaneous executions on the same branch or PR; cancel-in-progress aborts obsolete queued jobs to conserve minutes.

Default: group: ${{ github.ref }}, cancel-in-progress: true

Pro Tips & Best Practices

Reference actions using full

Reference actions using full 40-character commit SHAs rather than mutable branch or major version tags (e.g., actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1) to defend against supply chain attacks.

Configure concurrency groups

Configure concurrency groups with 'cancel-in-progress: true' keyed on '${{ github.workflow }}-${{ github.ref }}' to automatically kill outdated test runs when developers push new commits.

Declare top-level 'permissions

Declare top-level 'permissions: {}' (deny-all by default) and explicitly enable only required scopes (such as contents: read or pull-requests: write) inside individual jobs.

Leverage Native Action Cache Integration

Use built-in package manager caching in setup actions (such as 'cache: npm' in actions/setup-node or 'cache: pip' in actions/setup-python) instead of configuring manual cache actions.

Common Gotchas & Troubleshooting

Process completed with exit code 1 due to missing secret or empty environment variable

Verify repository or environment secrets under Settings > Secrets and variables > Actions. Secrets are not inherited by workflows triggered by forks unless explicitly configured via pull_request_target.

Resource not accessible by integration error (HTTP 403) when creating releases or publishing artifacts

Add an explicit permissions block to the job granting write access: 'permissions: { contents: write, packages: write }'. By default, GitHub Actions sets GITHUB_TOKEN to read-only in modern repositories.

Workflow fails to trigger on scheduled cron timers or published release events

Ensure the workflow YAML file is committed to the repository default branch (e.g., main or master). GitHub Actions evaluates scheduled cron jobs exclusively from the default branch.

Frequently Asked Questions

What is the fundamental difference between GitHub Actions jobs and steps?▼

A job runs on an isolated virtual machine or container runner, executing concurrently with other jobs by default unless chained via 'needs'. Steps run sequentially within a single job runner, sharing the local workspace filesystem and environment variables.

Why is pinning actions to a commit SHA considered a critical security practice?▼

Major version tags like @v4 are mutable Git references. If an upstream maintainer account or repository is compromised, malicious code can be pushed to that tag. Pinning to a full SHA guarantees that the exact audited bytecode executes every time.

How does workflow_dispatch work for manual and parameterized pipelines?▼

Adding 'workflow_dispatch:' under the 'on:' block adds a 'Run workflow' button in the GitHub Actions UI. You can define custom inputs (boolean toggles, string text fields, and dropdown choices) that pass into pipeline steps as '${{ inputs.parameter_name }}'.

How can I reduce GitHub Actions build times and conserve billed runner minutes?▼

Combine matrix builds with fail-fast options, leverage dependency caching (npm, pip, go, gradle), configure cancel-in-progress concurrency rules, and restrict triggers using path filters (paths / paths-ignore) so CI runs only when relevant code changes.

Related Tools & Utilities

All Tools →