Skill: GitHub Actions CI/CD

Capability Domain: DevOps / CI-CD
Technology Stack: GitHub Actions, OIDC
Linked Activities: Deploy via GitHub Actions

Skip when

Lake Scope Contract ci is not github_actions.

Recipe

1. Workflows already live in the starter kit: .github/workflows/deploy.yml on push to main (and workflow_dispatch). permissions: { id-token: write, contents: read }. Do not invent a second pipeline in the clone.
2. Assume AWS role via aws-actions/configure-aws-credentials with OIDC. No AWS_ACCESS_KEY_ID secret.
3. Steps: pytest (pandas in root requirements.txt if Streamlit unit tests import it) → cdk deploy --all --require-approval never. Print stack outputs to $GITHUB_STEP_SUMMARY. IAM simulate-principal-policy smoke test that the Streamlit task role can s3:ListBucket/s3:GetObject on the curated bucket.
4. OIDC trust — both sub shapes. GitHub Actions ID tokens often emit repo:{org}@{ORG_ID}/{repo}@{REPO_ID}:ref:refs/heads/main, not only repo:{org}/{repo}:*. DeployStack must allow both. Template: starter infra/ops_lake/deploy_stack.py.
5. Chicken-and-egg: laptop cdk bootstrap then one sandbox cdk deploy OpsLakeDeploy (or --all) to mint DeployRoleArn. Put that ARN in repo secret AWS_DEPLOY_ROLE_ARN. Thereafter shared env is GHA only.
6. A second workflow populate-lake.yml (STEP 2) fills data — do not confuse it with deploy. Secret for GitHub API: OPSLAKE_GITHUB_PAT (scopes repo, read:org). Never name a repo secret GITHUB_* — GitHub rejects that prefix. Template: starter .github/workflows/populate-lake.yml.

Copy-this: IAM trust conditions (DeployStack)

Trust token.actions.githubusercontent.com with:
- sub like repo:{org}/{lake_repo}:* and
- sub like repo:{org}@*/{lake_repo}@*:*
- aud = sts.amazonaws.com

Pitfalls

• Trusting only repo:org/repo:* — AssumeRoleWithWebIdentity fails on ID-qualified sub.
• Naming secrets GITHUB_TOKEN / GITHUB_PAT.
• Triggering deploy on every branch.
• Standing up GitLab CI in the same account.
• Laptop cdk deploy to the shared account after OIDC exists.