GitHub Actions CI best practices

Speed up GitHub Actions checkout and reduce network transfer by letting actions/checkout fetch only the commit under test (its default fetch-depth: 1) instead of the whole git history.

Speed up GitHub Actions and cut runner minutes by scoping your slowest build/test job to only the packages a PR actually changed, using your monorepo tool's affected mode, with a mandatory full-run fallback so a resolution error never silently skips work.

Add a GitHub Actions concurrency group scoped to the ref and turn on cancel-in-progress for PR runs (it defaults to false), so a new push cancels the now-obsolete run instead of leaving both to occupy runners.

Right-size a GitHub Actions job by comparing the same commit on the current and smaller runner, then keep the smaller size only when pass rate and wall-clock remain equivalent.

Set timeout-minutes on every GitHub Actions job that executes on a runner, plus hang-prone steps, so a stuck run is cancelled in minutes instead of occupying a runner for up to the 360-minute default.

Poll the exact condition a test needs, stop as soon as it is true, and cap the wait with a diagnostic failure so fast runs do not pay a worst-case sleep and slow runs do not become flaky.

Give every service container a healthcheck that proves it can answer a real request, then start the stack with docker compose up -d --wait so the job blocks exactly until each service is ready.

Expose a GitHub Actions secret only to the step that consumes it, gate production secrets with an environment, prefer short-lived OIDC credentials, and keep credentials out of logs, command arguments, caches, and artifacts.

Use pull_request for any job that checks out, builds, installs, or tests contributor code; reserve pull_request_target for metadata-only work on trusted base-branch code with minimal permissions.

Keep untrusted code from writing cache entries that trusted release or deploy jobs restore, and cache inert dependency data rather than executable workspace state or credentials.

Reference every third-party action by its full 40-character commit SHA (with the version as a trailing comment), not a mutable @v4 tag or @main branch that its maintainer, or an attacker, can re-point.

In GitHub Actions, declare id-token: write in the specific publishing job's permissions: block, never at the workflow's top level, so an OIDC publish token isn't minted for jobs that run untrusted code.