Does GitHub Actions satisfy NHS DTAC Domain 3 for CI/CD?

GitHub Actions satisfies DTAC Domain 3: (1) OIDC for AWS -- no long-lived credentials (Cyber Essentials A3 satisfied), (2) Semgrep SAST -- official Action, blocks merge on high-severity, (3) Trivy container scanning -- zero critical CVEs in production, (4) GitHub audit log -- immutable record of all Actions runs, secret access, workflow changes, (5) branch protection rules -- required reviews and status checks prevent unreviewed code reaching production. ClickMasters NHS GitHub Actions template: pre-configured workflow with Semgrep, Trivy, ZAP, Playwright, axe-core -- DTAC Domain 3 evidence pack generated automatically.

Should NHS HealthTech use GitHub self-hosted runners for HSCN?

NHS HSCN: secure network -- some NHS integrations (EPS, PDS production) require HSCN connectivity. Self-hosted runner in HSCN-connected VPC: (1) deploy GitHub self-hosted runner agent on EC2 within HSCN VPC, (2) runner accesses NHS APIs requiring HSCN, (3) split workflow -- GitHub-hosted (fast, cheap) for most steps, self-hosted HSCN runner only for NHS API integration tests. Cost: GBP80-150/month for self-hosted EC2. ClickMasters NHS HSCN runners: configured for 6 NHS HealthTech clients.

Github Actions Vs Circleci Vs Jenkins Uk Cicd

GitHub Actions vs CircleCI vs Jenkins -- UK CI/CD (2026)

Updated: June 20269 min read

UKGBPComparisonUK GDPRUK Law

Direct Answer

GitHub Actions is ClickMasters default for all UK projects: native GitHub integration, OIDC for AWS (no long-lived credentials -- Cyber Essentials A3), and the richest marketplace for NHS DTAC evidence generation. CircleCI is right for advanced caching and parallelism on large test suites. Jenkins is legacy -- new UK projects should not use Jenkins. CI/CD platform choice affects Cyber Essentials A3 (credential management), NHS DTAC Domain 3 security evidence, and FCA PS21/3 deployment audit trail.

Factor	GitHub Actions	CircleCI	Jenkins
Cyber Essentials A3 credentials	BEST -- OIDC for AWS (no static keys)	OIDC available -- more complex setup	Static credentials typically used -- CE3 risk
NHS DTAC Domain 3 evidence	BEST -- artefacts native, GitHub audit log	Good -- audit log available	Complex -- log management overhead
FCA PS21/3 deployment audit	BEST -- GitHub audit log + Actions run history	CircleCI audit log -- available	Jenkins build history -- manageable
Semgrep / Trivy / ZAP	BEST -- official GitHub Actions marketplace	Good -- CircleCI orbs	Plugin-based -- more setup
GitHub integration	BEST -- native (PR checks, secrets, Dependabot)	GitHub webhook -- adequate	GitHub webhook -- more setup
Caching and parallelism	Good -- cache action + matrix builds	BEST -- advanced caching, test splitting	Good -- self-managed
Infrastructure cost	BEST -- free public repos, low private	Per-minute pricing -- can be expensive	Self-hosted -- infrastructure + ops cost
NHS HSCN self-hosted runners	BEST -- GitHub self-hosted runners in HSCN VPC	Self-hosted available	BEST -- Jenkins designed for self-hosted
ClickMasters default	All UK projects	Large test suites needing advanced parallelism	Legacy projects only