11 · CI/CD 自动化

GitHub Actions 文档：https://docs.github.com/en/actions GitLab CI 文档：https://docs.gitlab.com/ee/ci/ Argo CD 文档：https://argo-cd.readthedocs.io/

---

1. GitHub Actions 标准流水线

# .github/workflows/deploy.yml
name: Build and Deploy

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  ECR_REGISTRY: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.ap-southeast-1.amazonaws.com
  IMAGE_NAME: igaming-api

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci
      - run: npm test
      - run: npm run lint

  security:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4
      - name: Trivy 容器安全扫描
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

  build-push:
    runs-on: ubuntu-latest
    needs: [test, security]
    if: github.ref == 'refs/heads/main'
    permissions:
      id-token: write
      contents: read
    outputs:
      image_tag: ${{ steps.meta.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS Credentials（OIDC，无需 Access Key）
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-deploy
          aws-region: ap-southeast-1

      - name: Login to ECR
        uses: aws-actions/amazon-ecr-login@v2

      - name: Docker Metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,prefix=,suffix=,format=short
            type=ref,event=branch

      - name: Build and Push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy:
    runs-on: ubuntu-latest
    needs: build-push
    environment: production   # 需要 GitHub Environment 审批
    steps:
      - name: Update K8s Deployment
        run: |
          aws eks update-kubeconfig --name igaming-prod --region ap-southeast-1
          kubectl set image deployment/api-server \
            app=${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build-push.outputs.image_tag }} \
            -n production
          kubectl rollout status deployment/api-server -n production --timeout=5m

---

2. GitLab CI/CD

# .gitlab-ci.yml
stages:
  - test
  - build
  - deploy

variables:
  DOCKER_DRIVER: overlay2
  IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA

test:
  stage: test
  image: node:20-alpine
  script:
    - npm ci
    - npm test
  cache:
    paths:
      - node_modules/

build:
  stage: build
  services:
    - docker:dind
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build -t $IMAGE .
    - docker push $IMAGE
  only:
    - main

deploy-prod:
  stage: deploy
  environment:
    name: production
    url: https://api.example.com
  script:
    - kubectl set image deployment/api app=$IMAGE -n production
    - kubectl rollout status deployment/api -n production
  only:
    - main
  when: manual   # 需要手动确认

---

官方文档

• GitHub Actions 文档：https://docs.github.com/en/actions
• GitLab CI 文档：https://docs.gitlab.com/ee/ci/
• Argo CD 文档：https://argo-cd.readthedocs.io/
• act（本地运行 Actions）：https://github.com/nektos/act

---

最后更新：2025-04