GitHub Tips & Tricks

🎯Hands-on Guide

The Best Tips & Tricks for GitHub (A Practical, Modern Playbook)

From branch strategy and PR reviews to GitHub Actions, security, Pages, Projects, and power-user shortcuts—this comprehensive article gives you copy-ready snippets and checklists to level-up your GitHub workflow.

✅ For beginners → advanced 🧰 Works with Git & gh CLI 🔐 Security best practices ⚙️ CI/CD with Actions 📄 Markdown & Docs

Setup & Hygiene

• Repository Setup
• README, LICENSE, Templates
• .gitignore, LFS & Submodules
• CODEOWNERS & Protection

Collaboration

• Branching Strategies
• PRs & Code Reviews
• Issues, Labels, Milestones & Projects
• Discussions & Wiki

Automation & Delivery

• GitHub Actions: CI Basics
• Advanced Actions (Matrix, Cache, Reusable)
• GitHub Pages & Docs
• Releases & Changelogs

Security & Insights

• Security (Dependabot, Secrets, Policies)
• Insights, Analytics & Maintenance
• API, Webhooks & gh CLI
• Search, Markdown & Shortcuts

1) Repository Setup: Do it Right From Day 1

Initialize Locally

# Create repo
git init my-app && cd my-app

# Add remote
git remote add origin git@github.com:your-org/my-app.git

# First commit
echo "# My App" > README.md
git add .
git commit -m "chore: initial commit"
git push -u origin main

Essential Settings Checklist

• Default branch main, delete branches on merge.
• Enable branch protection: required reviews, status checks, no force-push.
• Require signed commits for sensitive repos.
• Turn on Actions, Dependabot alerts, secret scanning (if available).
• Set topics, description, and homepage for discoverability.

2) README, LICENSE & Project Templates

README that Converts

• Value proposition + quick start (3 commands max).
• Badges: build status, coverage, version, license.
• Screenshots/GIFs + demo link.
• Usage, FAQ, Roadmap, Contributing, Security, License.

## Quick Start
git clone <repo> && cd app
npm i
npm run dev

Reusable Templates

Create these in .github/ (org-wide or repo-level):

• ISSUE_TEMPLATE/bug_report.md, feature_request.md
• PULL_REQUEST_TEMPLATE.md
• FUNDING.yml & SECURITY.md

## Summary
- 

## Checks
- [ ] Tests pass
- [ ] Docs updated
- [ ] No secrets committed

Tip: Use LICENSE (MIT/Apache-2.0) to remove ambiguity and unlock contributions.

3) .gitignore, Git LFS & Submodules

Smart .gitignore

# Node
node_modules/
dist/
.env
# OS
.DS_Store
Thumbs.db

Use language-specific templates; never commit credentials.

Large Files & Submodules

• Git LFS for binaries: git lfs track "*.png".
• Submodules only for pinned external dependencies; document update steps.

# Submodule example
git submodule add https://github.com/org/lib external/lib
git submodule update --init --recursive

4) CODEOWNERS & Branch Protection

CODEOWNERS Patterns

# .github/CODEOWNERS
*               @core-team
/docs/**        @docs-writers
/apps/api/**    @backend
/apps/web/**    @frontend

Owners are auto-requested for review, improving accountability.

Protected Branches

• Require 1–2 approving reviews + status checks.
• Enforce linear history, dismiss stale approvals on new commits.
• Restrict who can push to main / release branches.

5) Branching Strategies

Strategy	When to Use	Notes
Trunk-based	Fast teams, feature flags	Short-lived branches; frequent merges
GitHub Flow	Web apps	branch → PR → review → merge → deploy
Git Flow	Versioned releases	develop, release/*, hotfix/*; more ceremony

# Helpful aliases
git config alias.co checkout
git config alias.br branch
git config alias.cm "commit -m"
git config alias.st status

6) Pull Requests & Code Reviews that Scale

• Keep PRs small (< 300 lines diff). Add context in the description.
• Use Draft PRs early; convert when ready.
• Link Issues with keywords: Fixes #123 auto-closes on merge.
• Turn on required reviews & status checks.
• Use chore:, feat:, fix: prefixes (Conventional Commits).

# Update PR with latest main safely
git fetch origin
git rebase origin/main
# … resolve conflicts …
git push --force-with-lease

Saved Reply Snippet for Reviews

**Thanks!** Could you:
- Add tests covering X?
- Document Y in README?
- Split Z into a follow-up PR?

7) Issues, Labels, Milestones & Projects

Label System

• Type: bug, feat, docs, chore
• Priority: P0–P3, good first issue
• Area: api, ui, devops

Projects (Boards)

• Views: Table, Board, Roadmap, Charts.
• Fields: Status, Priority, Owner, Target release.
• Automation: When PR merged → Status: Done.

Milestones bundle issues/PRs for time-boxed releases.

8) Discussions & Wiki

• Enable Discussions for Q&A, ideas, RFCs; move support off Issues.
• Use the Wiki for living docs (architecture notes, runbooks).

9) GitHub Actions: CI/CD Basics

Node CI Workflow

# .github/workflows/ci.yml
name: CI
on:
  push: { branches: [main] }
  pull_request:
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20' }
      - run: npm ci
      - run: npm test

Python CI Workflow

# .github/workflows/ci-python.yml
name: CI-Python
on: [push, pull_request]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: '3.12' }
      - run: pip install -r requirements.txt
      - run: pytest -q

Always cache dependencies to speed up runs and set fail-fast: false for matrix jobs.

10) Advanced Actions: Matrix, Cache, Reusable & Environments

Matrix + Cache

# .github/workflows/matrix.yml
name: Matrix
on: [push, pull_request]
jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node: [18, 20, 22]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: ${{ matrix.node }} }
      - uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
      - run: npm ci && npm run build

Reusable Workflow & Secrets

# .github/workflows/reusable.yml
on: workflow_call
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm run lint

# Caller:
# uses: org/repo/.github/workflows/reusable.yml@main

# Environment protection (staging/prod)
# UI: Settings → Environments → Required reviewers + secrets

11) GitHub Pages & Documentation

• Host docs or a marketing site from docs/ or a dedicated branch.
• Use static site generators (Docusaurus, MkDocs, Astro) and deploy via Actions.

# Example deploy step (static site already built)
- name: Deploy to Pages
  uses: actions/upload-pages-artifact@v3
- name: Publish
  uses: actions/deploy-pages@v4

12) Releases, Tags & Changelogs

• Semantic versioning: MAJOR.MINOR.PATCH.
• Tag commits: git tag v1.2.0 && git push --tags.
• Auto-generate changelogs from PR titles or Conventional Commits.

# Release CLI
gh release create v1.2.0 --title "v1.2.0" --notes "Improvements & fixes" ./dist/*

13) Security Best Practices

Secret Safety

• Never commit .env; use repo/org/environment Secrets.
• Rotate tokens regularly; prefer OpenID Connect to avoid long-lived keys.
• Enable secret scanning & Dependabot alerts.

Policy Files

• SECURITY.md: how to report vulnerabilities.
• Branch protection + required reviews to block risky merges.
• Signed commits & verified publishers for packages.

Basic Dependabot Config

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: "/"
    schedule: { interval: weekly }
    open-pull-requests-limit: 5

14) Insights, Analytics & Maintenance

• Insights → Contribution graph, traffic, clones, popular content.
• Clean up stale branches; archive inactive repos.
• Use CODE_OF_CONDUCT.md and CONTRIBUTING.md to grow community.

15) API, Webhooks & gh CLI Power Moves

gh CLI Favorites

# Authenticate
gh auth login

# Create repo & push
gh repo create my-app --public --source=. --push

# Create issue & PR
gh issue create -t "Bug: crash on X" -b "Steps to reproduce…"
gh pr create --fill --head feat/x

# Review/merge
gh pr checkout 123
gh pr merge --squash --delete-branch

REST/GraphQL Samples

# REST: list issues (curl)
curl -H "Authorization: token <TOKEN>" \
  https://api.github.com/repos/org/repo/issues?state=open

# GraphQL: repo stars
curl -H "Authorization: bearer <TOKEN>" \
  -X POST https://api.github.com/graphql \
  -d '{ "query": "query{ repository(owner:\"org\",name:\"repo\"){ stargazerCount } }" }'

16) Search, Markdown, Shortcuts & Pro Tricks

Search Operators

• repo:org/repo is:issue is:open label:bug
• org:your-org author:@me is:pr review:required
• code: "function foo" language:TypeScript

Markdown Superpowers

• Task lists: - [ ] & - [x]
• Tables, footnotes, emoji, & mermaid diagrams

```mermaid
flowchart LR
A[Plan] --> B[Build] --> C[Test] --> D[Deploy]
```

Keyboard Shortcuts

gc Code • gi Issues • t File finder • / Search • . Open web editor

17) Practical Checklists

Before Opening a PR

• Rebased on main, lints & tests passing.
• Small, focused commits; meaningful title & description.
• Linked issue & screenshots for UI changes.

Before Merging

• All checks green; approvals in.
• Docs/CHANGELOG updated; feature flags toggled as needed.
• Squash merge to keep history clean (or rebase for monorepos).

18) Common Pitfalls to Avoid

• Committing secrets or large binaries without LFS.
• Massive PRs that stall reviews.
• Skipping branch protection and required checks.
• Unclear README and no templates → contributor confusion.
• Not automating tests/builds/releases with Actions.

19) Copy-Ready Snippets

Conventional Commit Examples

feat(auth): add OAuth login
fix(api): prevent null reference on user lookup
docs(readme): add quick start
chore(deps): bump axios to 1.7.2
refactor(ui): extract button component

Release Drafter (auto changelog)

# .github/release-drafter.yml
name-template: 'v$NEXT_PATCH_VERSION'
categories:
  - title: '🚀 Features'
    labels: ['feat']
  - title: '🐛 Fixes'
    labels: ['fix']
change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
template: |
  ## Changes
  $CHANGES

Node Publish on Tag

# .github/workflows/publish.yml
name: Publish
on:
  push:
    tags: ['v*.*.*']
jobs:
  npm-publish:
    permissions:
      contents: read
      id-token: write   # OIDC
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', registry-url: 'https://registry.npmjs.org' }
      - run: npm ci && npm test
      - run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}