GitHub Actions CI Pipeline for Node Projects

A CI pipeline catches broken builds before they reach main. Here is a minimal one for Node.

The workflow file

# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - run: npm ci
      - run: npm test
      - run: npm run build

Why npm ci not npm install

npm ci installs exactly what is in package-lock.json and fails if the lock file is out of date. No silent updates between runs.

Cache the node_modules

cache: npm in setup-node caches based on package-lock.json hash. Most runs skip the install step entirely.

Add a lint step

- run: npm run lint

Put it before test so style issues get caught before the slower test suite runs.

Matrix builds

Test across multiple Node versions with one change:

strategy:
  matrix:
    node: [18, 20, 22]
steps:
  - uses: actions/setup-node@v4
    with:
      node-version: ${{ matrix.node }}

Keep secrets out of logs

Use ${{ secrets.MY_TOKEN }} for API keys and tokens. Never echo a secret. GitHub masks known secret values but does not catch all leaks.