# Github Actions Templates > 生产级 GitHub Actions 工作流模式，用于测试、构建和部署应用程序。当用户要求'GitHub Actions 工作流'、'CI/CD 配置'、'自动化测试部署'时使用。 - Skill: `kscz0000/github-actions-templates` (Agent Skill) - Install (CLI): `npx skillmds@latest add kscz0000/github-actions-templates` - Raw SKILL.md: https://api.skillmd.com/api/skills/kscz0000/github-actions-templates/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: kscz0000 (https://skillmd.com/u/kscz0000) - Updated: 2026-09-21 - Page: https://skillmd.com/skills/kscz0000/github-actions-templates --- # GitHub Actions 模板 生产级 GitHub Actions 工作流模式，用于测试、构建和部署应用程序。 ## 不适用场景 - 任务与 GitHub Actions 模板无关 - 需要此范围之外的其他领域或工具 ## 使用说明 - 明确目标、约束条件和所需输入。 - 应用相关最佳实践并验证结果。 - 提供可执行的步骤和验证方法。 - 如需详细示例，请打开 `resources/implementation-playbook.md`。 ## 目的 为各种技术栈创建高效、安全的 GitHub Actions 工作流，实现持续集成和持续部署。 ## 适用场景 - 自动化测试和部署 - 构建 Docker 镜像并推送到镜像仓库 - 部署到 Kubernetes 集群 - 运行安全扫描 - 为多环境实现矩阵构建 ## 常用工作流模式 ### 模式 1：测试工作流 ```yaml name: Test on: push: branches: [ main, develop ] pull_request: branches: [ main ] jobs: test: runs-on: ubuntu-latest strategy: matrix: node-version: [18.x, 20.x] steps: - uses: actions/checkout@v4 - name: Use Node.js ${{ matrix.node-version }} uses: actions/setup-node@v4 with: node-version: ${{ matrix.node-version }} cache: 'npm' - name: Install dependencies run: npm ci - name: Run linter run: npm run lint - name: Run tests run: npm test - name: Upload coverage uses: codecov/codecov-action@v3 with: files: ./coverage/lcov.info ``` **参考：** 参见 `assets/test-workflow.yml` ### 模式 2：构建并推送 Docker 镜像 ```yaml name: Build and Push on: push: branches: [ main ] tags: [ 'v*' ] env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }} jobs: build: runs-on: ubuntu-latest permissions: contents: read packages: write steps: - uses: actions/checkout@v4 - name: Log in to Container Registry uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Extract metadata id: meta uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | type=ref,event=branch type=ref,event=pr type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} - name: Build and push uses: docker/build-push-action@v5 with: context: . push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max ``` **参考：** 参见 `assets/deploy-workflow.yml` ### 模式 3：部署到 Kubernetes ```yaml name: Deploy to Kubernetes on: push: branches: [ main ] jobs: deploy: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@v4 with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} aws-region: us-west-2 - name: Update kubeconfig run: | aws eks update-kubeconfig --name production-cluster --region us-west-2 - name: Deploy to Kubernetes run: | kubectl apply -f k8s/ kubectl rollout status deployment/my-app -n production kubectl get services -n production - name: Verify deployment run: | kubectl get pods -n production kubectl describe deployment my-app -n production ``` ### 模式 4：矩阵构建 ```yaml name: Matrix Build on: [push, pull_request] jobs: build: runs-on: ${{ matrix.os }} strategy: matrix: os: [ubuntu-latest, macos-latest, windows-latest] python-version: ['3.9', '3.10', '3.11', '3.12'] steps: - uses: actions/checkout@v4 - name: Set up Python uses: actions/setup-python@v5 with: python-version: ${{ matrix.python-version }} - name: Install dependencies run: | python -m pip install --upgrade pip pip install -r requirements.txt - name: Run tests run: pytest ``` **参考：** 参见 `assets/matrix-build.yml` ## 工作流最佳实践 1. **使用具体的 action 版本**（@v4，而非 @latest） 2. **缓存依赖项**以加速构建 3. **使用 secrets** 存储敏感数据 4. **在 PR 上实施状态检查** 5. **使用矩阵构建**进行多版本测试 6. **设置适当的权限** 7. **使用可复用工作流**处理通用模式 8. **为生产环境实施审批门禁** 9. **添加失败通知步骤** 10. **对敏感工作负载使用自托管运行器** ## 可复用工作流 ```yaml # .github/workflows/reusable-test.yml name: Reusable Test Workflow on: workflow_call: inputs: node-version: required: true type: string secrets: NPM_TOKEN: required: true jobs: test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: ${{ inputs.node-version }} - run: npm ci - run: npm test ``` **使用可复用工作流：** ```yaml jobs: call-test: uses: ./.github/workflows/reusable-test.yml with: node-version: '20.x' secrets: NPM_TOKEN: ${{ secrets.NPM_TOKEN }} ``` ## 安全扫描 ```yaml name: Security Scan on: push: branches: [ main ] pull_request: branches: [ main ] jobs: security: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@master with: scan-type: 'fs' scan-ref: '.' format: 'sarif' output: 'trivy-results.sarif' - name: Upload Trivy results to GitHub Security uses: github/codeql-action/upload-sarif@v2 with: sarif_file: 'trivy-results.sarif' - name: Run Snyk Security Scan uses: snyk/actions/node@master env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} ``` ## 带审批的部署 ```yaml name: Deploy to Production on: push: tags: [ 'v*' ] jobs: deploy: runs-on: ubuntu-latest environment: name: production url: https://app.example.com steps: - uses: actions/checkout@v4 - name: Deploy application run: | echo "Deploying to production..." # Deployment commands here - name: Notify Slack if: success() uses: slackapi/slack-github-action@v1 with: webhook-url: ${{ secrets.SLACK_WEBHOOK }} payload: | { "text": "Deployment to production completed successfully!" } ``` ## 参考文件 - `assets/test-workflow.yml` - 测试工作流模板 - `assets/deploy-workflow.yml` - 部署工作流模板 - `assets/matrix-build.yml` - 矩阵构建模板 - `references/common-workflows.md` - 常用工作流模式 ## 相关技能 - `gitlab-ci-patterns` - 用于 GitLab CI 工作流 - `deployment-pipeline-design` - 用于流水线架构 - `secrets-management` - 用于密钥管理 ## 限制 - 仅在任务明确符合上述描述的范围时使用此技能。 - 不要将输出作为环境特定验证、测试或专家审查的替代品。 - 如果缺少所需输入、权限、安全边界或成功标准，请停止并请求澄清。