Demo: review a build-test-deploy workflow
A workflow diagram should make dependencies and deploy gates obvious. It should also help spot overly broad permissions or secrets available too early in the pipeline.
- Keep deploy jobs dependent on test jobs through needs.
- Set minimal permissions at the workflow or job level.
- Use environments for manual approvals and protected deployments.
name: CI
on: [push, pull_request]
permissions:
contents: read
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: npm test
deploy:
needs: test
environment: production
runs-on: ubuntu-latest
steps:
- run: ./deploy.sh