Instruction file imported from MattBerg11/sleeper-league-explorer (.github/instructions/github-actions-best-practices.instructions.md). Copyright stays with the author.

GitHub Actions Best Practices

Mandatory Rules

1. SHA Pin ALL actions with version comment:

   uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

   NEVER use @v4, @main, or @latest.

2. Least privilege permissions:

   permissions:
     contents: read

   Add write permissions only at job level where needed.

3. Frozen lockfile:

   run: pnpm install --frozen-lockfile

pnpm Setup Pattern

- name: Install pnpm
  uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0

- name: Setup Node.js
  uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
  with:
    node-version: 22
    cache: 'pnpm'

- name: Install dependencies
  run: pnpm install --frozen-lockfile

Caching

Use pnpm store caching:

key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
restore-keys: ${{ runner.os }}-pnpm-

Concurrency

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Timeouts

Always set timeout-minutes:

• Build/test: 15 minutes
• Sync/ETL: 10 minutes
• Deploy: 10 minutes