#github-actions

Build a multi-arch Docker image with Buildx, tag it automatically (branch, sha, semver) and push it to GitHub Container Registry using only GITHUB_TOKEN. Every line explained.

Make runs fast with dependency caches, and pass build outputs between jobs or keep them for download with artifacts.

Routine for red or stuck workflow runs: read the failing step, enable debug logs, reproduce locally, and match the error against the usual suspects.

Deploy an image to an EC2 Docker Compose host with approval-gated environments, keyless AWS login via OIDC, SSM Run Command, a smoke test and automatic rollback.

How to read data inside workflows with ${{ }}: github, env, vars, secrets, steps, needs and inputs contexts, status functions, and the GITHUB_OUTPUT / GITHUB_ENV / GITHUB_STEP_SUMMARY files.

Checklist for fast, secure, maintainable pipelines: pinned actions, least privilege, OIDC, concurrency, timeouts, caching and reuse.

The mental model: an event triggers a workflow, the workflow runs jobs on runners, each job runs steps, and steps run shell commands or reusable actions.

Read these notes in order to go from zero to your own production CI/CD: concepts, syntax, security, registry, releases, deploys, reuse and debugging.

Control how jobs relate: ordering with needs, conditions with if, fan-out with matrix, passing values with outputs, plus services, timeouts and environments.

Push a vX.Y.Z tag and let GitHub Actions test, publish a versioned image to GHCR and create a GitHub Release with generated notes and attached binaries.

Write the pipeline once and reuse it everywhere: reusable workflows (workflow_call) for whole jobs, composite actions for shared steps. One source of truth for all repos.

Where credentials live (repo, environment, org), least-privilege GITHUB_TOKEN permissions, and keyless cloud login with OIDC instead of long-lived keys.