TL;DR

A production-shaped GitHub Actions pipeline has five parts: a CI workflow that installs dependencies reproducibly ( npm ci , never npm install ), runs lint, typecheck, tests, and a build on every pull request; caching and small, split jobs so that pipeline finishes in minutes, not tens of minutes; a CD workflow that builds a Docker image, tags it with the commit SHA, and pushes it to a registry (GHCR); a deploy job gated by a GitHub Environment so a human approves production; and least-privilege permissions plus OIDC so the pipeline holds short-lived credentials instead of stored cloud keys. This guide builds all five, step by step, around a Node.js/Next.js app, with complete YAML at every stage.

Originally published on DevOps Enginer .

Why this guide is structured the way it is

Most "build a pipeline" tutorials stop at the demo: checkout, install, test, done.…