CI/CD Pipeline with GitHub Actions: Complete Setup Guide
Md Nayeem Hossain
Author
Md Nayeem Hossain
Author
CI/CD Pipeline with GitHub Actions
Automation is the heart of modern DevOps. Continuous Integration (CI) and Deployment (CD) allow to ship code faster and with fewer bugs. GitHub Actions is my preferred tool because it lives right next to your code.
The Workflow Concept
A workflow is defined in a YAML file in .github/workflows/. It consists of:
Building the Pipeline
Here is a complete, production-grade workflow for a Node.js app. It runs tests, and if they pass, it builds a Docker image and pushes it to a registry.
name: CI/CD Pipeline
on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]
jobs:
test:
name: Run Tests
runs-on: ubuntu-latest
# We can spin up service containers for testing!
services:
mongo:
image: mongo:6
ports:
- 27017:27017
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm' # Automatically caches dependencies!
- name: Install dependencies
run: npm ci
- name: Run Tests
run: npm test
env:
DATABASE_URL: mongodb://localhost:27017/test_db
build-and-deploy:
name: Build & Deploy
needs: test # Only run if tests pass
if: github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Log in to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: Build and Push Docker Image
uses: docker/build-push-action@v5
with:
context: .
push: true
tags: myuser/myapp:latestSecrets Management
Notice the ${{ secrets.DOCKER_PASSWORD }}. You never want to commit passwords to your code. Go to your repository Settings > Secrets and variables > Actions to store these securely. They are encrypted and only exposed to the runner during execution.
Caching for Speed
CI/CD can be slow if you re-download dependencies every time. The actions/setup-node action has built-in caching. By adding cache: 'npm', it saves the node_modules folder. The next run will download the cache instead of hitting the npm registry, shaving minutes off your build time.
