GitHub Actions Tutorial: Automate Your Build and Deploy

What Is GitHub Actions?

GitHub Actions is a CI/CD platform built directly into GitHub. Every time you push code, open a pull request, or create a release, Actions can automatically run scripts — building your app, running tests, and deploying to production. Because PandaStack integrates exclusively with GitHub, Actions is the natural complement for a fully automated delivery pipeline.

Understanding Workflows, Jobs, and Steps

A GitHub Actions workflow is a YAML file stored in .github/workflows/. It contains one or more jobs, and each job is a sequence of steps. Steps can run shell commands or call reusable actions published on the GitHub Marketplace.

# .github/workflows/ci.yml
name: CI Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm test

      - name: Build application
        run: npm run build

Save that file, push to main, and GitHub automatically runs the pipeline. You can watch the progress under the Actions tab in your repository.

Adding Environment Variables and Secrets

Real applications need API keys, database URLs, and tokens — none of which should live in source code. GitHub Actions provides encrypted Secrets (Settings → Secrets and variables → Actions) and plain Variables for non-sensitive configuration.

      - name: Run integration tests
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          API_KEY: ${{ secrets.API_KEY }}
          NODE_ENV: test
        run: npm run test:integration

Secrets are masked in logs, so they never appear in plain text even if a step fails.

Caching Dependencies for Faster Builds

Installing node_modules from scratch on every run is slow. The cache input on setup-node (shown above) handles this automatically. For other package managers or build tools you can use the generic actions/cache action:

      - name: Cache build output
        uses: actions/cache@v4
        with:
          path: .next/cache
          key: ${{ runner.os }}-nextjs-${{ hashFiles('package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-nextjs-

With caching in place, subsequent runs skip the expensive install step and complete in a fraction of the time.

Matrix Builds: Test Across Multiple Versions

Use a matrix strategy to test your code against multiple Node.js or Python versions simultaneously without duplicating job definitions:

  test-matrix:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [18, 20, 22]

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
      - run: npm ci
      - run: npm test

GitHub runs all three jobs in parallel, cutting total test time significantly.

Deploying to PandaStack on Push

PandaStack watches your connected GitHub repository and auto-deploys whenever you push to the configured branch. That means your GitHub Actions pipeline and PandaStack's deployment system work together: Actions validates the code first, then PandaStack picks up the passing commit and deploys it.

To connect a repository, install the PandaStack CLI:

npm install -g @pandastack/cli
panda login
panda deploy --repo your-org/your-repo --branch main

From that point on, every push to main that passes your Actions checks triggers a fresh deployment on PandaStack — giving you a fully automated, end-to-end pipeline without any manual steps.

Best Practices

• Keep workflows focused — one workflow per concern (CI, deploy, release).
• Pin action versions with a full SHA for security-sensitive steps.
• Fail fast — put cheap checks (lint, type-check) before expensive ones (integration tests).
• Use concurrency groups to cancel outdated runs when a new push arrives.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

With these patterns in place you have a robust, fast, and secure CI/CD foundation ready to scale with your team.