CI/CD + Shift-Left Security
25 min
Day 78: GitHub Actions: build, test, cache, matrix
GitHub Actions: build, test, cache, matrix
A workflow is triggered by an event (push, PR, schedule) and runs a series of jobs, each a sequence of steps on a fresh runner. Understanding this structure is the whole foundation for reading or writing any CI pipeline.
A real build+test workflow
name: CI
on:
push:
branches: [main]
pull_request:
jobs:
test:
runs-on: ubuntu-latest
strategy:
matrix:
node-version: [18, 20]
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: '${{ matrix.node-version }}'
cache: 'npm'
- run: npm ci
- run: npm testcache: npm avoids re-downloading dependencies on every run when the lockfile hasn't changed — a real, measurable speedup at scale. The matrix strategy runs the same job across multiple parameter combinations (here, two Node versions) in parallel, catching version-specific bugs before they reach anyone.
Key terms
- Job
- An independent unit of work in a workflow, running on its own fresh runner.
- Matrix strategy
- Runs the same job across multiple parameter combinations in parallel.
Why does a matrix strategy testing Node 18 and 20 catch bugs a single-version pipeline would miss?
