8 GitHub Actions Patterns Every Node.js Developer Should Know

I started this project because I wanted to actually understand GitHub Actions — not just copy workflows from Stack Overflow. So I built 8 patterns from scratch, one per day, and documented every mistake I made along the way.

Pattern 1 — Basic CI

The foundation. Runs on every push, installs dependencies, runs tests, builds the project. The key insight: use npm ci not npm install. It uses your lockfile exactly and fails if lockfile is out of sync.

Also: --passWithNoTests --watchAll=false are essential Jest flags in CI. Without --watchAll=false, Jest watches for changes and the process never exits.

Pattern 2 — Dependency Caching

One line change: cache: 'npm' in the setup-node step. GitHub hashes your package-lock.json and restores cached node_modules if nothing changed. 45 seconds → 12 seconds on cache hit.

- uses: actions/setup-node@v4
  with:
    node-version: '22'
    cache: 'npm'  # ← this one line

Pattern 3 — Matrix Testing

Test on Node 18, 20, and 22 simultaneously. Three parallel jobs, one workflow definition.

strategy:
  matrix:
    node-version: [18, 20, 22]
  fail-fast: false  # see all results even if one fails

Pattern 4 — GitHub Pages Auto-Deploy

The CI: false flag stops Create React App from treating warnings as errors. The concurrency block prevents out-of-order deployments if you push twice quickly. Permissions pages: write and id-token: write are mandatory — without them you get a confusing 403.

Pattern 5 — PR Automation

Auto-labels PRs by file type (workflows, source-code, tests, documentation) and size (XS to XL). Posts a statistics comment with additions, deletions, and files changed. Detects and updates existing comments instead of posting duplicates.

Pattern 6 — PR Status Comments That Always Post

The key: if: always() on the comment job. Without it, the comment is skipped when tests fail — exactly when you need it most. needs.test.result gives you the outcome of the upstream job.

Pattern 7 — Scheduled Security Audits

Runs every Monday at 9 AM via cron. Creates or updates a GitHub issue when critical vulnerabilities are found. Smart issue management — one issue per period, updated weekly, not a new issue every Monday.

schedule:
  - cron: '0 9 * * 1'  # Every Monday

Pattern 8 — Release Automation

Push a feat: commit and the workflow bumps the minor version, generates a changelog from commit messages, creates a GitHub release. The [skip ci] in the version bump commit prevents infinite loops. paths-ignore on markdown files also helps.