GitHub workflow parts

GitHub workflow components for code repositories.

Important

Keep your pipelines safe and DRY!

Reusable workflows

Tip

Rather than copying and pasting from one workflow to another, you can make workflows reusable.
Source: Reusing workflow configurations

Containers:

• Publish your image
• Scan your image

.NET:

• Ensure the quality of your code

Markup (Markdown, YAML):

• Ensure the quality of your content

Terraform:

• Deploy your environment
• Ensure the quality of your infrastructure code

Composite actions

Tip

Composite actions allow you to collect a series of workflow job steps into a single action which you can then run as a single job step in multiple workflows. Source: Creating a composite action

Containers:

• Sign your image with Cosign

.NET:

• Build, test your code and analyze it with Sonar
• Build and test your code
• Install the SDK, lint the code and restore NuGet packages

MongoDB:

• Add your runner IP address to Atlas access list
• Start a server in your pipeline

SBOM:

• Generate a SBOM with Syft

Terraform:

• Setup Terraform
• Setup TFLint

Note

These composite actions download official release binaries directly (with SHA256 checksum verification) instead of relying on third-party marketplace actions, reducing supply-chain exposure. Linux runners only (for example ubuntu-latest).