How to Set Up a CI/CD Pipeline with GitHub Actions in 2025

Continuous Integration and Continuous Deployment (CI/CD) pipelines have become essential infrastructure for modern software teams. They automate the process of testing, building, and deploying code, reducing manual errors and accelerating delivery cycles. In this guide, you'll learn how to set up a CI/CD pipeline with GitHub Actions from scratch, even if you've never worked with automated workflows before.

GitHub Actions has emerged as one of the most popular CI/CD solutions because it's built directly into GitHub, requires no separate infrastructure, and offers generous free tier limits. Whether you're building a web application, API, or mobile backend, the principles we'll cover apply across the board.

What Is a CI/CD Pipeline?

A CI/CD pipeline is an automated workflow that takes your code from commit to production. Continuous Integration (CI) automatically tests and builds your code every time you push changes. Continuous Deployment (CD) takes it a step further by automatically deploying passing builds to staging or production environments.

The benefits are substantial. Teams that implement CI/CD pipelines deploy code up to 200 times more frequently than those relying on manual processes, while maintaining better stability and quality. You catch bugs earlier, reduce integration headaches, and ship features faster.

Understanding GitHub Actions Basics

GitHub Actions uses YAML files stored in your repository's .github/workflows directory. Each workflow file defines when to run (triggers), what environment to use (runners), and what steps to execute (jobs).

Here are the core concepts:

Workflows: Automated processes defined in YAML files Events: Triggers that start workflows (push, pull request, schedule, etc.) Jobs: Sets of steps that run on the same runner Steps: Individual tasks like running commands or using actions Actions: Reusable units of code that perform common tasks Runners: Servers that execute your workflows (GitHub-hosted or self-hosted)

Setting Up Your First CI Pipeline

Let's build a practical CI pipeline for a Node.js application. This example tests and builds your code automatically on every push and pull request.

First, create the workflow file in your repository:

mkdir -p .github/workflows
touch .github/workflows/ci.yml

Now add this configuration to ci.yml:

name: CI Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

jobs:
  test:
    runs-on: ubuntu-latest
    
    strategy:
      matrix:
        node-version: [18.x, 20.x]
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Set up Node.js ${{ matrix.node-version }}
      uses: actions/setup-node@v4
      with:
        node-version: ${{ matrix.node-version }}
        cache: 'npm'
        
    - name: Install dependencies
      run: npm ci
      
    - name: Run linter
      run: npm run lint
      
    - name: Run tests
      run: npm test
      
    - name: Build application
      run: npm run build

This workflow triggers on pushes to main or develop branches and on pull requests to main. It tests your code against multiple Node.js versions using a matrix strategy, ensuring compatibility.

Key points about this configuration:

• actions/checkout@v4 clones your repository code
• actions/setup-node@v4 installs Node.js and caches npm dependencies for faster runs
• npm ci provides faster, more reliable installs than npm install in CI environments
• The matrix strategy runs all steps for both Node.js 18 and 20

Adding CD: Automated Deployment

Once your CI pipeline is working, you can extend it with deployment steps. Here's how to add automated deployment to a hosting platform like Vercel or AWS:

name: CI/CD Pipeline

on:
  push:
    branches: [ main ]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version: '20.x'
        cache: 'npm'
    - run: npm ci
    - run: npm test
    - run: npm run build
    
  deploy:
    needs: test
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Deploy to production
      env:
        DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
      run: |
        npm install -g vercel
        vercel --prod --token=$DEPLOY_TOKEN

This configuration only deploys when tests pass (needs: test) and only from the main branch. The deployment token is stored securely in GitHub Secrets, not in your code.

Configuring Secrets and Environment Variables

Never hardcode sensitive credentials in your workflow files. GitHub provides encrypted secrets for this purpose.

To add secrets:

1. Go to your repository Settings
2. Navigate to Secrets and variables > Actions
3. Click "New repository secret"
4. Add your secret name and value

Access secrets in workflows using the ${{ secrets.SECRET_NAME }} syntax. Common secrets include:

• API keys and tokens
• Database connection strings
• SSH keys
• Cloud provider credentials
• Third-party service credentials

For non-sensitive configuration, use environment variables:

env:
  NODE_ENV: production
  API_URL: https://api.example.com

Best Practices for Production Pipelines

Use caching aggressively: Cache dependencies, build artifacts, and Docker layers to speed up runs. The actions/cache action or built-in caching in setup actions saves significant time.

Fail fast: Run quick tests before expensive operations. Lint and unit tests should run before integration tests or builds.

Separate CI and CD: Keep testing and deployment as separate jobs. This gives you flexibility to deploy manually or on a schedule if needed.

Use matrix builds sparingly: Testing against multiple versions is valuable, but too many combinations slow down feedback. Focus on versions you actually support.

Set timeouts: Prevent hung jobs from consuming runner minutes:

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 10

Monitor workflow runs: Review failed runs promptly. GitHub sends notifications, but setting up Slack or email alerts ensures visibility.

Keep workflows DRY: Use reusable workflows or composite actions for repeated logic across multiple pipelines.

Troubleshooting Common Issues

Workflows not triggering: Check your event filters. A workflow with on: push: branches: [main] won't run on feature branches.

Intermittent failures: Network issues or flaky tests cause problems. Add retry logic for external service calls and fix non-deterministic tests.

Slow pipelines: Profile your workflow. Usually dependencies installation or test suites are the culprits. Parallelize jobs, use caching, and optimize test execution.

Permission errors: GitHub Actions needs explicit permissions for certain operations. Add a permissions block:

permissions:
  contents: read
  packages: write

Secret not found: Secrets are environment-specific. Make sure you've added the secret to the right repository or organization, and that it's spelled exactly as referenced in the workflow.

Advanced Patterns

Once you're comfortable with basic pipelines, consider these advanced patterns:

Multi-environment deployments: Deploy to staging automatically, production manually using workflow dispatch or approval gates.

Monorepo support: Use path filters to run jobs only when relevant files change:

on:
  push:
    paths:
      - 'api/**'
      - 'packages/shared/**'

Docker integration: Build and push images as part of your pipeline using docker/build-push-action.

Scheduled runs: Run security scans, backups, or reports on a schedule using cron syntax:

on:
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM UTC

Next Steps

You now have a solid foundation for building CI/CD pipelines with GitHub Actions. Start with a simple workflow that runs tests, then gradually add deployment, notifications, and more sophisticated patterns as your needs grow.

The key is to iterate. Don't try to build the perfect pipeline on day one. Ship a basic workflow, observe where it helps and where it slows you down, then refine. Over time, you'll develop a deployment process that gives you confidence to ship code multiple times per day.

Building robust DevOps practices takes expertise and experience. If you're looking to implement CI/CD pipelines or improve your deployment infrastructure, Stardelite helps teams build reliable, automated workflows that accelerate delivery without sacrificing quality.