Demystifying GitHub Actions - Harnessing the power of automation to streamline your development process

Dive into this deck on GitHub Actions, where we blend essential automation tips with fun movie-themed memes! Learn how to optimize your workflows, secure projects, and identify all the film references. Perfect for developers eager to enhance their GitHub skills and add efficiency to their processes. Enjoy and apply these insights for a more streamlined and secure development experience!

1. By: Victor Szoltysek
Aug 30th / 2024
RAVL EIP
Harnessing the power of automation to
streamline your development process
DEMYSTIFYING
GITHUB ACTIONS

4. GITHUB ACTIONS IS EASY
Essentially a scheduler and runner that's incredibly simple to use.
Free for public repositories on GitHub.
Just add a GitHub Action file to define what to do and when.
Meant to be used by developer (directly).
GitHub Actions: a Developer's Best Friend

5. When
What

8. HOW DO I BUILD THIS AGAIN?
Avoid the "works on my machine" syndrome.
Implement from day one—you'll thank me later.
Simplify your current 47-step build process.
Build Consistency: Once and for all

9. On Code Commit
Checkout
Code
Setup Java
Run Build

14. WHO BROKE THE BUILD?
Immediate action required if the build fails: fix or roll back.
Temporary red builds are fine; permanent red is not.
Tip: Use Webhooks (MS Teams) to keep everyone informed.
Keeping the Build Green

15. Custom Action

16. Easy to create custom
MS Teams Incoming
Webhook (just
copy+paste the URL)

19. ENHANCING YOUR BUILD PROCESS
As a dev team, add additional checks to ensure quality.
Linting, Code Analysis, Unit Testing etc.
Use the same checks locally and on GitHub Actions.
Automate More, Stress Less

20. Note - one call (not
multiple)

22. PRESERVING BUILDS
By default, builds are temporary—learn to save what matters.
Preserve build artifacts for deployment and future
reference.
Ensure the availability and integrity of your artifacts.
Securing Your Build Artifacts

25. WHAT’S IN THE BUILD?
Eliminate the "Is it deployed yet?" and "What’s in the build?"
confusion — you’re thank me later.
Uniquely version your builds — it’s easy! Don’t make it hard !
Unique filename and runtime check of version including GitHash /
Build Time / and version number.
Know Your Build Inside Out

26. Gradle (Java) Build Script Snippet
Auto GitHub Environment
Variable

27. You know exactly
what’s deployed
endpoint

29. WHERE’S THE DEPLOY BUTTON?
Prevent the scramble for deployment procedures and credentials due to
infrequent use.
Set up automated deployments from Day 1 — You’ll thank me later.
Don’t store secrets/passwords in source control—use GitHub Secrets instead.
You can also add manual gates (approval steps).
Deployment at a Click

33. MY BUILDS ARE SLOW
Builds slow down as projects grow
Keep core builds under 10 minutes for fast feedback
Profile builds and fix slow steps
Managing Build Performance

36. MY BUILDS ARE SLOW
The term "Pipeline" is deceptive; it implies sequential steps for DevOps.
Parallelize builds across actions, steps and agents to save time.
Avoiding making multiple sequential calls just to get the pretty pipeline
steps.
Why 'Pipeline' Can Be a Misnomer

40. MY BUILDS ARE SLOW
Use caching actions to avoid redundant operations.
Treat every build as a release candidate; avoid multiple
identical builds (i.e. 4 instead of 1)
Skip builds for changes that don’t affect the final product.
Reducing Redundancy in Builds

41. Cache Maven (Java) Dependencies

42. Skip build on non-code changes

45. MY BUILDS ARE SLOW
Externalize slow, less critical tests into separate, less frequent
workflows.
Parallize execution (across agents) to reduce bottlenecks.
Handle slow, mandatory checks imposed by other teams in a
separate workflow, using CODEOWNER files to manage access rights.
Separating and Optimizing Slow Steps

46. Nightly Security Check

47. .github/OWNERS file — lock access for security check

49. KEY TAKEAWAYS
Try GitHub Actions on your next GitHub Public repo
Use ChatGPT to write your GitHub Actions scripts
Advocate for fast automated builds, quick feedback, auto deploys, and versioned
artifacts on your teams.
If things are brittle, slow, and manual — automate them and do them more often.
Action To Take

51. [email protected]
www.victorszoltysek.com

52. Reusable Workflows: Utilize reusable workflows to avoid duplication and maintain consistent standards across projects. Allow
for custom workflows when specific needs arise to maintain flexibility.
Custom Actions Development: Develop custom actions to automate unique processes tailored to your projects, enhancing
efficiency. Allow standard actions to be used alongside custom ones to avoid reinventing the wheel and opt for battle-tested,
official actions.
Use of CODEOWNERS Files: Implement CODEOWNERS files to secure and manage access to critical code changes.
Specifically, lock down workflow modifications to designated teams like Security or QA, ensuring controlled updates.
Dynamic Status Badges: Incorporate dynamic status badges in project READMEs to instantly show workflow health with a
dash of visual flair—adding some razzle-dazzle to your project's visibility.
Dependency Graphs Over Sequential Pipelines: Design workflows as dependency graphs rather than traditional sequential
pipelines. This approach optimizes execution paths and reduces waiting times by highlighting interdependencies and allowing
for concurrent executions.
Utilization of Built-in Variables: Leverage GitHub’s built-in environment variables for dynamic configuration management
across your workflows, minimizing manual setup and maintenance.
Secure Secrets Management: Use GitHub Secrets to securely manage sensitive information within your workflows, ensuring
that credentials are shielded and compliance is maintained.
Scheduled Workflows: Optimize resource utilization by scheduling non-critical workflows to run during off-peak hours,
reducing load and improving efficiency.
Essential GitHub Actions Insights for Advanced Workflows