jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [16.x, 18.x, 20.x]
        os: [ubuntu-latest, windows-latest, macos-latest]
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
      - run: npm ci
      - run: npm test

name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm test

      - name: Build application
        run: npm run build

# Environment variables
env:
  NODE_ENV: production
  API_URL: ${{ vars.API_URL }}

# Secrets management
steps:
  - name: Deploy to production
    run: |
      echo ${{ secrets.DEPLOY_KEY }} | base64 -d > deploy_key
      chmod 600 deploy_key
      scp -i deploy_key ./dist/* user@server:/var/www/

# Node.js setup with caching
- uses: actions/setup-node@v4
  with:
    node-version: '20'
    cache: 'npm'

# Python setup
- uses: actions/setup-python@v4
  with:
    python-version: '3.11'

# Go setup
- uses: actions/setup-go@v4
  with:
    go-version: '1.21'

# CodeQL security analysis
- name: Initialize CodeQL
  uses: github/codeql-action/init@v2
  with:
    languages: javascript

- name: Perform CodeQL Analysis
  uses: github/codeql-action/analyze@v2

# Dependency review
- name: Dependency Review
  uses: actions/dependency-review-action@v3

# Test results upload
- name: Upload test results
  uses: actions/upload-artifact@v3
  with:
    name: test-results
    path: test-results/

# Coverage reporting
- name: Upload coverage to Codecov
  uses: codecov/codecov-action@v3
  with:
    file: ./coverage/lcov.info

# Blue-green deployment
jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - name: Deploy to staging
        run: ./deploy.sh staging

  deploy-production:
    runs-on: ubuntu-latest
    environment: production
    needs: deploy-staging
    if: github.ref == 'refs/heads/main'
    steps:
      - name: Deploy to production
        run: ./deploy.sh production

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        test-suite: [unit, integration, e2e]
    steps:
      - run: npm run test:${{ matrix.test-suite }}

  build:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - run: npm run build

  deploy:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - run: npm run deploy

# Run only on specific paths
on:
  push:
    paths:
      - 'src/**'
      - 'tests/**'
      - '!docs/**'

# Skip CI for documentation
jobs:
  test:
    if: "!contains(github.event.head_commit.message, '[skip ci]')"
    runs-on: ubuntu-latest
    steps:
      - run: npm test

// action.yml
name: 'Hello World'
description: 'Greet someone'
inputs:
  who-to-greet:
    description: 'Who to greet'
    required: true
    default: 'World'
runs:
  using: 'node16'
  main: 'dist/index.js'

// index.js
const core = require('@actions/core');

try {
  const name = core.getInput('who-to-greet');
  console.log(`Hello ${name}!`);
  core.setOutput('greeting', `Hello ${name}!`);
} catch (error) {
  core.setFailed(error.message);
}

# action.yml
name: 'Docker Action'
description: 'Run command in Docker container'
runs:
  using: 'docker'
  image: 'Dockerfile'
  args:
    - ${{ inputs.command }}

# action.yml
name: 'Setup Environment'
description: 'Setup development environment'
runs:
  using: 'composite'
  steps:
    - run: npm ci
      shell: bash
    - run: npm run build
      shell: bash

# Use pinned versions
- uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675
  # Instead of: uses: actions/checkout@v4

# Limit permissions
permissions:
  contents: read
  issues: write

# Use trusted actions only
# Avoid actions from unverified creators

# Cache dependencies
- uses: actions/cache@v3
  with:
    path: ~/.npm
    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}

# Use matrix for parallel jobs
strategy:
  matrix:
    node-version: [18, 20]
  fail-fast: false

# Retry failed jobs
jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      max-parallel: 4
      matrix:
        retry: [1, 2, 3]
    steps:
      - run: npm test || (sleep 10 && npm test)

# .github/workflows/ci.yml
name: CI

on: [push, pull_request]

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm test
      - run: npm run build

# .github/workflows/release.yml
name: Release

on:
  release:
    types: [published]

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm run build
      - run: npm publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}