GitHub Actions là gì? Cấu trúc của một workflow file?

GitHub Actions là CI/CD platform tích hợp trong GitHub, trigger bởi events (push, PR, schedule, workflow_dispatch).

• Workflow YAML trong .github/workflows/ với cấu trúc: on (triggers), jobs (chạy parallel mặc định, dùng needs: để sequential), steps (actions hoặc run commands).
• Matrix strategy: chạy job với nhiều combinations — matrix: { node: [18, 20], os: [ubuntu-latest, windows-latest] } tạo 4 parallel jobs tự động; dùng để test cross-platform/cross-version.
• Caching: actions/cache để cache node_modules, build artifacts — key dựa trên hash của package-lock.json để invalidate khi dependencies thay đổi; significant speedup cho install steps.
• Secrets: lưu trong GitHub repo/org Settings → Secrets, access bằng ${{ secrets.MY_SECRET }} — không bao giờ log secrets.
• Reusable workflows: workflow A có thể call workflow B với uses: ./.github/workflows/shared.yml — tránh duplicate CI logic across repos.
• Self-hosted runners: chạy Actions trên máy chủ riêng — tiết kiệm cost cho large workloads, access internal resources, custom hardware (GPU, ARM).
• OIDC tokens: GitHub Actions có thể auth với AWS/GCP/Azure mà không cần long-lived credentials — best practice cho cloud deployments.
• Environments với required reviewers: production deployment cần approval từ reviewer trước khi proceed.

GitHub Actions is a CI/CD platform integrated into GitHub, triggered by events (push, PR, schedule, workflow_dispatch).

• Workflow YAML lives in .github/workflows/ with the structure: on (triggers), jobs (run in parallel by default, use needs: for sequential), steps (actions or run commands).
• Matrix strategy: run a job with multiple combinations — matrix: { node: [18, 20], os: [ubuntu-latest, windows-latest] } automatically creates 4 parallel jobs; used to test across platforms/versions.
• Caching: actions/cache to cache node_modules and build artifacts — the key is based on a hash of package-lock.json so it invalidates when dependencies change; significant speedup for install steps.
• Secrets: stored in GitHub repo/org Settings → Secrets, accessed via ${{ secrets.MY_SECRET }} — never log secrets.
• Reusable workflows: workflow A can call workflow B with uses: ./.github/workflows/shared.yml — avoids duplicate CI logic across repos.
• Self-hosted runners: run Actions on your own servers — saves cost for large workloads, access to internal resources, custom hardware (GPU, ARM).
• OIDC tokens: GitHub Actions can authenticate with AWS/GCP/Azure without long-lived credentials — best practice for cloud deployments.
• Environments with required reviewers: production deployment requires approval from a reviewer before proceeding.