Does GitHub Actions satisfy FCA PS21/3 change management?

GitHub Actions with branch protection satisfies FCA PS21/3 change management: (1) branch protection on main (no direct push — all changes via PR), (2) required status checks (all CI/CD pipeline checks must pass before merge — automated quality gate), (3) required reviews (minimum 2 reviewers for production changes — human change review), (4) deployment environment protection rules (GitHub Environments — production deployment requires explicit approval from named approvers), (5) audit log (GitHub audit log — every merge, every deployment, every approver — immutable, downloadable for FCA evidence). ClickMasters FCA PS21/3 CI/CD configuration: branch protection + required checks + environment approvals + CloudFormation change set review = complete PS21/3 change management audit trail.

Should UK NHS projects use self-hosted GitHub Actions runners?

For NHS applications processing clinical data (NHS Article 9 health data), self-hosted GitHub Actions runners in eu-west-2 is the strongest DTAC Domain 3 position: CI/CD pipeline runs in the same AWS account and region as the NHS application, no clinical data leaves eu-west-2 in test outputs or logs. GitHub-hosted runners: run in Microsoft Azure data centres — acceptable for most NHS applications (test data should be synthetic, not real patient data). ClickMasters NHS CI/CD configuration: self-hosted runners on ECS Fargate (eu-west-2) — runners spin up on demand, terminated after pipeline, no persistent state. NHS DSP Toolkit Annex B Standard 9.4: CI/CD infrastructure must be included in security risk assessment — self-hosted runners simplify the risk boundary.

Github Actions Vs Gitlab Ci Vs Circleci Uk 20

GitHub Actions vs GitLab CI vs CircleCI — UK CI/CD (2026)

Updated: March 20269 min read

🇬🇧 UK💷 GBP📊 Comparison🔒 UK GDPR⚖️ UK Law

Direct Answer

GitHub Actions is ClickMasters' default for all UK projects on GitHub — tightest GitHub integration, largest marketplace of actions, and AWS OIDC (no long-lived credentials — strongest Cyber Essentials A3 access control). GitLab CI is right when the team uses GitLab (built-in CI/CD is GitLab's core strength — no separate tool needed). CircleCI is legacy for most new UK projects — GitHub Actions has matched or exceeded CircleCI for typical UK use cases. CI/CD platform choice affects UK Cyber Essentials A2 (14-day patching evidence), FCA PS21/3 change management audit trail, and AWS OIDC security posture.

Factor	GitHub Actions	GitLab CI	CircleCI
AWS OIDC (no long-lived credentials)	✅ Native — GitHub OIDC → AWS IAM role	✅ GitLab OIDC — available	CircleCI OIDC — available
Cyber Essentials patching evidence	✅ Actions run history — Dependabot PR merge = patch audit trail	Merge request pipeline history	CircleCI pipeline history
FCA PS21/3 change management	✅ Required status checks + branch protection = change gate	Merge request approvals — equivalent	Required context checks — available
NHS DTAC Domain 3 security scans	✅ Marketplace: Semgrep, Trivy, OWASP ZAP actions pre-built	GitLab SAST/DAST built-in — good	CircleCI orbs for Snyk, Trivy
GitHub integration	✅ Native — same platform	Requires webhook/mirror	GitHub connector available
Self-hosted runners (NHS data residency)	✅ GitHub Actions self-hosted runners — eu-west-2	✅ GitLab Runner self-hosted — eu-west-2	CircleCI self-hosted runners — available
Cost at medium UK team (10 devs)	✅ GitHub Teams + Actions included	GitLab Premium (~£15/user/month)	CircleCI (~£400+/month for medium usage)
ClickMasters default	✅ All GitHub-based UK projects	All GitLab-based UK projects	Legacy only — no new projects