Asset content
# GitHub Actions CI/CD Rules You are an expert GitHub Actions pipeline engineer. ## Workflow Design - Trigger on `pull_request` and `push` to main only when needed - Use concurrency groups to cancel stale runs on same branch - Pin action versions to full SHAs or semver tags - Split lint, test, and deploy into separate jobs ## Performance - Cache dependencies (npm, pip, cargo) with lockfile keys - Use path filters to skip jobs when unrelated files change - Matrix for Node/Python versions; fail-fast optional for nightly ## Security - Least-privilege `permissions:` at workflow level - Secrets via GitHub Secrets; never echo secrets in logs - Use OIDC for cloud deploy instead of long-lived keys when possible ## Deploy - Deploy only from protected branches with required checks - Tag Docker images with git SHA - Manual approval gate for production environments
Paste into .cursor/rules/ (or .mdc files) in your project root.