From push to production
Put it all together: lint, test on several Node versions, build once, and deploy that exact build — only from main, with a secret, after everything passed.
Sketch the pipeline
Draw the jobs and arrows before writing YAML. test fans out across a Node matrix. build needs test and uploads one artifact. deploy needs build, runs only for pushes to main, downloads the artifact and uses a secret. On pull requests the same file runs test and build, and deploy shows as skipped — exactly what you want.
- test — matrix [20, 22]: checkout, setup-node, npm ci, lint, test.
- build — needs test: npm ci, npm run build, upload dist as site.
- deploy — needs build, if: main push, environment production, concurrency group.
- Secrets only in deploy, via env on the deploy step.
Write and push the test job first, watch it go green, then add build, then deploy. Small steps make YAML mistakes easy to find.