GitHub Actions Matrix CI/CD

---
name: github-actions-ci
description: Production CI pipelines, pnpm caching, parallel matrix testing, automated semver releases, and branch protection checks.
license: Apache-2.0
version: 1.4.1
---

# GitHub Actions Matrix CI/CD

## Overview
Production CI pipelines, pnpm caching, parallel matrix testing, automated semver releases, and branch protection checks.
This skill establishes an authoritative, production-grade operational standard for GitHub Actions Matrix CI/CD. When this skill is active, the AI agent adheres to the strict engineering guidelines, architectural invariants, code patterns, and safety constraints specified below.

## 1. Core Architectural Invariants
1. **Contract Strictness**: Validate all incoming parameters and inputs at system boundaries using explicit schemas (Pydantic, Zod, or type-enforced contracts). Never allow untyped or unvalidated data into core logic.
2. **Defensive Isolation**: Ensure side-effects are decoupled and isolated. Network, disk, and database operations must include explicit timeouts, retries with exponential backoff, and circuit breakers.
3. **Observability & Telemetry**: Emit structured JSON logs with traceable correlation IDs. Never output sensitive tokens, secrets, or plain-text PII in log records.
4. **Deterministic Reproducibility**: Ensure all workflows, builds, and outputs are idempotent. Repeated executions with identical inputs must produce identical results without state drift.

## 2. Production Reference Implementation
```yaml
# Production Declarative Specification
apiVersion: apps/v1
kind: Deployment
metadata:
  name: github-actions-ci
  labels:
    app.kubernetes.io/name: github-actions-ci
    app.kubernetes.io/part-of: enterprise-platform
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app.kubernetes.io/name: github-actions-ci
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        fsGroup: 10001
      containers:
        - name: app
          image: ghcr.io/enterprise/github-actions-ci:v1.0.0
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          readinessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
```

## 3. Step-by-Step Execution Workflow
1. **Audit Preconditions**: Verify that all required dependencies, environment variables, and configuration flags are active before initiating operations.
2. **Execute Invariant Verification**: Run unit checks, schema validation, and static type audits against the target workspace.
3. **Apply Atomic Transformations**: Execute code modifications or operational procedures in atomic steps to allow clean rollback in the event of failure.
4. **Post-Execution Sanity Check**: Verify system health via automated assertions, tests, and linter passes to confirm zero regressions.

## 4. Strict Anti-Patterns & Common Traps
- ❌ **Do not bypass parameter validation**: Blindly trusting client or external inputs introduces remote code execution, injection, and logic bugs.
- ❌ **Do not ignore unhandled asynchronous errors**: Uncaught promises or unhandled background tasks lead to silent process crashes and resource leaks.
- ❌ **Do not hardcode environment-specific credentials or URLs**: Always consume configuration through verified environment schemas.
- ❌ **Do not perform unbounded queries or loops**: Cap execution limits, page sizes, and retry counts to prevent runaway resource exhaustion.

## 5. Production Verification & Testing Checklist
- [ ] Static type check passes with zero errors (`tsc --noEmit`, `mypy`, or `cargo check`).
- [ ] Unit and integration test coverage verifies both happy paths and edge case failure handling.
- [ ] Security scanners report zero High or Critical vulnerabilities.
- [ ] Logs and diagnostics verify clean startup and graceful termination without memory leakage.