DevOps Rules

- Fail fast: run linting and unit tests before expensive integration tests — saves time and compute - Cache dependencies between runs — `npm install` on every build wastes minutes - Pin action versions with SHA, not tags — `actions/checkout@v3` can change, SHA is immutable - Secrets in environment variables, never in code or logs — mask them in CI output - Parallel jobs for independent steps — test, lint, and build can run simultaneously