HomeCasa Prompts

GitHub Actions CI/CD pipeline

Create a GitHub Actions workflow for lint, test, build and environment-based deploys, with caching, secure secrets and manual production approval. Designed for ChatGPT, Claude and Microsoft Copilot. It includes 7 customizable variables and you can copy it for free in one click.

Intermediate · Code · Pending editorial review

Designed for:

Prompt

Act as a DevOps engineer who specializes in GitHub Actions and fast, secure pipelines.

Project: {{project}}.
Stack and package manager: {{stack}}.
Current commands: lint `{{lint_cmd}}`, test `{{test_cmd}}`, build `{{build_cmd}}`.
Deployment target: {{deploy_target}}.
Branching strategy: {{branching}}.

Deliver, in this order:
1. A text diagram of the pipeline: which jobs run on pull requests, on pushes to the main branch and on release tags, and which run in parallel.
2. The complete `.github/workflows/ci.yml` file with:
   - `concurrency` to cancel outdated runs.
   - Dependency caching and pinned action versions (ideally by SHA).
   - Least-privilege `permissions` per job.
   - A version matrix only where it adds value.
   - The build artifact uploaded and reused by the deploy job.
3. A deploy workflow or job using `environments` (staging and production), manual approval for production, and OIDC authentication instead of long-lived keys when the provider supports it.
4. The list of required secrets and variables and where to configure them. Never write real values: use [FILL IN].
5. Recommended branch protection rules and required checks.
6. How to cut pipeline time and how to roll back.

Constraints:
- Comment the non-obvious parts of the YAML.
- If any deployment detail is unclear, ask me instead of assuming.

How to use it

  1. Copy the real commands you run locally for lint, test and build.
  2. Say where you deploy (Vercel, AWS, a VPS, Fly.io…).
  3. Save the YAML in .github/workflows/ and add the secrets under Settings → Secrets and variables.
  4. Open a test pull request to verify the pipeline before turning on branch protection.

Usage example

Project: Node.js API with PostgreSQL · Stack: Node 22 with pnpm · Deploy: container on AWS ECS · Branches: main plus feature branches.

Sample output

1. Diagram

PR ──► lint ─┐
             ├─► build (Docker image)
PR ──► test ─┘
push main ──► lint + test ─► build ─► deploy staging ─► [approval] ─► deploy production

2. .github/workflows/ci.yml (jobs excerpt)

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read            # least privilege
    services:
      postgres:                 # throwaway database for tests only
        image: postgres:16
        env: { POSTGRES_PASSWORD: postgres }
        ports: ['5432:5432']
        options: --health-cmd pg_isready --health-interval 5s --health-retries 10
    steps:
      - uses: actions/checkout@v4          # pin by SHA: [FILL IN]
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint
      - run: pnpm test
        env:
          DATABASE_URL: postgres://postgres:postgres@localhost:5432/postgres
      - run: pnpm build
      - uses: actions/upload-artifact@v4   # reused by the deploy job
        with: { name: dist, path: dist/ }

AWS authentication will use OIDC (id-token: write only on the deploy job) with an IAM role: role ARN [FILL IN], region [FILL IN], ECS cluster and service names [FILL IN]…

Key facts

Category
Programming & development · DevOps
Output type
Code
Level
Intermediate
Designed for
ChatGPT, Claude and Microsoft Copilot
Verified in
Pending editorial verification
Variables
Project, Stack and package manager, Lint command, Test command, Build command, Deployment target and Branching strategy
Language
English
Price
Free, no sign-up
Updated
Nov 7, 2026

Frequently asked questions

Why pin actions by SHA?

A tag like v4 can be moved to point at different code. Pinning the SHA protects you from unexpected changes or a compromised action. Dependabot can keep those SHAs updated for you.

What is OIDC and why should I use it?

It lets GitHub request short-lived credentials from your cloud provider on every run, so you never store permanent access keys as repository secrets.

What is this prompt for?

Create a GitHub Actions workflow for lint, test, build and environment-based deploys, with caching, secure secrets and manual production approval.

Which AI tools does it work with?

It is designed for ChatGPT, Claude and Microsoft Copilot. We have not verified it in these tools yet, so results may vary between them.

How do I customize the prompt?

Click “Customize” and fill in the variables (Project, Stack and package manager, Lint command, Test command, Build command, Deployment target and Branching strategy). The text updates instantly and you can then copy it in one click. Values are stored only in your browser.

Do I need experience to use it?

It is intermediate: it helps to know the topic so you can provide good context and review the result critically.

Is this prompt free?

Yes. Every HomeCasa Prompts prompt is free, with no sign-up or subscription. You can also use them in professional projects.

Can I trust the AI output?

Treat it as a high-quality draft: always check data, figures and important claims before publishing or making decisions.

Related prompts