Best Practices and Optimization

Best Practices and Optimization

A production workflow should be correct before it is fast. Optimize the critical feedback path, reduce privileges and supply-chain risk, make failures diagnosable, and ensure deployment has a safe recovery path.

Core ideas

• Declare default token permissions as read-only or empty, then grant narrow job-level permissions.
• Concurrency groups prevent stale pull-request checks or overlapping deployments from wasting capacity.
• Timeouts and cancellation keep hung builds from occupying runners.
• Clear job names, step summaries, annotations, retained logs, and diagnostic artifacts reduce recovery time.

How it works

Measure queue duration, setup time, build time, cache effectiveness, and flaky failure rate. Parallelize independent jobs, cache only deterministic dependencies, and avoid installing tools already present when the pinned version is acceptable. Reliability gains usually outweigh micro-optimizations.

Configuration example

name: Production delivery
on:
  push:
    branches: [main]
permissions:
  contents: read
concurrency:
  group: deploy-production
  cancel-in-progress: false

jobs:
  deploy:
    timeout-minutes: 20
    environment: production
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - run: ./scripts/deploy.sh

Read the example from top to bottom: the trigger creates a run, the job requests a runner, and each step receives only the context configured for it. Adapt names, versions, permissions, and commands to the repository rather than copying production credentials or policies blindly.

Production guidance

• Pin action dependencies, review automated upgrades, and inventory workflow permissions.
• Use branch protection and required checks for the validation contract.
• Keep deployment idempotent, record the deployed revision, and rehearse rollback.

The chapter quiz follows this lesson and checks both the vocabulary and the operational decisions behind the configuration.