(01)Add workflow to your repo
Linux
1mkdir -p .github/workflows2cp ci.yml .github/workflows/ci.yml3git add .github/workflows/4git commit -m "Add CI pipeline"5git push origin main6# View runs: GitHub → Actions tabBuild, test, and Docker push workflow — the YAML IT teams bookmark for Node and Java projects
.github/workflows/ci.yml
Node.js — install, test, build Docker image, push to registry
1name: CI Pipeline2 3on:4 push:5 branches: [main, develop]6 pull_request:7 branches: [main]8 9env:10 REGISTRY: ghcr.io11 IMAGE_NAME: ${{ github.repository }}12 13jobs:14 build-and-test:15 runs-on: ubuntu-latest16 steps:17 - uses: actions/checkout@v418 19 - name: Setup Node.js20 uses: actions/setup-node@v421 with:22 node-version: "20"23 cache: "npm"24 25 - name: Install dependencies26 run: npm ci27 28 - name: Run tests29 run: npm test30 31 - name: Build Docker image32 run: docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .33 34 - name: Log in to GitHub Container Registry35 if: github.event_name == 'push' && github.ref == 'refs/heads/main'36 uses: docker/login-action@v337 with:38 registry: ${{ env.REGISTRY }}39 username: ${{ github.actor }}40 password: ${{ secrets.GITHUB_TOKEN }}41 42 - name: Push image43 if: github.event_name == 'push' && github.ref == 'refs/heads/main'44 run: docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}.github/workflows/java-ci.yml
Spring Boot / Maven — compile, test, package JAR
1name: Java CI2 3on:4 push:5 branches: [main]6 pull_request:7 branches: [main]8 9jobs:10 build:11 runs-on: ubuntu-latest12 steps:13 - uses: actions/checkout@v414 15 - name: Set up JDK 2116 uses: actions/setup-java@v417 with:18 java-version: "21"19 distribution: "temurin"20 cache: maven21 22 - name: Build and test23 run: mvn -B verify24 25 - name: Upload JAR artifact26 uses: actions/upload-artifact@v427 with:28 name: app-jar29 path: target/*.jarWhat to add before production merge
| Aspect | Minimal | Production |
|---|---|---|
| Auth | long-lived AWS keys in secrets | OIDC role (AWS_ROLE_ARN) — no static keys |
| Scan | build + push only | Trivy/Snyk scan gate before push |
| Deploy | kubectl apply on every push | main only; PR = plan/dry-run; env branches |
| Secrets | KUBECONFIG in repo secret | IRSA + short-lived tokens; rotate quarterly |
| Concurrency | none | cancel-in-progress on same branch |
| Branch protection | none | required reviews + status checks on main |
Step 01
1mkdir -p .github/workflows2cp ci.yml .github/workflows/ci.yml3git add .github/workflows/4git commit -m "Add CI pipeline"5git push origin main6# View runs: GitHub → Actions tab1# GitHub repo → Settings → Secrets and variables → Actions2# GITHUB_TOKEN is automatic; add DOCKERHUB_TOKEN if pushing to Docker Hub