Use GitHub Actions for continuous integration

Cost

Free tier. Free for public repositories with a monthly quota of minutes for private ones, paid above that. Not open source.

How to do it

GitHub Actions became generally available with CI and CD on 13 November 2019. It is built into the code host that 81.1% of developers use, so there is no second account to manage. Workflows are YAML files in the repository, and AI tools write them well. Keep the way out open by putting the logic in scripts the workflow calls. Then any other CI runs the same scripts. Use short-lived cloud credentials as Use OIDC for CI says. It stays the pick because it comes with the code host, so there is no second server to run. Choose something else when your code lives on GitLab Community Edition. Then use its built-in CI/CD, which is open source and works the same way.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

YAML example

name: test
on: [push, pull_request]
jobs:
  test:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - run: ./scripts/test.sh

Shell example

#!/bin/sh
set -eu
npm ci
npm test

How to check

Every workflow file runs one script per job, and the same scripts pass on a developer machine. Every third-party action is pinned to a full 40-character commit hash.

Sources

• GitHub Actions documentation

Related rules

• Let CI sign in with OIDC in Infrastructure