---

name: ci-cd-ops description: "使用 GitHub Actions 的 CI/CD 流水线模式、发布自动化和测试策略。适用于：github actions、workflow、CI、CD、pipeline、deploy、release、semantic release、changesets、goreleaser、matrix、cache、secrets、environment、artifact、reusable workflow、composite action。" license: MIT allowed-tools: "Read Write Bash" metadata: author: claude-mods related-skills: git-ops, docker-ops, testing-ops

CI/CD 操作

使用 GitHub Actions、发布自动化工具和测试流水线的持续集成、交付和部署综合模式。

GitHub Actions 快速参考

工作流文件结构

name: CI                          # Actions 标签页中的显示名称
on:                               # 触发事件
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:                      # GITHUB_TOKEN 作用域（最小权限）
  contents: read
  pull-requests: write

concurrency:                      # 防止重复运行
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:                              # 工作流级环境变量
  NODE_VERSION: "20"

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
      - run: npm ci
      - run: npm test

核心语法元素

| 元素 | 用途 | 示例 | |---------|---------|---------| | on | 事件触发器 | push、pull_request、schedule | | jobs.<id>.runs-on | 运行器选择 | ubuntu-latest、self-hosted | | jobs.<id>.needs | 作业依赖 | needs: [build, lint] | | jobs.<id>.if | 条件执行 | if: github.event_name == 'push' | | jobs.<id>.strategy.matrix | 并行变体 | node-version: [18, 20, 22] | | jobs.<id>.environment | 部署目标 | environment: production | | jobs.<id>.permissions | Token 作用域 | contents: write | | steps[*].uses | 使用 Action | uses: actions/checkout@v4 | | steps[*].run | 运行命令 | run: npm test | | steps[*].env | 步骤环境变量 | env: { CI: true } |

触发器决策树

| 场景 | 触发器 | 配置 | |----------|---------|--------| | 每个 PR 运行测试 | pull_request | branches: [main] | | 合并到 main 时部署 | push | branches: [main] | | 版本标签时发布 | push | tags: ['v*'] | | 每夜构建 | schedule | cron: '0 2 * * *' | | 手动部署 | workflow_dispatch | inputs: { environment: ... } | | 被其他工作流调用 | workflow_call | inputs:、secrets: | | PR 标签变更时 | pull_request | types: [labeled] | | Issue 评论时 | issue_comment | types: [created] | | Release 发布时 | release | types: [published] | | 包推送时 | registry_package | types: [published] |

触发器过滤模式

on:
  push:
    branches: [main, 'release/**']      # 分支模式
    paths: ['src/**', '!src/**/*.test.*'] # 路径过滤（忽略测试）
    tags: ['v*']                          # 标签模式
  pull_request:
    types: [opened, synchronize, reopened] # 默认类型
    paths-ignore: ['docs/**', '*.md']     # 忽略仅文档变更

缓存策略

| 生态系统 | Action / Key | 路径 | 恢复键 | |-----------|-------------|------|-------------| | Node (npm) | actions/setup-node + cache: npm | 自动 | 自动 | | Node (pnpm) | actions/setup-node + cache: pnpm | 自动 | 自动 | | Go modules | actions/setup-go + cache: true | 自动 | 自动 | | Cargo | actions/cache@v4 | ~/.cargo/registry、target | cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }} | | pip / uv | actions/setup-python + cache: pip | 自动 | 自动 | | Docker layers | docker/build-push-action | 使用 buildx 缓存 | type=gha 或 type=registry | | Gradle | actions/setup-java + cache: gradle | 自动 | 自动 | | Composer | actions/cache@v4 | vendor | composer-${{ hashFiles('composer.lock') }} |

手动缓存示例

- uses: actions/cache@v4
  with:
    path: |
      ~/.cargo/bin
      ~/.cargo/registry
      ~/.cargo/git
      target
    key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
    restore-keys: |
      cargo-${{ runner.os }}-

矩阵策略

strategy:
  fail-fast: false                    # 失败时不取消兄弟作业
  max-parallel: 4                     # 限制并发作业数
  matrix:
    os: [ubuntu-latest, windows-latest, macos-latest]
    node-version: [18, 20, 22]
    include:                          # 添加特定组合
      - os: ubuntu-latest
        node-version: 22
        coverage: true
    exclude:                          # 排除特定组合
      - os: windows-latest
        node-version: 18