Workflow

Step 1 — Complete CI + build + deploy pipeline

name: CI
on:
  push: { branches: [main] }
  pull_request: { branches: [main] }
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true
permissions: { contents: read }

jobs:
  quality:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: pnpm/action-setup@fe02b34f77f8bc703a5f83169411f1f62a0633a0
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
        with: { node-version: 20, cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint
      - run: pnpm tsc --noEmit
      - run: pnpm test -- --coverage

  build:
    needs: quality
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: pnpm/action-setup@fe02b34f77f8bc703a5f83169411f1f62a0633a0
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
        with: { node-version: 20, cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684
        with:
          path: .next/cache
          key: nextjs-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('**/*.ts','**/*.tsx') }}
          restore-keys: |
            nextjs-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-
            nextjs-${{ runner.os }}-
      - run: pnpm build

  deploy-preview:
    needs: build
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    environment: { name: preview, url: "${{ steps.d.outputs.url }}" }
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - id: d
        run: |
          URL=$(npx vercel deploy --token=${{ secrets.VERCEL_TOKEN }})
          echo "url=$URL" >> "$GITHUB_OUTPUT"

  deploy-prod:
    needs: build
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    environment: { name: production, url: "https://example.com" }
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - run: npx vercel deploy --prod --token=${{ secrets.VERCEL_TOKEN }}

Step 2 — Reusable workflow pattern

# .github/workflows/reusable-ci.yml
name: Reusable CI
on:
  workflow_call:
    inputs:
      node-version: { type: string, default: "20" }
      run-e2e: { type: boolean, default: false }
    secrets:
      VERCEL_TOKEN: { required: false }
jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: pnpm/action-setup@fe02b34f77f8bc703a5f83169411f1f62a0633a0
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
        with: { node-version: "${{ inputs.node-version }}", cache: pnpm }
      - run: pnpm install --frozen-lockfile && pnpm lint && pnpm tsc --noEmit && pnpm test
      - if: inputs.run-e2e
        run: pnpm test:e2e

Consume: uses: ./.github/workflows/reusable-ci.yml with with: { node-version: "20", run-e2e: true }.

Examples

Example 1 — Matrix builds across Node versions

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix: { node: [18, 20, 22] }
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: pnpm/action-setup@fe02b34f77f8bc703a5f83169411f1f62a0633a0
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
        with: { node-version: "${{ matrix.node }}", cache: pnpm }
      - run: pnpm install --frozen-lockfile && pnpm test

Example 2 — Monorepo with path filters

on:
  pull_request:
    paths: ["packages/api/**", "packages/web/**", "pnpm-lock.yaml"]
jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      api: ${{ steps.f.outputs.api }}
      web: ${{ steps.f.outputs.web }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
        id: f
        with:
          filters: |
            api: ["packages/api/**"]
            web: ["packages/web/**"]
  test-api:
    needs: changes
    if: needs.changes.outputs.api == 'true'
    uses: ./.github/workflows/reusable-ci.yml
  test-web:
    needs: changes
    if: needs.changes.outputs.web == 'true'
    uses: ./.github/workflows/reusable-ci.yml

Example 3 — Scheduled security audit

name: Security Audit
on:
  schedule: [{ cron: "0 9 * * 1" }]
  workflow_dispatch:
jobs:
  audit:
    runs-on: ubuntu-latest
    permissions: { issues: write }
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: pnpm/action-setup@fe02b34f77f8bc703a5f83169411f1f62a0633a0
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
        with: { node-version: 20, cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - run: pnpm audit --audit-level=high 2>&1 | tee audit.txt
        continue-on-error: true
      - if: failure()
        uses: peter-evans/create-issue-from-file@e8ef132d6df98ed982188e460ebb3b5d4ef3a9cd
        with: { title: "Security: audit found vulnerabilities", content-filepath: audit.txt, labels: "security,automated" }

Decision tree

1. Have tests? → Yes: CI workflow. No: lint + type-check only.
2. Monorepo? → Yes: path filters + --filter. No: single job.
3. Multiple Node versions? → Yes: matrix. No: pin to LTS.
4. Deploying from CI? → Yes: environments with secrets. No: skip deploy jobs.
5. Shared CI across repos? → Yes: reusable workflow. No: keep local.
6. Long builds? → Yes: cache .next/cache + turbo remote cache. No: default cache.
7. Security-sensitive? → Yes: SHA-pinned actions, restricted perms, scheduled audit.

Edge cases and gotchas

• Cache thrashing — overly specific keys miss every run; layer with restore-keys
• Concurrency races — without concurrency groups, pushes to the same PR queue redundant runs
• Fork secret exposure — pull_request from forks cannot access secrets; pull_request_target has write access on the base — use with caution
• Action supply-chain — @v4 tags can be moved; pin to full SHA hashes
• Timeout waste — default 360-min timeout burns runner minutes on hung jobs
• pnpm store path — differs on self-hosted runners, breaking cache restore

Evaluation criteria

Research-backed changes

The biggest delta is Wasmer (YC S19) Is Hiring – Rust and DevRel Positions. Fold the concrete changes into the operating notes, then discard the fluff.

Fresh signals

• Wasmer (YC S19) Is Hiring – Rust and DevRel Positions · Hacker News
• A Mysterious Numbers Station Is Broadcasting Through the Iran War · Hacker News
• I Quit. The Clankers Won · Hacker News
• CERN levels up with new superconducting karts · Hacker News

Next edits

• Add one new tactic based on Wasmer (YC S19) Is Hiring – Rust and DevRel Positions.
• Rewrite one stale section with today's source language.
• Turn the top signal into a reusable agent prompt.