Generate GitHub Actions CI/CD workflows for Node.js, Python, Docker, testing, deployment. YAML validation, best practices, secrets management. Copy-paste ready.
Use this free online GitHub Actions Generator directly in your browser. No signup required, no data leaves your device. Part of Utilier — a collection of 133+ developer utilities.
What is GitHub Actions Workflow Generator & Validator?
GitHub Actions is GitHub's built-in CI/CD platform for automating build, test, and deployment workflows. This tool generates GitHub Actions YAML workflows for common scenarios — Node.js testing, Python testing, Docker build, deployment to AWS/Vercel/Netlify, release automation. Select workflow type, configure triggers (push, pull_request, schedule), jobs, steps, and copy the YAML to .github/workflows/ in your repo. Validates YAML syntax, checks for security issues (hardcoded secrets), and suggests best practices (caching, matrix builds).
Workflow templates: Pre-built workflows: Node.js CI (npm test, lint), Python CI (pytest, black), Docker build/push, deploy to cloud (AWS, Vercel, Netlify), release (semantic-release, changelog), cron jobs.
Trigger configuration: Set when workflow runs: push (on commits), pull_request (on PR), workflow_dispatch (manual), schedule (cron), release (on new release). Multi-branch support (main, dev, feature/*).
Jobs and steps: Define jobs (build, test, deploy), each with steps (checkout code, setup Node.js, run tests, upload artifacts). Jobs run in parallel or sequentially (depends_on).
Writing GitHub Actions workflows manually requires knowledge of YAML syntax, action names, secrets, caching, and matrix builds. This tool generates workflows with best practices.
Avoid syntax errors: YAML is indentation-sensitive. Missing spaces, wrong alignment, or tabs break workflows. Tool validates syntax and catches errors before commit.
Discover actions: GitHub Actions ecosystem has 1000s of actions (actions/checkout, actions/setup-node, docker/build-push-action). Hard to remember all. Tool suggests common actions.
Learn workflow structure: See how on, jobs, steps, env, secrets work together. Great for learning GitHub Actions syntax and CI/CD concepts.
Save time: No need to search GitHub docs for action syntax or workflow examples. Tool generates production-ready workflows instantly.
Security best practices: Tool uses secrets correctly (secrets.API_KEY, not hardcoded). Suggests least-privilege permissions (contents: read, not write unless needed).
Caching and matrix builds: Enables caching (npm, pip, cargo) for faster builds. Supports matrix builds (test Node.js 18, 20, 22 in parallel).
When to use GitHub Actions generator
Use whenever you need to automate CI/CD workflows on GitHub repositories.
Setting up CI for Node.js, Python, Java, Go, or Rust projects (test on push, PR).
Automating Docker build and push to Docker Hub or GitHub Container Registry.
Deploying to cloud (AWS Lambda, Vercel, Netlify, GitHub Pages) on push to main.
Running tests on multiple Node.js/Python versions (matrix builds).
name: Node.js CI
on: [push]
jobs: build: runs-on: ubuntu-latest strategy: matrix: node-version: [18, 20, 22] steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: ${{ matrix.node-version }} - run: npm ci - run: npm test
Runs 3 parallel jobs (Node.js 18, 20, 22). Each job runs checkout, setup, install, test. Matrix tests compatibility across versions.
Cron job (nightly tests)
Type: Cron, Schedule: '0 0 * * *' (daily at midnight UTC), Job: run tests
name: Nightly Tests
on: schedule: - cron: '0 0 * * *'
jobs: test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: npm ci - run: npm test
Runs daily at midnight UTC. Useful for nightly builds, dependency health checks, or scheduled tasks. Cron syntax: '0 0 * * *' = midnight daily.
Technical reference
GitHub Actions workflow structure and syntax:
Workflow file location
.github/workflows/*.yml or *.yaml. GitHub automatically detects files in this directory. Example: .github/workflows/ci.yml, .github/workflows/deploy.yml.
on (triggers)
When workflow runs. push (on commits), pull_request (on PR), workflow_dispatch (manual), schedule (cron), release (on new release). Example: on: [push, pull_request]
jobs
Define jobs (build, test, deploy). Each job runs on a runner (ubuntu-latest, windows-latest, macos-latest). Jobs run in parallel unless depends_on is set. Example: jobs: build: runs-on: ubuntu-latest
steps
Actions or commands in a job. uses: for actions (actions/checkout@v4), run: for shell commands (npm test). Example: - uses: actions/checkout@v4 - run: npm install
secrets
Sensitive data (API keys, tokens). Reference: ${{ secrets.API_KEY }}. Add in repo Settings > Secrets and variables > Actions. Never hardcode secrets in YAML.
env
Environment variables. Set at workflow, job, or step level. Example: env: NODE_ENV: production. Access in scripts: echo $NODE_ENV.
matrix
Run job across multiple configurations. Example: matrix: node-version: [18, 20, 22]. Creates 3 parallel jobs (Node.js 18, 20, 22).
Set token permissions for GITHUB_TOKEN. Default: read. Set contents: write for commits, packages: write for Docker push. Example: permissions: contents: read
artifacts
Upload build artifacts (logs, test reports, binaries). actions/upload-artifact stores files, actions/download-artifact retrieves in later jobs. Example: - uses: actions/upload-artifact@v4 with: name: coverage path: coverage/
Common mistakes to avoid
Hardcoding secrets (API_KEY=abc123) instead of using ${{ secrets.API_KEY }}
Why it happens: Hardcoded secrets are visible in YAML (public repo = exposed secrets, private repo = visible to collaborators). GitHub scans for leaked secrets but may miss patterns. Common for beginners who don't know about repo secrets.
How to avoid it: Add secrets in repo Settings > Secrets and variables > Actions. Reference in YAML: ${{ secrets.API_KEY }}. Never hardcode. For forks, use environments (requires approval).
Not caching dependencies, causing slow builds (5-10 minutes every time)
Why it happens: Without caching, npm install or pip install re-downloads all dependencies every run (slow, wastes GitHub Actions minutes). Caching reduces install time from 5 min to 10 sec. Common oversight for new users.
How to avoid it: Add actions/cache for npm, pip, or cargo. Example: - uses: actions/cache@v4 with: path: ~/.npm key: ${{ runner.os }}-node-${{ hashFiles('package-lock.json') }}. Tool auto-adds caching.
Using actions/checkout@v1 or actions/setup-node@v1 (deprecated, insecure)
Why it happens: Old action versions (v1, v2) are deprecated and may have security vulnerabilities (Node.js 12 end-of-life). GitHub warns about outdated actions. Common in old workflows or copy-pasted examples.
How to avoid it: Use latest versions: actions/checkout@v4, actions/setup-node@v4. Check GitHub Marketplace for current versions. Tool uses latest by default.
Not setting permissions, granting excessive write access to GITHUB_TOKEN
Why it happens: Default GITHUB_TOKEN has write permissions (can commit, create releases). If workflow is compromised, attacker can push malicious code. CIS GitHub Actions benchmark requires least-privilege permissions.
How to avoid it: Set permissions: contents: read (read-only) unless write is needed. For commits: contents: write. For Docker push: packages: write. Minimize scope.
Running workflows on every push (including drafts), wasting GitHub Actions minutes
Why it happens: Trigger on: [push] runs on every commit to every branch (including WIP branches, draft PRs). This wastes free minutes (2000/month for free plan). Common when using default templates without customization.
How to avoid it: Limit triggers: on: push: branches: [main, dev]. Or use pull_request only. Avoid running on every branch. Save minutes for important builds.
Frequently asked questions
Where do I put GitHub Actions workflow files?
.github/workflows/ directory in repo root. Example: .github/workflows/ci.yml. GitHub automatically detects and runs workflows in this directory.
How do I add secrets (API keys, tokens) to workflows?
Repo Settings > Secrets and variables > Actions > New repository secret. Add NAME and VALUE. Reference in YAML: ${{ secrets.NAME }}. Never hardcode secrets.
What is the difference between push and pull_request triggers?
push runs on commits (every git push). pull_request runs on PR creation/update. Use pull_request for code review checks, push for deployment workflows.
How do I test across multiple Node.js or Python versions?
Use matrix builds. Example: strategy: matrix: node-version: [18, 20, 22]. Creates 3 parallel jobs (one per version). Each job runs all steps with different versions.
What is actions/cache and why use it?
actions/cache caches dependencies (node_modules, pip cache) between runs. Reduces install time from 5 min to 10 sec. Saves GitHub Actions minutes. Always enable caching for npm, pip, cargo.
How do I manually trigger a workflow?
Add workflow_dispatch trigger: on: workflow_dispatch:. Then go to repo > Actions > select workflow > Run workflow. Useful for manual deployments or testing.
What are GitHub Actions free tier limits?
Free plan: 2000 minutes/month (public repos unlimited). Private repos use minutes. Windows/macOS runners use 2x-10x minutes. Monitor usage in Settings > Billing.