GitHub Actions 高级工作流：构建高效的自动化流水线

GitHub Actions 是 GitHub 内置的 CI/CD 平台，灵活且强大。本文将介绍一些高级工作流模式，帮助你构建更高效的自动化流水线。

一、矩阵构建策略

矩阵构建可以在多个操作系统、语言版本中并行运行测试。

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        node: [18, 20, 22]
        exclude:
          - os: windows-latest
            node: 22
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
      - run: npm ci
      - run: npm test

二、可重用工作流

将通用工作流抽象为可重用模块。

# .github/workflows/deploy.yml
on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
    secrets:
      DEPLOY_TOKEN:
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - uses: actions/checkout@v4
      - run: ./deploy.sh
        env:
          TOKEN: ${{ secrets.DEPLOY_TOKEN }}

三、环境与审批

jobs:
  deploy-production:
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://example.com
    steps:
      - run: ./deploy-prod.sh

四、OIDC 认证

使用 OpenID Connect 替代长期密钥：

jobs:
  deploy-to-aws:
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789:role/github-actions
          aws-region: us-east-1
      - run: aws s3 sync ./dist s3://my-bucket

五、最佳实践

  1. 缓存依赖：使用 actions/cache 加速构建
  2. 并行执行：合理使用矩阵和并行 job
  3. 条件执行：基于分支、标签或文件变更
  4. 安全扫描：集成 CodeQL 和 Dependabot