Reusable and Composite Workflows — CI/CD with GitHub Actions

As an organisation's GitHub Actions footprint grows — dozens of repositories, hundreds of workflow files — copy-paste becomes a maintenance problem. A security hardening step needing updates in 50 workflow files across 20 repositories is a significant operational burden, and any missed update is a security gap. GitHub Actions provides two mechanisms for workflow reuse. Reusable workflows are complete workflows called from another workflow using `uses: org/repo/.github/workflows/file.yml@ref`, passing inputs and receiving outputs. Composite actions encapsulate a sequence of steps into a single `uses:` reference, enabling step-level reuse. Together they enable organisations to build a library of standardised, security-reviewed pipeline components that individual teams consume without needing to maintain the implementation details.

Analogy🏏Cricket

🏏 Think of it like cricket: A cricket series is structured in three tiers: the series schedule (which matches are played and when), individual match plans (batting order, bowling rotations, fielding strategy), and specific delivery plans (which balls to bowl to which batsman in which over). The series schedule is the workflow — it defines the overall event. Each match is a job — it runs independently but contributes to the series outcome. Each delivery plan is a step — a specific action with a discrete result. Just as a Test captain doesn't redesign the series schedule for every match but does adjust the bowling plan for each innings, GitHub Actions separates what triggers the automation (workflow) from how independent tasks are parallelised (jobs) from the individual commands executed (steps). The insight is that this separation of concerns is what allows large, complex pipelines to remain manageable — just as a well-structured series plan keeps a touring team organised across multiple venues and formats.