5 ways to automate everyday workflows with GitHub Actions

Key Concepts

• GitHub Actions
• CI/CD (Continuous Integration/Continuous Delivery)
• Automation beyond CI/CD
• Community Management (welcoming contributors, auto-tagging)
• Stale Issue Management
• Build Summaries
• Reusable Workflows
• Parallel Job Execution
• Caching Dependencies
• Artifact Attestations
• Immutable Releases
• Sigstore
• Provenance
• Bill of Materials (BOM)
• GitHub Container Registry
• Self-hosted Runners
• GitHub-managed Workflows

Automating GitHub Actions Beyond CI/CD

This presentation explores how to leverage GitHub Actions for automation beyond traditional CI/CD pipelines, focusing on enhancing community engagement, improving project management, accelerating delivery, and ensuring security.

1. Community Management and Project Organization

The speaker demonstrates how GitHub Actions can automate community management tasks within a public repository.

• Welcoming New Contributors: A workflow is set up to automatically welcome new contributors when they join the repository, open an issue, or create a pull request. This workflow checks if a contributor is new and provides a personalized welcome message.
  • Example: When a new issue is opened, a script adds a welcome message, identifying the user as a "new issue contributor" or "new PR contributor."
• Auto-tagging Issues and Pull Requests: Actions can automatically tag issues and pull requests to aid in organization, allowing for the assignment of priority levels and component labels.
• Metrics and Reporting: Workflows can be configured to track metrics, such as issues and pull requests opened in the last 30 days, to identify and report on "stale" items.
  • Real-world Application: This helps prevent issues and pull requests from being forgotten, especially in open-source or enterprise projects.
  • Demo: The speaker shows a live example of a "Community Management" workflow running, welcoming a new contributor, auto-tagging an issue, and successfully completing. They also highlight how to view these workflow runs in the "Actions" tab of the repository.

2. Stale Issue and Pull Request Management

Automating the identification and management of stale issues and pull requests is crucial for project health.

• Scheduled Workflows: A workflow can be scheduled to run daily (e.g., at midnight) to identify stale issues and pull requests.
• Staleness Criteria: The system can mark issues as stale after a certain period (e.g., 30 days for PRs, 7 days before closing).
• Management Reports: These workflows generate reports detailing the stale items, providing a clear overview for project maintainers.
  • Build Summaries: Each action workflow includes a customizable "build summary" that can present metrics and the outcome of the automation.
  • Integration with Communication Tools: These reports can be sent to communication platforms like Microsoft Teams or Slack for regular updates.

3. Scaling Actions and Accelerating Delivery

This section focuses on optimizing workflows for efficiency and speed, particularly in enterprise environments.

• Reusable Workflows: The presentation emphasizes the use of reusable workflows to avoid repetitive code and manage complex pipelines.
  • Concept: Reusable workflows allow you to define a set of jobs that can be called from multiple other workflows, promoting DRY (Don't Repeat Yourself) principles.
  • Example: A CI/CD pipeline can be structured with reusable workflows for backend and frontend builds.
• Parallel Job Execution: Running jobs in parallel significantly reduces overall execution time.
  • Methodology: In the example, backend and frontend builds are configured to run concurrently using different runners.
  • Benefit: This speeds up the delivery process, allowing for simultaneous testing, documentation generation, or other tasks.
• Caching Dependencies: Caching dependencies (e.g., Python versions, npm packages) can drastically reduce build times for long-running workflows.
  • Process: Cache the necessary packages and libraries before the build process, and then restore them during the build.
• Beyond CI/CD Use Cases: The speaker highlights that GitHub Actions can be used for various tasks beyond CI/CD, including:
  • Resizing images
  • UI interface testing
  • Documentation generation (e.g., creating Readmes)

4. Secure Automation and Artifact Attestations

Ensuring the security of the software development lifecycle (SDLC) is paramount.

• The Importance of Security: The speaker stresses that everyone involved in pushing code is a potential security expert, as mistakes like committing passwords can happen.
• Securing the SDLC: GitHub is focused on securing the entire SDLC and workflows.
• Artifact Attestations: This is a key concept for proving the integrity of built artifacts.
  • Definition: Artifact attestations provide evidence that the artifact being run is the same as the one originally built, preventing tampering.
  • Technical Term: Provenance refers to the origin and history of an artifact.
  • Technical Term: Bill of Materials (BOM) lists all the components and dependencies within a software artifact.
• Immutable Releases: GitHub has recently introduced immutable releases, which are a critical component of securing the SDLC.
  • Compliance: This feature supports Salsa Level 3 compliance.
• Attestation Process:
  • Public Repositories: For public repositories using GitHub-managed workflows (not self-hosted runners), attestations are made with the public Sigstore, leading to a signed attestation and a public transparency log. This is highly beneficial for open-source projects.
  • Private Repositories: For private repositories, attestations are made with a GitHub Sigstore, resulting in a signed attestation and a private attestation store.
• Demo of Container Image Build and Attestation:
  • A simple workflow is demonstrated that builds a container image, pushes it to the GitHub Container Registry, and then attests it using built-in actions.
  • Output Summary: The workflow provides a summary including the container image, image digest, and details of the attestation.
  • Verification: Attestations can be downloaded, secured, and verified against commit history, SHA codes, workflow files, and even via the CLI.
• Integration with Releases: Attestations can be compared with releases, and immutable releases are now tightly integrated with attestations, providing an enhanced layer of security.
  • Argument: The end-to-end SDLC capability with attestations and immutable releases is a significant advancement for enterprise customers.

Conclusion and Takeaways

The presentation concludes by reiterating the power of GitHub Actions for automating tasks beyond CI/CD, enhancing community engagement, improving project management, and crucially, securing the entire software development lifecycle. The speaker encourages attendees to explore the public repository, contribute, and experiment with the provided workflows. The key takeaways are:

• Expand Automation: Leverage GitHub Actions for community management, stale issue tracking, and more.
• Accelerate Delivery: Utilize reusable workflows, parallel jobs, and caching for faster builds.
• Prioritize Security: Implement artifact attestations and immutable releases to ensure the integrity and provenance of your software.
• Community Contribution: The provided repository is a resource for learning and implementing these automation strategies.