Fitur Advanced GitHub Actions

Foundations Recap

Sebelum masuk ke fitur advanced, pastikan kamu nyaman dengan fondasi workflow berikut:

# Triggers — kapan workflow dijalankan
on:
  push:                       # setiap push
    branches: [main]
    paths: ["src/**"]         # hanya jika path tertentu berubah
  pull_request:
    types: [opened, synchronize]
  workflow_dispatch:          # manual trigger dari UI
    inputs:
      environment:
        type: choice
        options: [staging, production]
  schedule:
    - cron: "0 2 * * *"      # daily 02:00 UTC

# Conditional execution dengan `if`
jobs:
  deploy:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - name: Deploy ke production
        if: ${{ !contains(github.event.head_commit.message, '[skip deploy]') }}
        run: ./deploy.sh

# Outputs — komunikasi antar job
jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.meta.outputs.tag }}
    steps:
      - id: meta
        run: echo "tag=v$(date +%s)" >> $GITHUB_OUTPUT

  deploy:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - run: echo "Deploying ${{ needs.build.outputs.image_tag }}"

# Environments — untuk protection rules (approval, secret scoping)
jobs:
  deploy-prod:
    environment:
      name: production            # config approval di GitHub Settings
      url: https://myapp.com
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh

OIDC: Auth ke AWS Tanpa Long-Lived Key

Daripada menyimpan AWS_ACCESS_KEY_ID statis di secrets (berisiko bocor), gunakan OpenID Connect. GitHub bertindak sebagai identity provider, AWS meng-assume role sementara per workflow run.

permissions:
  id-token: write      # wajib untuk OIDC
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/gha-deploy
          aws-region: ap-southeast-1
      - run: aws s3 sync ./dist s3://my-bucket/

Di sisi AWS, IAM role dikonfigurasi dengan trust policy yang hanya mempercayai repo tertentu. Tidak ada kredensial permanen yang bisa bocor dari log atau secrets store.

Matrix Strategy

Jalankan job di beberapa kombinasi environment sekaligus:

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [18, 20, 22]
        os: [ubuntu-latest, windows-latest]
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}

Job Dependencies

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - run: npm test

  deploy:
    needs: test            # tunggu test selesai
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh

Reusable Workflows

# .github/workflows/deploy-reusable.yml
on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
    secrets:
      deploy_key:
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - run: echo "Deploying to ${{ inputs.environment }}"

Custom Action

# action.yml
name: Setup My App
description: Install and configure
inputs:
  version:
    description: App version
    required: true
runs:
  using: composite
  steps:
    - run: echo "Setting up v${{ inputs.version }}"
      shell: bash

Artifacts & Outputs

- name: Upload build artifacts
  uses: actions/upload-artifact@v4
  with:
    name: build-output
    path: dist/

# Di job lain
- name: Download artifacts
  uses: actions/download-artifact@v4
  with:
    name: build-output