actions

Instruction file imported from RickRyker/dreams (.github/instructions/actions.instructions.md). Copyright stays with the author.

When generating or improving GitHub Actions workflows:

Security First

• Use GitHub secrets for sensitive data, never hardcode credentials
• Pin third-party actions to specific commits by using the SHA value (e.g., - uses: owner/some-action@a824008085750b8e136effc585c3cd6082bd575f)
• Configure minimal permissions for GITHUB_TOKEN required for the workflow

Performance Essentials

• Cache dependencies with actions/cache or built-in cache options
• Add timeout-minutes to prevent hung workflows
• Use matrix strategies for multi-environment testing

Best Practices

• Use descriptive names for workflows, jobs, and steps
• Include appropriate triggers: push, pull_request, workflow_dispatch
• Add if: always() for cleanup steps that must run regardless of failure

Example Pattern

name: CI
on: [push, pull_request]

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      - run: npm test