23 production-ready GitHub Actions workflows for Node, Next.js, Python, PHP, Go, Rust and Docker. Least-privilege permissions on every one, actions pinned to verified releases, caching that is correct rather than copied. Zero actionlint errors.
Most CI configs are copied from a blog post and never read again. They run every action off @master. They leave the default GITHUB_TOKEN — which in most repositories can push commits and publish packages — wide open to every third-party action in the job. They cache node_modules, which goes stale across Node versions. They start tests against a Postgres container before Postgres accepts connections, and everyone learns to hit retry.
The GitHub Actions Workflow Pack is 23 workflows written the other way round: each one is a file you can read top to bottom, drop into .github/workflows/, change two lines in, and have working the same day.
workflow_call with typed inputs, an optional secret and an output consumed downstream — and a straight answer on which of the two to reach for.permissions: on all 23. This is the single most common real-world GitHub Actions mistake. Declaring the block replaces the repository default wholesale, so anything unlisted is none. Where a job genuinely needs to write — a release, a GHCR push — the elevation is on that job alone, and the comment says which scope buys what.@master, and every pin verified: the tag exists, and every input and output used is declared in that action's own action.yml at that exact version. Includes the one-command conversion to immutable commit SHAs.cache: npm caches the download cache and not node_modules, and the file says why. The Go workflow does not stack a redundant actions/cache on top of what setup-go already does. Rust's cache is restored after the toolchain is selected, because it keys on the rustc version. Composer's cache directory is read from composer config rather than hardcoded.concurrency: on 22 of 23 — CI cancels superseded runs; releases and Pages deployments deliberately do not, because cancelling a publish halfway is worse than waiting.pull_request_target is what makes fork labelling work and also how you hand a write token to a stranger's branch. Why a ${{ }} expression inside a run: block is a script injection waiting for a hostile PR title. Why secrets does not work in a step-level if:, and the one-line lift that fixes it.actionlint 1.7.12 — including shellcheck over every run: block — reports 0 errors across all 23 files. All 25 YAML files parse. All 27 action references were checked against the live GitHub API before release. The exact command to reproduce that check yourself is in the README.
Engineers setting up CI on a new repo, or inheriting one where the workflows were pasted in and never reviewed. Especially useful if you ship across several stacks — the permission model, pinning discipline and concurrency rules are the same in all 23 files, so reading two of them teaches you the pattern for the rest.
20 of the 23 work on any repository, public or private, on the free plan. Three depend on GitHub's code scanning platform — codeql.yml, dependency-review.yml and docker-scan-trivy.yml — which is free on public repositories and requires GitHub Advanced Security on private ones. Each of those three says so in its header comment, because without it they fail with a 403 that reads like a configuration error and is not.
Two, and only if you use the workflows that need them. npm-publish.yml needs NPM_TOKEN. secret-scan-gitleaks.yml needs GITLEAKS_LICENSE, and only for repositories owned by an organisation — personal accounts do not need one, and the key is free either way. Everything else, including the GHCR push and the GitHub Release, authenticates with the built-in GITHUB_TOKEN. The workflow index lists the secrets for every file in one table.
Every one was checked against the GitHub API on the release date, and each is pinned to a specific released tag — actions/checkout@v7.0.1, docker/build-push-action@v7.3.0, and so on. The full list is in the workflow index and the changelog. The README also shows how to convert the whole set to immutable commit SHAs with one pinact command, and how to add a dependabot.yml so the pins stay current on their own.
They are statically verified, and the README tells you exactly how so you can repeat it: actionlint 1.7.12 reports 0 errors across all 23 files, which includes running shellcheck over every run: block; all 25 YAML files parse; and every action reference was resolved against the live GitHub API to confirm the tag exists and that every input and output used is declared in that action's own action.yml at that version. What that cannot check is your project — a workflow cannot know whether your test script is called test or spec, so each header tells you which lines to change.
Because it is the most common serious mistake in real repositories. In a repo left on the permissive default, the GITHUB_TOKEN handed to every job — and to every third-party action inside it — can push commits, edit issues and publish packages. Declaring a permissions: block replaces that default wholesale, so anything you do not list is set to none. All 23 workflows declare one, and where a job genuinely needs to write, the elevation is scoped to that job and the comment explains what each scope is for.
Yes. The commercial license covers unlimited personal projects, internal company projects and unlimited client work, including committing the workflow files into public open-source repositories where they will be visible. The one thing you cannot do is resell the pack itself, or repackage it as your own template repository or course material.
Probably, in one of two ways. Either you take a specific workflow you do not have yet — the GHCR publish with provenance, the reusable-workflow pattern, the service-container setup — or you read two of the CI files and apply the permission, pinning and caching discipline to the workflows you already run. The header comments are written to be read, not skimmed past: they name the failure mode each step exists to prevent.
Email hello@buycoded.com with the workflow name and the run log. If it is a real defect we fix it, reissue, and you re-download from your account at no cost. There is also a 14-day no-questions refund if the pack does not deliver.
8 production-grade Dockerfiles and 5 ready-to-run Compose stacks. Every Dockerfile is multi-stage, non-root, healthchecked, cache-ordered and pinned — hadolint-clean and actually built, with measured image sizes (Go: 16.0 MB, Rust: 37.9 MB, static+nginx: 72.2 MB). Node/TS, Next.js standalone, FastAPI, Django, PHP-FPM+nginx, Go, Rust, static. Each ships a sample app so `docker build .` works before you change anything.
25 professionally designed PDF cheat sheets — Cursor, Claude Code, Copilot, Windsurf, and the modern dev stack. Print them, pin them, ship faster.