GitHub Actions + DevOps 实战：从 CI 到自动化部署

一句话结论：GitHub Actions = 独立开发者的"免费运维团队"。零成本（2000 分钟/月）/ 完整生态 / 与 Git 深度集成。本文从 CI 到自动化部署，含 8 个实战 Workflow。

背景

2026 年独立开发者必备 DevOps 工具：

• GitHub Actions：CI/CD（首选，免费 2000 分钟/月）
• Docker：容器化（与 7/19 关联）
• Vercel / Cloudflare：部署（与 7/18 / 7/26 关联）
• Playwright：E2E 测试
• Sentry：错误监控
• Dependabot：依赖安全

GitHub Actions 优势：

• 与 GitHub 深度集成
• 免费额度（2000 分钟/月，公共仓库无限）
• 完整 Marketplace（20000+ Action）
• 支持多平台（Linux / macOS / Windows）
• 支持 ARM（Apple Silicon）

6 大核心概念

1. Workflow（工作流）

# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npm ci
      - run: npm test

2. Event（事件）

on:
  push:                          # 推送
  pull_request:                  # PR
  schedule:                      # 定时
    - cron: '0 0 * * *'         # 每天凌晨
  workflow_dispatch:             # 手动触发
  release:                       # 发布
    types: [published]
  issues:                        # Issue
    types: [opened]

3. Job（任务）

jobs:
  test:
    runs-on: ubuntu-latest
    steps: [...]
  
  deploy:
    needs: test                  # 依赖
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'  # 条件
    steps: [...]

4. Step（步骤）

steps:
  - name: Checkout
    uses: actions/checkout@v4
  
  - name: Setup Node
    uses: actions/setup-node@v4
    with:
      node-version: 20
  
  - name: Install
    run: npm ci
  
  - name: Test
    run: npm test
    env:
      API_KEY: ${{ secrets.API_KEY }}

5. Runner（运行环境）

runs-on: ubuntu-latest          # Linux
# runs-on: macos-latest         # macOS
# runs-on: windows-latest       # Windows
# runs-on: ubuntu-22.04-arm     # ARM

6. Action（操作）

# 官方
- uses: actions/checkout@v4
- uses: actions/setup-node@v4

# 社区
- uses: actions/setup-pnpm@v4
- uses: arduino/setup-task@v2

# 自定义
- uses: ./my-action              # 本地 action

8 个实战 Workflow

Workflow 1：基础 CI（Node.js）

# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
      
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
      
      - name: Install
        run: npm ci
      
      - name: TypeScript
        run: npx tsc --noEmit
      
      - name: Lint
        run: npm run lint
      
      - name: Test
        run: npm test
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/test
      
      - name: Build
        run: npm run build
      
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: build
          path: dist/

Workflow 2：多 Node 版本测试

name: Multi-Node Test

on: [push, pull_request]

jobs:
  test:
    runs-on: ubuntu-latest
    
    strategy:
      matrix:
        node-version: [18, 20, 22]
    
    steps:
      - uses: actions/checkout@v4
      
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
      
      - run: npm ci
      - run: npm test

Workflow 3：自动部署到 Vercel（与 7/18 关联）

name: Deploy

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
      
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      
      - name: Install Vercel CLI
        run: npm install -g vercel
      
      - name: Pull Vercel config
        run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}
      
      - name: Build
        run: vercel build --prod --token=${{ secrets.VERCEL_TOKEN }}
      
      - name: Deploy
        run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }}

Workflow 4：Docker 镜像构建推送（与 7/19 关联）

name: Docker Build & Push

on:
  push:
    branches: [main]
    tags: ['v*']

jobs:
  docker:
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}
      
      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            myuser/myapp:latest
            myuser/myapp:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

Workflow 5：E2E 测试（Playwright）

name: E2E Test

on:
  push:
    branches: [main]

jobs:
  e2e:
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
      
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      
      - name: Install
        run: npm ci
      
      - name: Install Playwright
        run: npx playwright install --with-deps
      
      - name: Build
        run: npm run build
      
      - name: Start server
        run: |
          npm start &
          sleep 10
      
      - name: Run tests
        run: npx playwright test
      
      - name: Upload report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: playwright-report/

Workflow 6：安全扫描

name: Security

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '0 0 * * 1'  # 每周一

jobs:
  security:
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
      
      # 依赖漏洞扫描
      - name: npm audit
        run: npm audit --audit-level=moderate
      
      # CodeQL 扫描
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: javascript
      
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
      
      # Secret 扫描
      - name: TruffleHog
        uses: trufflesecurity/trufflehog@main
        with:
          args: --directory=. --json
      
      # SAST
      - name: Semgrep
        uses: returntocorp/semgrep-action@v1

Workflow 7：定时任务（Cron）

name: Daily Backup

on:
  schedule:
    - cron: '0 2 * * *'  # 每天凌晨 2 点
  workflow_dispatch:

jobs:
  backup:
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Backup database
        run: |
          pg_dump ${{ secrets.DATABASE_URL }} > backup.sql
          echo "Backup created: $(date)"
      
      - name: Upload to S3
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
          aws-region: us-east-1
      
      - name: Upload
        run: |
          aws s3 cp backup.sql s3://my-backups/$(date +%Y-%m-%d).sql
      
      - name: Notify Slack
        if: always()
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "Backup ${{ job.status }}: ${{ github.run_id }}"
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

Workflow 8：PR 自动化（AI 评审）

name: AI PR Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  review:
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      
      - name: Get diff
        id: diff
        run: |
          echo "diff<<EOF" >> $GITHUB_OUTPUT
          git diff origin/main...HEAD >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT
      
      - name: AI Review
        uses: actions/github-script@v7
        with:
          script: |
            const diff = `${{ steps.diff.outputs.diff }}`;
            const prompt = `
              审查以下 PR，重点关注：
              1. 性能问题
              2. 安全漏洞
              3. TypeScript 类型安全
              4. 错误处理
              5. 测试覆盖
              
              输出 Markdown 格式的审查报告。
              
              ${diff.slice(0, 8000)}
            `;
            
            const response = await fetch('https://api.anthropic.com/v1/messages', {
              method: 'POST',
              headers: {
                'x-api-key': process.env.ANTHROPIC_API_KEY,
                'anthropic-version': '2023-06-01',
                'content-type': 'application/json',
              },
              body: JSON.stringify({
                model: 'claude-sonnet-4-5',
                max_tokens: 2048,
                messages: [{ role: 'user', content: prompt }],
              }),
            });
            
            const data = await response.json();
            const review = data.content[0].text;
            
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `## 🤖 AI Review\n\n${review}`,
            });
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

5 个常用 Action

1. pnpm 安装

- uses: pnpm/action-setup@v4
  with:
    version: 9

2. 缓存依赖

- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}

3. 上传 / 下载 Artifact

- uses: actions/upload-artifact@v4
  with:
    name: build
    path: dist/

- uses: actions/download-artifact@v4
  with:
    name: build
    path: dist/

4. 设置环境变量

- name: Set env
  run: echo "VERSION=1.0.0" >> $GITHUB_ENV

5. SSH 部署

- name: Deploy via SSH
  uses: appleboy/ssh-action@v1
  with:
    host: ${{ secrets.HOST }}
    username: ${{ secrets.USERNAME }}
    key: ${{ secrets.SSH_KEY }}
    script: |
      cd /app
      git pull
      npm ci
      npm run build
      pm2 restart app

5 个常见坑

坑 1：超时

默认超时 6 小时
免费 runner 内存 7GB

❌ 大型 build 卡死
✅ 拆分 job / 用缓存 / 用自托管 runner

坑 2：免费额度

免费：2000 分钟/月（Linux）
macOS / Windows：10x 计算（更贵）

❌ 大项目频繁跑 CI
✅ 缓存依赖 + 减少触发条件

坑 3：Secret 泄露

# ❌ 错误
echo "API_KEY=$API_KEY" >> $GITHUB_ENV

# ✅ 正确（仅本 step 可见）
env:
  API_KEY: ${{ secrets.API_KEY }}

坑 4：并发问题

# ❌ 多个 PR 同时部署会冲突
on: pull_request

# ✅ 串行部署
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

坑 5：依赖缓存失效

# ✅ 正确缓存 key
- uses: actions/setup-node@v4
  with:
    cache: 'npm'  # 自动用 package-lock.json 作 key

与之前内容的关系

7/17 Rust + Axum         → 后端
7/18 Vercel + Cloudflare → 部署
7/19 Docker              → 容器化
7/20 OWASP               → 安全
7/25 Deno 2 + Hono       → 运行时
7/26 Workers + D1        → 边缘全栈
7/27 GitHub Actions      → DevOps  ← 今天
→ "框架 → 部署 → 容器 → 安全 → 运行时 → 边缘 → 自动化"

7 天落地路径

Day 1：第一个 Workflow

# .github/workflows/ci.yml
name: CI
on: [push]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20 }
      - run: npm ci
      - run: npm test

Day 2：多版本测试

strategy:
  matrix:
    node: [18, 20, 22]

Day 3：自动部署

# Vercel / Cloudflare Pages / Docker Hub

Day 4：E2E 测试

# Playwright

Day 5：安全扫描

# CodeQL / npm audit / TruffleHog

Day 6：定时任务

# Cron Trigger

Day 7：监控 + 优化

# 缓存 / 并发 / 自托管 runner

我的看法

GitHub Actions 是 2026 年独立开发者的"标配 DevOps"：

1. 零成本：免费 2000 分钟/月（个人够用）
2. 完整生态：Marketplace 20000+ Action
3. 深度集成：与 GitHub 代码 / PR / Issue
4. 多平台：Linux / macOS / Windows / ARM
5. 可扩展：自托管 runner + GPU runner

对独立开发者的建议：

• 必装 CI：每次 PR 自动跑测试
• 必装 Deploy：main 分支自动部署
• 必装安全：每周扫描漏洞
• 可选 AI Review：自动 PR 审查

参考

• GitHub Actions 文档
• Workflow 语法
• Marketplace
• Docker（7/19）
• Vercel+Cloudflare（7/18）
• OWASP（7/20）
• Workers + D1（7/26）

---

本文基于 GitHub Actions 2026 年 7 月最新版本。