GitHub Actions Advanced YAML Pipelines Cheatsheet

GitHub Actions has evolved from simple task runners into a sophisticated CI/CD platform. Designing enterprise pipelines requires strategies for parallel testing, execution concurrency limits, secure credential separation across environments, and step-level caching.

This reference sheet covers concurrency policies, matrix strategies, reusable workflows, environments, and caching.

Concurrency Controls & Queue Limits

Prevent duplicate execution costs by ensuring only a single workflow run runs at a time for a given branch or pull request.

name: Continuous Integration

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

# Group runs by ref (branch/PR). If a new commit is pushed, cancel the previous running job.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

High-Performance Matrix Strategies

Matrix strategies allow you to spawn parallel job executions across multiple operating systems and programming language runtimes.

jobs:
  build:
    runs-on: ${{ matrix.os }}
    strategy:
      # If one job in the matrix fails, do not automatically cancel the remaining running jobs
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
        node-version: [18.x, 20.x]
        # Include specific platform custom variables
        include:
          - os: ubuntu-latest
            node-version: 20.x
            experimental: true
        # Exclude specific combinations
        exclude:
          - os: macos-latest
            node-version: 18.x

    steps:
      - uses: actions/checkout@v4
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
      - run: npm ci
      - run: npm run test

Designing Reusable Workflows

Avoid duplicate YAML code blocks by encapsulating standard delivery structures into reusable templates.

1. The Reusable Workflow (.github/workflows/deploy-template.yml)

name: Reusable Deployment

on:
  workflow_call:
    inputs:
      target_env:
        required: true
        type: string
    secrets:
      DEPLOY_KEY:
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.target_env }}
    steps:
      - name: Perform Deployment
        run: |
          echo "Deploying to ${{ inputs.target_env }}..."
          curl -X POST -H "Authorization: Bearer ${{ secrets.DEPLOY_KEY }}" https://api.meshworld.in/deploy

2. The Caller Workflow (.github/workflows/production.yml)

name: Release Pipeline

on:
  release:
    types: [published]

jobs:
  trigger-production-deployment:
    uses: ./.github/workflows/deploy-template.yml
    with:
      target_env: 'production'
    secrets:
      DEPLOY_KEY: ${{ secrets.PROD_API_KEY }}

Configuring Secure Environments

Assign environment contexts to specific jobs to implement gate controls, manual deployment approvals, and variable overrides.

jobs:
  production_release:
    runs-on: ubuntu-latest
    # Links to GitHub repository settings environment containing review approvals
    environment:
      name: production
      url: https://meshworld.in
    steps:
      - name: Access Production Key
        # Secrets are securely injected strictly for this environment context
        run: echo "Deploying with key ${{ secrets.PRODUCTION_AWS_ACCESS_KEY }}"

Optimizing Workflows with Caching

Speed up job execution times by caching runtime dependency folders (like Node.js node_modules or Python package caches) between workflow runs.

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      # 1. Standard npm caching setup
      - name: Setup Node.js with cache
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm' # Automatically configures cache path matching package-lock.json hash
          
      - run: npm ci
      
      # 2. Custom directory caching using actions/cache
      - name: Cache Astro OG generator cache
        uses: actions/cache@v4
        with:
          path: .og-cache
          key: ${{ runner.os }}-og-cache-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-og-cache-