Five GitHub Actions workflows worth adding to your repos

Writing tests and automations often takes a back seat to shipping features — it’s easy to put off, and it’s rarely the most exciting part of a project. But with GitHub Actions, a lot of the setup is already done for you. Thousands of pre-built, community-maintained actions cover everything from code quality and security to visual testing and release management, and you can plug them into your own workflows or customize them as needed. Here are five automations that give you solid coverage without much effort.

Run CodeQL to catch vulnerabilities early

Nobody wants to discover their project’s security flaws are trending on Hacker News. Manually auditing code and advisory feeds for zero-days is time-consuming, though. CodeQL, GitHub’s semantic analysis engine, automates the scan: it runs security checks against a repository’s code, identifies known vulnerabilities across languages and packages, and surfaces the results in the repository’s security tab. A pre-built GitHub Action makes this a matter of adding a workflow that runs on pull requests and merges. It’s a straightforward way to keep vulnerabilities from slipping through until someone else finds them.

Make npm test part of your workflow

npm test is a familiar command for JavaScript projects, but its real strength lies in the flexibility of the package.json file. You can wire it up to run whatever scripts you need — accessibility checks, unit tests, link validation, or anything else. For example, a common setup runs clean and node scripts, then updates the jest snapshot to keep things current:

"scripts": {
"test": "npm run clean && node scripts/test.js --env=jsdom --updateSnapshot",
}

Green tests give you the confidence to push to production, but the script can cover more than just basics. Some useful additions include:

  • Accessibility tests to confirm all HTML elements have the proper aria attributes (a guide for React with jest-axe is available).
  • Link checks to catch 404s (a GitHub Actions workflow for this is available).
  • UI component unit tests to verify button behavior, often via Playwright.

See your UI with automated visual tests

It’s easy to focus on functionality and ship a build that’s missing a critical UI element — sometimes literally a login button. Automated visual testing takes your code, deploys it to a test environment, and lets you interact with what was built. A tool like Cypress, which is open source and available as a pre-built GitHub Action, integrates directly into your testing cycle. It runs a headless browser so you can verify that everything looks the way it should, while providing real-time logs.

Check performance with Lighthouse

Performance regressions often sneak in silently after a code change, dragging down SEO and user experience. Lighthouse, the open-source tool from Google, audits page quality across accessibility, performance, progressive web app criteria, SEO, and more. It’s available from Chrome DevTools, as a Node module, from the command line, or as a GitHub Marketplace action that can run straight in your CI pipeline — the CLI option works in a workflow as well. Sanctioned by the Google Chrome team, this is one of those automations that not everyone runs, but should.

Automate releases and release notes

Writing release notes and manually cutting a release can take time away from the actual work. The latest version of GitHub Releases, in general beta since 2021, supports auto-generated release notes and automated releases. Getting set up involves adding two pre-built workflows to your CI pipeline:

  1. Create Release — this workflow builds the GitHub release and publishes it to npm.
  2. Bump Version — run this as a standalone workflow after squashing and merging a release request.

Bump Version increments the version using npm and pushes the new tag to the repository. That tag then triggers Create Release, which generates the changelog, creates the GitHub release, and publishes to npm. It’s a simple way to cut versions and keep the release process consistent.

The takeaway

There’s no shortage of automations available, but many teams are still only scratching the surface. Adding a few workflows for security scanning, testing, visual checks, performance, and releases can handle the routine parts of code quality and delivery — so you can catch problems before users do, and push code confidently.