GitHub Actions

┌─────────────────────────────────────────────────────────────────┐
│                      GitHub Platform                             │
├─────────────────────────────────────────────────────────────────┤
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────────────┐  │
│  │   Trigger   │───▶│  Workflow   │───▶│      Runner         │  │
│  │  (push/pr)  │    │   (.yml)    │    │   (执行环境)         │  │
│  └─────────────┘    └─────────────┘    └─────────────────────┘  │
│                                               │                  │
│                                               ▼                  │
│  ┌─────────────────────────────────────────────────────────────┐│
│  │                    Job 执行流程                              ││
│  │  ┌───────┐   ┌───────┐   ┌───────┐   ┌───────┐   ┌───────┐ ││
│  │  │Step 1 │──▶│Step 2 │──▶│Step 3 │──▶│Step N │──▶│Output │ ││
│  │  │checkout│  │setup │   │build │   │deploy│   │result │ ││
│  │  └───────┘   └───────┘   └───────┘   └───────┘   └───────┘ ││
│  └─────────────────────────────────────────────────────────────┘│
└─────────────────────────────────────────────────────────────────┘

jobs:
  build:
    runs-on: self-hosted  # 使用自托管运行器
    # 或指定标签
    # runs-on: [self-hosted, linux, x64, gpu]

# 工作流名称（可选，默认为文件名）
name: CI/CD Pipeline

# 触发条件
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

# 环境变量（全局）
env:
  NODE_ENV: test
  CI: true

# 并发控制
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# 权限设置
permissions:
  contents: read
  pull-requests: write

# 作业定义
jobs:
  build:
    runs-on: ubuntu-latest
    # ... 作业配置

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      # 步骤1：检出代码
      - name: Checkout code
        uses: actions/checkout@v4

      # 步骤2：配置 Node.js 环境
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'pnpm'  # 启用 pnpm 缓存

      # 步骤3：安装 pnpm
      - name: Setup pnpm
        uses: pnpm/action-setup@v3
        with:
          version: 8

      # 步骤4：安装依赖
      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # 步骤5：代码检查
      - name: Run linter
        run: pnpm lint

      # 步骤6：运行测试
      - name: Run tests
        run: pnpm test:coverage

      # 步骤7：构建
      - name: Build
        run: pnpm build

on:
  push:
    branches:
      - main
      - 'release/**'  # 支持 glob 模式
    paths:
      - 'src/**'      # 仅当 src 目录变更时触发
      - 'package.json'
      - 'pnpm-lock.yaml'
    paths-ignore:
      - '**.md'       # 忽略文档变更
    tags:
      - 'v*'          # 推送标签时触发

on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches: [main]

on:
  schedule:
    # cron 语法：分 时 日 月 周
    - cron: '0 0 * * *'      # 每天 UTC 0 点
    - cron: '0 6 * * 1'      # 每周一 UTC 6 点
    - cron: '0 0 1 * *'      # 每月 1 号

on:
  workflow_dispatch:
    inputs:
      environment:
        description: '部署环境'
        required: true
        default: 'staging'
        type: choice
        options:
          - staging
          - production
      version:
        description: '版本号'
        required: false
        type: string
      dry_run:
        description: '试运行模式'
        required: false
        type: boolean
        default: false

steps:
  - name: Deploy
    run: |
      echo "Deploying to ${{ inputs.environment }}"
      echo "Version: ${{ inputs.version }}"

on:
  issues:
    types: [opened, edited]
  release:
    types: [created, published]
  discussion:
    types: [created]

# 可被其他工作流调用
on:
  workflow_call:
    inputs:
      config-path:
        required: true
        type: string
    secrets:
      token:
        required: true

# 条件判断
if: ${{ github.event_name == 'push' }}
if: ${{ success() }}              # 前面步骤成功
if: ${{ failure() }}              # 前面步骤失败
if: ${{ always() }}               # 始终执行

# 函数调用
if: ${{ startsWith(github.ref, 'refs/tags/') }}
if: ${{ contains(github.event.head_commit.message, '[skip ci]') }}

# 类型转换
env:
  VERSION: ${{ toJSON(github.event) }}
  ENABLED: ${{ fromJSON(env.CONFIG).enabled }}

# 文件哈希
key: ${{ hashFiles('**/package-lock.json', '**/yarn.lock') }}

# 环境变量格式化
env:
  SHORT_SHA: ${{ github.sha.substring(0, 7) }}

# 条件表达式
env:
  DEPLOY_ENV: ${{ github.ref == 'refs/heads/main' && 'production' || 'staging' }}

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pnpm lint

  test:
    runs-on: ubuntu-latest
    needs: lint  # 依赖 lint 作业完成后执行
    steps:
      - uses: actions/checkout@v4
      - run: pnpm test

  build:
    runs-on: ubuntu-latest
    needs: [lint, test]  # 多依赖，都成功后才执行
    steps:
      - uses: actions/checkout@v4
      - run: pnpm build

  deploy:
    runs-on: ubuntu-latest
    needs: build
    if: github.ref == 'refs/heads/main'  # 仅 main 分支部署
    steps:
      - uses: actions/checkout@v4
      - run: pnpm deploy

┌──────┐
│ lint │
└──┬───┘
   │
   ▼
┌──────┐
│ test │
└──┬───┘
   │
   ▼
┌───────┐
│ build │
└──┬────┘
   │
   ▼
┌────────┐
│ deploy │ (main 分支)
└────────┘

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      artifact-path: ${{ steps.build.outputs.path }}
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Get version
        id: version
        run: echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
      
      - name: Build
        id: build
        run: |
          pnpm build
          echo "path=./dist" >> $GITHUB_OUTPUT

  deploy:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Deploy
        run: |
          echo "Deploying version ${{ needs.build.outputs.version }}"
          echo "From path ${{ needs.build.outputs.artifact-path }}"

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        node: [18, 20, 22]
    
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
      - run: pnpm test

strategy:
  matrix:
    os: [ubuntu-latest, windows-latest, macos-latest]
    node: [18, 20, 22]
    # 排除特定组合
    exclude:
      - os: windows-latest
        node: 18
      - os: macos-latest
        node: 18
    # 包含特定组合
    include:
      - os: ubuntu-latest
        node: 20
        experimental: true

           ┌──────────────────────────────────────────┐
           │             Matrix Combinations          │
           └──────────────────────────────────────────┘
                            │
    ┌───────────────────────┼───────────────────────┐
    │                       │                       │
    ▼                       ▼                       ▼
┌─────────┐           ┌─────────┐           ┌─────────┐
│ Ubuntu  │           │ Windows │           │  macOS  │
│ Node 20 │           │ Node 20 │           │ Node 20 │
└─────────┘           └─────────┘           └─────────┘
    │                       │                       │
    ▼                       ▼                       ▼
  Pass/Fail              Pass/Fail              Pass/Fail

strategy:
  fail-fast: false  # 一个失败不取消其他作业
  max-parallel: 4   # 最大并行数

steps:
  - uses: actions/checkout@v4

  - name: Cache pnpm store
    uses: actions/cache@v4
    with:
      path: |
        ~/.pnpm-store
        node_modules
      key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
      restore-keys: |
        ${{ runner.os }}-pnpm-

  - run: pnpm install

# npm
- uses: actions/setup-node@v4
  with:
    node-version: '20'
    cache: 'npm'

# yarn
- uses: actions/setup-node@v4
  with:
    node-version: '20'
    cache: 'yarn'

# pnpm
- uses: actions/setup-node@v4
  with:
    node-version: '20'
    cache: 'pnpm'

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pnpm build
      
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-output
          path: |
            dist/
            build/
          retention-days: 5  # 保留天数，默认 90 天
          compression-level: 6  # 压缩级别 0-9

jobs:
  deploy:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-output
          path: ./dist  # 解压路径

      - name: Deploy
        run: pnpm deploy

# 工作流 1：构建并上传
jobs:
  build:
    steps:
      - uses: actions/upload-artifact@v4
        with:
          name: build-${{ github.sha }}
          path: dist/

# 工作流 2：下载并部署（需要 workflow_run 触发）
on:
  workflow_run:
    workflows: ["Build"]
    types: [completed]

jobs:
  deploy:
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: build-${{ github.event.workflow_run.head_sha }}

# 工作流级别
env:
  GLOBAL_VAR: 'workflow-level'

jobs:
  build:
    # 作业级别
    env:
      JOB_VAR: 'job-level'
    
    steps:
      # 步骤级别
      - name: Example
        env:
          STEP_VAR: 'step-level'
        run: |
          echo "Global: $GLOBAL_VAR"
          echo "Job: $JOB_VAR"
          echo "Step: $STEP_VAR"

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production  # 指定环境
    steps:
      - name: Deploy to AWS
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: |
          aws s3 sync ./dist s3://my-bucket --region us-east-1

# 在 Settings → Secrets and variables → Actions → Variables 中配置

jobs:
  deploy:
    steps:
      - name: Deploy
        run: |
          echo "API URL: ${{ vars.API_URL }}"
          echo "Max retries: ${{ vars.MAX_RETRIES }}"

jobs:
  test:
    runs-on: ubuntu-latest
    
    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: test_db
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

      redis:
        image: redis:7
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - uses: actions/checkout@v4
      
      - name: Run tests
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/test_db
          REDIS_URL: redis://localhost:6379
        run: pnpm test

services:
  app:
    image: my-app:latest
    ports:
      - 3000:3000

  nginx:
    image: nginx:latest
    ports:
      - 80:80
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro

jobs:
  deploy:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - run: echo "Deploying to production"

  notify:
    if: failure()  # 前面作业失败时执行
    runs-on: ubuntu-latest
    steps:
      - name: Send notification
        run: |
          curl -X POST ${{ secrets.SLACK_WEBHOOK }} \
            -d '{"text": "Build failed!"}'

steps:
  - name: Build
    run: pnpm build
    
  - name: Test
    run: pnpm test
    
  - name: Upload logs on failure
    if: failure()
    uses: actions/upload-artifact@v4
    with:
      name: logs
      path: logs/
      
  - name: Cleanup
    if: always()
    run: rm -rf temp/

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 30  # 作业级别超时
    
    steps:
      - name: Long running task
        timeout-minutes: 10  # 步骤级别超时
        run: pnpm build

steps:
  - name: Deploy with retry
    uses: nick-fields/retry@v2
    with:
      timeout_minutes: 10
      max_attempts: 3
      retry_wait_seconds: 30
      command: pnpm deploy

# 同一分支只保留最新运行，取消之前的运行
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: pnpm build

# PR 场景：取消同一 PR 的旧运行
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

# main 分支：不取消，允许排队
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

name: Deploy to Vercel

on:
  push:
    branches: [main]
  pull_request:

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Deploy to Vercel
        uses: amondnet/vercel-action@v25
        with:
          vercel-token: ${{ secrets.VERCEL_TOKEN }}
          vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
          vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
          vercel-args: ${{ github.event_name == 'push' && '--prod' || '' }}

name: Docker Build and Push

on:
  push:
    branches: [main]
    tags: ['v*']

jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ secrets.DOCKER_USERNAME }}/myapp
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=sha

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

name: Deploy to AWS

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Login to ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push to ECR
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: myapp
        run: |
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:${{ github.sha }} .
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:${{ github.sha }}

      - name: Deploy to ECS
        uses: aws-actions/amazon-ecs-deploy-task-definition@v1
        with:
          task-definition: task-definition.json
          service: my-service
          cluster: my-cluster

name: Publish to npm

on:
  release:
    types: [created]

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write  # 用于 OIDC
    steps:
      - uses: actions/checkout@v4
      
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'
      
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      
      # 方式 1：使用传统 Token
      - run: npm publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
      
      # 方式 2：使用 OIDC（推荐，无需 Token）
      - run: npm publish --provenance

# .github/workflows/deploy.yml
name: Deploy

on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
      version:
        required: false
        type: string
        default: 'latest'
    secrets:
      DEPLOY_TOKEN:
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy
        run: |
          echo "Deploying to ${{ inputs.environment }}"
          echo "Version: ${{ inputs.version }}"

# .github/workflows/main.yml
name: Main CI

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pnpm build

  deploy-staging:
    needs: build
    uses: ./.github/workflows/deploy.yml
    with:
      environment: staging
    secrets:
      DEPLOY_TOKEN: ${{ secrets.STAGING_TOKEN }}

  deploy-production:
    needs: build
    if: github.ref == 'refs/heads/main'
    uses: ./.github/workflows/deploy.yml
    with:
      environment: production
      version: ${{ github.sha }}
    secrets:
      DEPLOY_TOKEN: ${{ secrets.PRODUCTION_TOKEN }}

# .github/actions/setup-node/action.yml
name: 'Setup Node.js Environment'
description: '配置 Node.js 环境并安装依赖'
author: 'Your Name'

inputs:
  node-version:
    description: 'Node.js 版本'
    required: false
    default: '20'
  package-manager:
    description: '包管理器'
    required: false
    default: 'pnpm'

runs:
  using: 'composite'
  steps:
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: ${{ inputs.node-version }}
        cache: ${{ inputs.package-manager }}

    - name: Setup pnpm
      if: ${{ inputs.package-manager == 'pnpm' }}
      uses: pnpm/action-setup@v3
      with:
        version: 8

    - name: Install dependencies
      shell: bash
      run: |
        if [ "${{ inputs.package-manager }}" = "pnpm" ]; then
          pnpm install --frozen-lockfile
        elif [ "${{ inputs.package-manager }}" = "yarn" ]; then
          yarn install --frozen-lockfile
        else
          npm ci
        fi

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - uses: ./.github/actions/setup-node
        with:
          node-version: '20'
          package-manager: 'pnpm'
      
      - run: pnpm build

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://myapp.example.com
    steps:
      - run: pnpm deploy

# 工作流级别
permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write  # 仅在需要的作业中提升权限
    steps:
      - uses: softprops/action-gh-release@v1

# ❌ 危险：直接使用用户输入
- run: echo "${{ github.event.issue.title }}"

# ✅ 安全：使用环境变量
- env:
    TITLE: ${{ github.event.issue.title }}
  run: echo "$TITLE"

# ✅ 安全：转义特殊字符
- uses: actions/github-script@v7
  with:
    script: |
      const title = `${{ github.event.issue.title }}`.replace(/"/g, '\\"');
      console.log(title);

# AWS OIDC 认证
- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789:role/my-github-role
    aws-region: us-east-1

steps:
  - name: Debug context
    run: |
      echo "Event: ${{ github.event_name }}"
      echo "Ref: ${{ github.ref }}"
      echo "SHA: ${{ github.sha }}"
      echo "Actor: ${{ github.actor }}"
      
  - name: Debug environment
    run: env | sort
    
  - name: Debug file system
    run: find . -type f -name "*.json" | head -20

- name: Setup tmate session
  uses: mxschmitt/action-tmate@v3
  if: ${{ failure() }}  # 失败时启用

git commit -m "docs: update README [skip ci]"

- name: Free disk space
  run: |
    sudo rm -rf /usr/share/dotnet
    sudo rm -rf /opt/ghc
    sudo rm -rf /usr/local/share/boost
    df -h

# 检查缓存 key 是否正确
- name: Check cache
  run: |
    echo "Lock file hash: ${{ hashFiles('**/pnpm-lock.yaml') }}"
    echo "OS: ${{ runner.os }}"

# 给工作流添加必要权限
permissions:
  contents: write      # 用于推送代码/创建 release
  packages: write      # 用于发布到 GitHub Packages
  pull-requests: write # 用于创建 PR 评论
  issues: write        # 用于创建 Issue

defaults: &defaults
  working-directory: ./packages/core

jobs:
  build:
    steps:
      - run: pnpm build
        <<: *defaults
      - run: pnpm test
        <<: *defaults

# 完整示例：生产级工作流
name: CI/CD

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  NODE_ENV: test

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-node
      - run: pnpm lint

  test:
    runs-on: ${{ matrix.os }}
    needs: lint
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        node: [18, 20, 22]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile
      - run: pnpm test:coverage
      - uses: codecov/codecov-action@v4
        if: matrix.os == 'ubuntu-latest' && matrix.node == '20'

  build:
    runs-on: ubuntu-latest
    needs: [lint, test]
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-node
      - run: pnpm build
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  deploy:
    runs-on: ubuntu-latest
    needs: build
    if: github.ref == 'refs/heads/main'
    environment: production
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - name: Deploy
        run: pnpm deploy