1. Introduction to GitHub Actions

Continuous Integration and Continuous Delivery

In software development, multiple team members develop code and contribute to creating the software’s functionality. When multiple people contribute to a code base, it is important to maintain its integrity and ensure that any team member can retrieve the latest version and build and run it locally.

Two important aspects should be maintained to assure the code base's stability. The first aspect is to ensure that the code is compiling without errors. The second aspect is to ensure that all unit tests validating code behavior pass, including the latest code changes, at a very high percentage.

A build pipeline should be defined to compile each check-in/commit to the code base and then execute all unit tests to validate the code base to ensure its stability; this is generally known as a CI build. If the build successfully compiles and all the unit tests pass, it generates and publishes output that is deployed to a target environment (see Figure 1-1).

Checking for code security vulnerabilities can be integrated into the build pipeline to improve a project/product’s security. The quality of the code can be validated in a build pipeline. Early detection of security vulnerabilities and code quality issues with a shift-left approach reduces costs in the long run because a vulnerability detected during production is costly to fix.

Development teams produce software in short cycles in modern, agile software development approaches. One of the biggest challenges is ensuring a software release’s reliability in target environments. A straightforward and reusable deployment process is essential in reducing the cost, time, and risks of delivering software changes, including incremental updates to an application in production. In a nutshell, continuous delivery ensures that software changes are delivered more frequently and reliably. DevOps has evolved as a product of continuous delivery.

Continuous delivery ensures that every change is deployed to production with the option to hold deployment until manual approval is given. Continuous deployment allows every change to be automatically deployed to production. To implement continuous deployment, you must have continuous delivery already in place. Continuous deployment is created by automating the approval steps in continuous delivery (see Figure 1-2).

Importance of Software Delivery Automation

Software delivery automation involves a few processes. Code compilation validation, code stability, quality, and security are covered in continuous integration. Integration and functional test automation verify that business needs are being met in software systems. Release or deployment automation delivers and manages deployment configurations automatically. Using infrastructure as code (IaC) and deploying infrastructure with automated pipelines offers a dynamic provisioning environment to a software team, essentially facilitating the agile process and enhancing the DevOps team’s capabilities.

Without software process automation, deploying software would be a challenging task. An Ops team would need to spend a lot of time manually setting up and deploying new environments. There would be a higher possibility of missed steps during setup, leading to a variety of unexpected issues that cost time and money to resolve. Setting up and deploying environments requires additional investment in human resources (see Figure 1-3 (data from IBM System Science Institute Relative Cost of Fixing Defects research gate)).

Skipping tests may result in bugs creeping into production, which would cost more money or cause client dissatisfaction and lead to legal action or harm your business reputation. And again, testing manually costs money and delays deliverables. There is a critical need for test automation to avoid additional costs and software delivery issues (see Figure 1-4 (data from https://qodestack.com/myths-of-test-automation/)).

Automating deployment and testing processes while identifying security and other software vulnerabilities with a shift-left approach is vital. Detecting vulnerabilities as early as possible (on the left side of process flow if possible) costs less money than to fix them.

Introduction to GitHub Actions

GitHub Actions are a set of actions in a GitHub repository workflow. These actions allow you to customize and execute software development workflows. You can create actions or utilize existing actions and create and customize workflows to perform any job or automate software development life cycle processes, including CI/CD.

Actions are individual tasks that can be combined to create a workflow. A workflow is one or more automated jobs with actions configured in a YAML file that can be stored in your GitHub repo. Let’s discuss each key concept in more detail.

Summary

This chapter looked at CI/CD concepts and the importance of automation in the software delivery process. It explored a few important key concepts in GitHub Actions to set the stage for the rest of the chapters in this book.

The next chapter starts using GitHub Actions by looking at preconfigured workflow templates and marketplace actions. You create a GitHub Actions workflow to build a .NET Core application. You learned about the structure of a workflow in this chapter and set up continuous integration with GitHub Actions in the next chapter.