advanced-actions-demo

GitHub Actions workflow-pattern lab showing reusable workflows, Node 18/20 matrix tests, concurrency control, least-privilege permissions, and environment-gated placeholder deploys.

Context: This is the pipeline implementation from devops-labs Module-3 Mini-Project 11. Full implementation notes and evidence live there.

---

What This Demonstrates Today

Pattern	Implementation	Why It Matters
Least-privilege workflow permissions	contents: read by default; deploy workflow receives only the permissions it currently needs	Keeps workflow permissions narrow while the deployment target is still a placeholder
Build matrix	strategy.matrix across Node 18 and 20	Parallel test runs, catches version-specific breakage before merge
Reusable workflows	workflow_call trigger in reusable-lint-test.yml	Shared lint/test logic — one change propagates to all consuming workflows
Environment targeting	workflow_dispatch with environment input (preview / staging / prod)	Manual deploy with environment-gated protection rules

---

Workflow Structure

.github/workflows/
├── build.yml               # Matrix build: Node 18 + 20, npm cache, calls reusable-lint-test
├── reusable-lint-test.yml  # workflow_call: shared lint + test logic
└── deploy.yml              # workflow_dispatch: environment-gated placeholder deploy

Deployment Boundary

The deploy workflow is intentionally a placeholder. It verifies that environment-scoped secrets are available, logs a masked-token deployment path, and gives a safe place to attach a real target later.

Reusable Workflow Pattern

# In build.yml
jobs:
  lint-test:
    uses: ./.github/workflows/reusable-lint-test.yml
    with:
      node-version: ${{ matrix.node }}

---

Environment Targeting

Manual dispatch selects target environment:

workflow_dispatch inputs:
  environment: preview | staging | prod

GitHub Environments can be configured with:

• Required reviewers before production deploys
• Environment-specific secrets
• Deployment protection rules

---

How to Run

git clone https://github.com/darestack/advanced-actions-demo.git
cd advanced-actions-demo
npm ci
npm test
npm run lint

Push to main to trigger the matrix build. Use Actions -> Deploy -> Run workflow to trigger a manual placeholder deployment and select the target environment.

To Add Real AWS OIDC Later

This repo should not claim AWS OIDC until these pieces exist in the workflow and can be shown in a successful run:

• permissions: id-token: write
• aws-actions/configure-aws-credentials@v4
• an IAM role ARN stored as an environment secret
• an IAM trust policy scoped to this repository and branch or environment
• a masked successful workflow run showing the assumed role

That would turn this from a workflow-pattern lab into a real cloud deployment example.

---

Stack

GitHub Actions · Node.js · Reusable Workflows · GitHub Environments