GitHub Actions CI/CD 实战：自动化构建测试部署

# GitHub Actions CI/CD 实战 ## 工作流基本结构 ```yaml # .github/workflows/ci.yml name: CI/CD Pipeline on: push: branches: [main, develop] pull_request: branches: [main] jobs: lint: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: '20' cache: 'npm' - run: npm ci - run: npm run lint test: runs-on: ubuntu-latest needs: lint services: postgres: image: postgres:16 env: POSTGRES_PASSWORD: test POSTGRES_DB: testdb ports: - 5432:5432 options: >- --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5 steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: '20' cache: 'npm' - run: npm ci - run: npm test -- --coverage env: DATABASE_URL: postgres://postgres:test@localhost:5432/testdb - uses: actions/upload-artifact@v4 with: name: coverage path: coverage/ ``` ## Docker 镜像构建与推送 ```yaml build: runs-on: ubuntu-latest needs: test if: github.ref == 'refs/heads/main' steps: - uses: actions/checkout@v4 - name: Login to Docker Hub uses: docker/login-action@v3 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_TOKEN }} - name: Build and push uses: docker/build-push-action@v5 with: context: . push: true tags: | myapp:latest myapp:${{ github.sha }} cache-from: type=gha cache-to: type=gha,mode=max ``` ## 部署到生产 ```yaml deploy: runs-on: ubuntu-latest needs: build environment: production steps: - name: Deploy to server uses: appleboy/ssh-action@v1 with: host: ${{ secrets.SERVER_HOST }} username: ${{ secrets.SERVER_USER }} key: ${{ secrets.SSH_PRIVATE_KEY }} script: | cd /opt/app docker pull myapp:${{ github.sha }} docker compose down export IMAGE_TAG=${{ github.sha }} docker compose up -d docker image prune -f ``` ## 矩阵策略（多版本测试） ```yaml test-matrix: runs-on: ubuntu-latest strategy: matrix: node-version: [18, 20, 22] os: [ubuntu-latest, macos-latest] fail-fast: false steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: ${{ matrix.node-version }} - run: npm ci - run: npm test ``` ## 缓存优化 ```yaml - name: Cache node_modules uses: actions/cache@v4 with: path: ~/.npm key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }} restore-keys: | ${{ runner.os }}-npm- ``` ## PR 自动化 ```yaml pr-check: runs-on: ubuntu-latest if: github.event_name == 'pull_request' steps: - uses: actions/checkout@v4 - run: npm ci && npm test - name: Comment test results uses: actions/github-script@v7 with: script: | github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: 'All tests passed!' }) ``` ## Secrets 管理 ``` Settings -> Secrets and variables -> Actions 必须设置： DOCKER_USERNAME DOCKER_TOKEN SERVER_HOST SERVER_USER SSH_PRIVATE_KEY ``` ## 最佳实践 1. 使用 `needs` 定义 Job 依赖，避免不必要的并行 2. PR 必须通过 CI 才能合并（Branch Protection Rules） 3. 生产部署设置 `environment`，需要审批 4. 使用缓存加速构建（npm、Maven、Docker layer） 5. 敏感信息用 Secrets，绝不硬编码