使用github actin做CICD并集成git secrets

name: CICD

# 触发流水线的条件
on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "build"
  build:
    # runs-on 后面是runner所在服务器的tag
    runs-on: [ myTag ]
    # container下面的配置是用来在上面的服务器上启动一个docker作为流水线实际执行的环境
    # 这几如果使用的docker hub的公开镜像就不需要credentials，如果是私有仓库就需要配置
    container:
      image: xxxxxxxxxxxxxxxxxxxxxxx
      credentials:
        # ${{secrets.xxxxxxxxxxx}} 是利用了github的secrets功能，在repo的setting-->Secrets里面可以添加需要的
        # 秘钥和token等信息，然后以${{secrets.xxxxxxxxxxx}}形式在workflow中使用，这一点比起jenkins要好很多
        username: ${{secrets.xxxxxxxxxxx}}
        password: ${{secrets.xxxxxxxxxx}}
      env:
       # 设置容器内的环境变量
        AAA: BBB

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # 正式开始编辑之前先清理环境，
      # rm -rf * 不能删除隐藏目录，所以 .git 要单独删除，因为git secrets 相关的配置文件都在这里面，
      # 如果不删除的话，在执行git secrets --scan命令的时候shell退出码会返回1，这样action 的workflow就会失败
      # 我在这里花了一天时间....
      - name: Initial Env
        run: |
          rm -rf *
          rm -rf .git
          ls -a
          
      # 利用官方的action把代码拉下来
      - uses: actions/checkout@v2

      - name: Secrets Scan
        run: |
          git secrets --install -f
          git secrets --register-aws
          git secrets --add --allowed .github/workflows/main.yml:.*
          git secrets --add xxxxxxxxxxx
          git secrets --scan

      - name: Stg Build Image
        if: ${{github.ref != 'refs/heads/master'}}
        run: |
          Stg Build Command
      
      # 利用if语法和分支名称条件来判断应该发布到测试环境还是生产环境
      - name: Stg Deploy
        if: ${{github.ref != 'refs/heads/master'}}
        run: |
          Stg Deploy Command
          
      - name: Prod Build Image
        if: ${{github.ref == 'refs/heads/master'}}
        run: |
          Prod Build Command
          
      - name: Prod Deploy
        if: ${{github.ref == 'refs/heads/master'}}
        run: |
          Prod Build Command
       
      # 最后记得要清理环境，尽量避免信息泄露
      - name: Clean up
        run: |
          rm -rf *
          rm -rf .git