Reduce duplicated efforts: Mastering automation with GitHub Actions| Jessica Deen| Beyond the Commit

Key Concepts

• Automation in software delivery
• GitHub Actions
• DevOps (People, Process, Products)
• CI/CD (Continuous Integration/Continuous Delivery or Deployment)
• GitHub Actions Marketplace
• Immutable Actions
• Workflow files
• Branch protection rules
• Deployment gates
• Reusable workflows (DRY principle - Don't Repeat Yourself)
• OIDC (OpenID Connect)
• Job Summaries

1. Introduction to Automation and GitHub Actions

• Automation in software engineering aims to automate manual tasks to reduce errors.
• GitHub Actions facilitates automation, tying into DevOps and CI/CD practices.
• DevOps is defined as the union of people, process, and products, enabling continuous delivery of value to end users.
• The goal is to deliver value to end users through systematic automation using tools like GitHub Actions.

2. GitHub Actions Marketplace

• The GitHub Actions Marketplace provides pre-built automation tools for use with GitHub Actions.
• It includes CI/CD tooling, reporting tools, and AI tools.
• Users can also build and publish their own tools.

3. Immutable Actions for Enhanced Security

• Immutable Actions, soon to be generally available (GA), will store actions on packages in the GitHub container registry.
• This allows referencing specific, immutable versions of actions, enhancing the CI/CD supply chain and improving security.
• Instead of using commit SHAs or past versions, a specific, immutable version of an action can be referenced.

4. Workflow Files and Triggering Actions

• Workflow files define the steps and triggers for actions.
• Triggers can be set for events like pushes to specific branches (e.g., main, feature branches) or pull requests.
• Branch protection rules and deployment gates can be configured to ensure that critical processes like testing and security checks are completed before merging or deploying.
• Manual approvals can be required for deployments, especially in regulated industries (government, healthcare, finance) for compliance and audit control.

5. Reusable Workflows and the DRY Principle

• Reusable workflows prevent script sprawl by allowing the creation of standardized workflows that can be used across multiple projects and organizations.
• These workflows can be stored in a central repository along with infrastructure-as-code files (e.g., Bicep, Terraform, CloudFormation).
• Reusable workflows support inputs for passing information between workflows and customizing behavior for different environments.
• Example: Frontend, backend, and middleware teams can use the same linting, testing, and security policy reports through a standardized process.

6. Secure Workflows with OIDC (OpenID Connect)

• GitHub Actions uses a declarative approach defined in workflow files.
• OIDC is the recommended method for establishing trust relationships between GitHub Actions and cloud providers (Azure, Google, AWS).
• OIDC allows GitHub Actions to authenticate to the cloud and obtain temporary credentials with specific permissions.
• Permissions can be defined per branch, tag, environment, or pull request.
• The temporary credential is used only for the duration of the job and is automatically discarded afterward.

7. Job Summaries for Workflow Reporting

• Job Summaries provide a way to view the results of workflow runs without combing through thousands of lines of logs.
• Job Summaries can output data such as code coverage, unit test results, and custom job summaries in markdown or text format.
• Conditional statements can be used to output different information based on the success, failure, or cancellation of a job.
• Job Summaries can be integrated with reusable workflows to standardize output across teams and projects.
• In regulated industries, Job Summaries can include provenance and SBOM (Software Bill of Materials) information.

8. Conclusion

• Automation is crucial for ensuring code is delivered in the correct state.
• GitHub Actions provides tools and features to automate testing, security checks, and deployment.
• Using the GitHub Actions Marketplace, Immutable Actions, reusable workflows, OIDC, and Job Summaries can streamline and secure the software delivery process.
• The overall goal is to free developers from manual tasks and ensure consistent, reliable deployments.