Lo lus teb luv luv: Thaum GitHub Actions lossis GitHub API yuav nres tau ntau teev, yuav tsum npaj ib txoj kev CI/CD nyob sab nraud GitHub, muaj source-code mirror uas nkag tau ywj pheej, muaj artefact repository lossis container registry uas tsis nyob hauv tib qho chaw yuav ua rau muaj teeb meem, muaj cov ntawv theej ntawm configuration thiab secret uas xav tau, nrog rau runbook hloov mus siv txoj kev ntawd uas twb tau xyaum lawm.
Tsis txhob suav tias self-hosted runner yog ib qho kev daws teeb meem thaub qab tiav. Runner uas koj tswj tseem yuav tsum txuas rau GitHub kom tau txais job thiab rub runner version; yog GitHub control plane lossis Actions API ntsib teeb meem, runner yuav tsis tau txais cov hauj lwm tshiab (raws li docs.github.com).
Tsab xov xwm no yog rau pab neeg me thiab cov neeg uas nyuam qhuav ua DevOps. Lub hom phiaj siv tau tiag yog khaws tau peb yam peev xwm: coj lub system rov mus rau qhov xwm txheej nyab xeeb, tsim ib qho artefact ntseeg tau rau kev tso tawm ceev ib zaug thiab rov qab mus rau txheej txheem ib txwm yam tsis tsim keeb kwm kev tso tawm uas rov ua dua. Tsab xov xwm tsis xav tias koj yuav tsum tsim ib lub platform hloov chaw uas loj ib yam li lub tuam txhab loj.
Txiav txim seb yuav tiv thaiv theem kev txuas mus ntxiv li cas
Ua ntej xaiv cuab yeej, txiav txim seb yam twg yuav tsum txuas ntxiv thaum muaj outage. Rau ntau pab neeg, qhov kev xaiv tseem ceeb tsim nyog yog:
- Theem 1 – kev nyab xeeb ntawm kev khiav haujlwm: tsis tso tawm feature tshiab, tab sis tseem rollback rov qab mus rau version ruaj khov uas tab tom khiav.
- Theem 2 – kev tso tawm ceev: build thiab deploy ib qho kev hloov me uas tib neeg twb tshuaj xyuas lawm.
- Theem 3 – kev txuas mus ntxiv puv ntoob: tseem khiav lint, unit test, build, scan thiab deploy cia li yuav luag ib yam li qub.
Pab neeg me yuav tsum ua kom tiav Theem 1 thiab Theem 2 ua ntej. Theem 3 tsuas tsim nyog thaum kev cuam tshuam rau kev tso tawm ua rau muaj kev puas tsuaj loj lossis lub system muaj qhov yuav tsum tau rov qab ua haujlwm hauv lub sijhawm nruj. Qhov no yog kev xaiv txog theem uas lees txais kev pheej hmoo thiab tus nqi khiav haujlwm, tsis yog ib qho technical requirement uas zoo ib yam rau txhua qhov project.
| Hom system | Lub hom phiaj tsim nyog | Txoj kev daws teeb meem tsawg kawg |
|---|---|---|
| Website lossis application uas hloov tsawg | Rollback thiab kev tso tawm ceev | Khaws image uas tau kos npe lawm, runbook rau deploy manually thiab txoj cai ceev uas muaj sijhawm tas |
| SaaS product uas tab tom khiav | Khaws peev xwm kho qhov yuam kev loj | CI/CD hloov chaw rau release branch, registry nyob sab nraud GitHub thiab cov kev kuaj uas yuav tsum muaj |
| System uas lis transaction lossis cov ntaub ntawv tseem ceeb | Txo lub sijhawm uas kev tso tawm nres kom tsawg kawg | Ob txoj kev CI/CD, secret manager ywj pheej, xyaum tsis tu ncua thiab yuav tsum muaj ob tug neeg pom zoo |
Kos daim qauv kev vam khom ntawm pipeline
Tsim ib lub rooj rau txhua qhov kev pabcuam hauv txheej txheem tam sim no. Sau tus tswv, qhov chaw nkag, sijhawm khaws cia, cov cai uas yuav tsum muaj thiab txoj kev kuaj. Yog ib yam twg tsis muaj tus saib xyuas lossis tsis muaj txoj kev nkag thaum GitHub puas, ces yog ib qho single point of failure uas yuav tsum daws.
| Feem | Kev vam khom uas nquag ntsib | Lo lus nug thaum muaj outage | Txoj kev thaub qab |
|---|---|---|---|
| Source code | GitHub repository, Git clone, pull request | Puas rub tau commit uas twb pom zoo lawm? | Git mirror nyob sab nraud GitHub lossis daim qauv theej uas hloov tsis tau thiab sync tsis tu ncua |
| CI | GitHub Actions workflow | Puas khiav test thiab lint tau? | CI/CD ywj pheej lossis script uas khiav hauv zos nrog version uas twb fix lawm |
| Runner | GitHub-hosted runner, self-hosted runner | Runner puas tau txais job tshiab? | Runner uas lwm lub CI system ua tus tswj thiab xa haujlwm |
| Kev vam khom rau build | npm, PyPI, Maven, NuGet, Docker base image | Puas rub tau package thiab image los siv? | Proxy lossis registry mirror uas cais tawm ntawm lub ntsiab lus tsis ua haujlwm |
| Artefact | Actions artifacts, GitHub Packages, image registry | Puas rub tau daim qauv uas twb build tiav lawm los deploy? | Lub chaw khaws artefact ywj pheej, muaj retention meej thiab checksum |
| Cov ntaub ntawv zais | Secrets, signing key, cloud credentials | Puas txheeb xyuas tus kheej tau yam tsis tas siv GitHub? | Secret manager thiab credential xwm txheej ceev uas muaj hnub tas sijhawm |
| Deploy | Cloud API, Kubernetes, VM, CDN | Leej twg muaj cai deploy, thiab yuav ua li cas? | Runbook siv tes lossis ib qho deploy system ywj pheej |
Npaj lwm txoj kev CI/CD
Lwm txoj kev tsis tas khiav txhua workflow. Txoj kev tsawg kawg yuav tsum muab kom raug lub commit lossis lub pob code uas twb pom zoo lawm, nruab dependency los ntawm qhov chaw uas twb tswj hwm lawm, khiav cov kev kuaj uas yuav tsum muaj, tsim ib qho artefact hloov tsis tau, sau cov metadata ntawm build, thiab tsuas deploy tom qab muaj kev pom zoo ywj pheej xwb.
- Muab lub commit uas tau teeb tseg meej los ntawm mirror, tsis txhob nyeem ceg
mainuas tseem nyob rau hauv GitHub. - Nruab dependency los ntawm lockfile, cache lossis proxy registry uas twb tswj hwm version lawm.
- Khiav lint, unit test, kuaj dependency thiab build raws li cov qauv uas tau teeb tseg ua ntej.
- Ntim artefact lossis container image nrog tus lej version uas hloov tsis tau.
- Sau commit SHA, checksum, lub sijhawm build, version ntawm cov cuab yeej thiab tus neeg pom zoo.
- Tsuas deploy tom qab muaj kev pom zoo siv tes lossis muaj ib qho kev tiv thaiv sib npaug.
Control plane, credential thiab log ntawm lwm txoj kev yuav tsum cais tawm ntawm GitHub raws li qib uas lub hom phiaj continuity xav tau. Ib qho CI system tshiab uas tseem rub code, secret, base image thiab artefact los ntawm tib lub service kuj yuav tsuas txo tau qee feem ntawm qhov kev pheej hmoo xwb.
Yog repository siv reusable workflow lossis action sab hauv, thaum hu lawv ces yuav tsum teeb qhov reference rau commit SHA es tsis yog ceg uas hloov tau; qhov no pab kom ruaj khov dua thiab yooj yim tshawb xyuas keeb kwm (raws li docs.github.com).
Qauv khiav xwm txheej ceev los ntawm mirror
Qauv hauv qab no yuav khiav hauv shell ntawm lub tshuab CI xwm txheej ceev lossis lub tshuab ua haujlwm uas twb tau pom zoo lawm, tsis yog hauv GitHub interface. Cov script ci/test-required.shci/test-required.sh ci/build-image.shci/build-image.sh ci/verify-release.sh ci/verify-release.sh ci/deploy-approved.sh thiab ci/deploy-approved.sh yog cov khoom uas koj yuav tsum npaj ua ntej; lawv yuav tsum xa tus error code uas tsis yog 0 thaum kev kuaj lossis deploy ua tsis tiav.
#!/usr/bin/env bash
set -Eeuo pipefail
: "${MIRROR_URL:?Đặt MIRROR_URL tới Git mirror độc lập}"
: "${COMMIT_SHA:?Đặt COMMIT_SHA của commit đã được phê duyệt}"
: "${IMAGE_REPOSITORY:?Đặt IMAGE_REPOSITORY của registry độc lập}"
: "${IMAGE_TAG:?Đặt IMAGE_TAG bất biến, ví dụ release-abc1234}"
: "${DEPLOY_ENV:?Đặt DEPLOY_ENV, ví dụ staging hoặc production}"
WORKDIR="${WORKDIR:-/tmp/emergency-release-${COMMIT_SHA}}"
IMAGE_REF="${IMAGE_REPOSITORY}:${IMAGE_TAG}"
rm -rf -- "$WORKDIR"
git clone --no-checkout "$MIRROR_URL" "$WORKDIR"
git -C "$WORKDIR" fetch --no-tags origin "$COMMIT_SHA"
git -C "$WORKDIR" cat-file -e "${COMMIT_SHA}^{commit}"
git -C "$WORKDIR" checkout --detach "$COMMIT_SHA"
cd "$WORKDIR"
./ci/test-required.sh
./ci/build-image.sh "$IMAGE_REF"
./ci/verify-release.sh "$IMAGE_REF" "$COMMIT_SHA"
printf 'Đã build và kiểm tra %s từ commit %s.\n' "$IMAGE_REF" "$COMMIT_SHA"
printf 'Chỉ tiếp tục sau phê duyệt theo runbook; môi trường: %s\n' "$DEPLOY_ENV"
./ci/deploy-approved.sh "$IMAGE_REF" "$DEPLOY_ENV" "$COMMIT_SHA"
printf 'Đã gửi triển khai %s tới %s. Hãy kiểm tra health check và log triển khai.\n' "$IMAGE_REF" "$DEPLOY_ENV"Hloov cov environment variables nrog cov nqi tiag ua ntej khiav. Qhov xav pom yog code raug checkout hauv detached state ntawm lub commit raug, cov kauj ruam kuaj ua tiav zoo, image muaj reference uas hloov tsis tau, thiab deploy script sau tseg rau ib puag ncig raug. Yog git fetch nrhiav tsis tau lub commit, tsum tam sim ntawd; tsis txhob hloov mus siv ceg tshiab tshaj. Yog kev txheeb xyuas lossis health check ua tsis tiav, tsis txhob txuas ntxiv tso tawm thiab hloov mus rau rollback.
Tsis txhob muab token, private key lossis password tso rau hauv command, repository lossis log. Deploy script yuav tsum rub credential los ntawm secret manager uas cais tawm, txwv cai raws li ib puag ncig, thiab tsis txhob luam tus nqi zais tawm rau standard output.
Cais code, dependency thiab artefact tawm ntawm ib qho failure point
Code: tsim ib qho mirror raws sijhawm mus rau lwm tus provider lossis Git server uas ywj pheej. Sau lub sijhawm sync zaum kawg thiab lub commit tshiab tshaj uas twb muaj hauv mirror. Kuaj raws sijhawm ob qho tib si kev clone thiab kev rub tau lub commit raug, vim mirror uas tsis tau sim restore dua tsuas yog ib qho kev xav xwb.
Artefact: tsis txhob suav Actions artifact ua qhov chaw khaws release mus ntev. Rau txhua release, khaws image lossis binary package rau hauv lub chaw khaws uas muaj retention policy meej, nrog commit SHA, checksum, dependency manifest thiab cov lus qhia rollback.
Dependency: lockfile, cache lossis proxy registry pab kom txoj kev xwm txheej ceev tsis rub version tshiab tshaj thaum muaj teeb meem. Kev build dua nrog dependency tshiab yuav tsim tau artefact uas txawv ntawm daim uas twb kuaj lawm; yog rub tsis tau dependency raug, ces zoo dua rollback lossis tos dua li hla qhov kev kuaj.
Kuaj supply chain: ua kom muaj kev scan dependency txuas ntxiv thaum tsis yog lub sijhawm outage, thiab teeb tseg ua ntej tias yuav daws cov lus ceeb toom li cas ua ntej tso tawm. Yog koj siv GitHub Dependabot, koj yuav saib tau cov lus qhia qhib Dependabot malware alerts; txawm li ntawd los, txoj kev npaj continuity yuav tsum tsis txhob vam khom ib leeg rau GitHub interface lossis API.
Npaj kev nkag mus thiab cov ntaub ntawv zais rau xwm txheej ceev
- Tsim credential deploy xwm txheej ceev uas muaj cai nqaim, muaj sijhawm siv luv, thiab siv rau ib puag ncig uas tsim nyog xwb.
- Xyuas kom muaj tsawg kawg ob tug neeg uas muaj cai pom zoo lossis qhib txoj kev no, kom tsis txhob vam khom ib tug neeg xwb.
- Siv secret manager uas cais tawm ntawm GitHub, muaj access log thiab muaj txheej txheem revoke.
- Khaws thiab tiv thaiv tus signing key ntawm artefact lossis image sib cais; tsis txhob theej private key rau hauv repository, lub computer ntiag tug lossis script file.
- Khaws ib daim npe tiv tauj uas nyob sab nraud GitHub, rau thaum issue, pull request thiab comment nkag tsis tau.
Cai xwm txheej ceev yuav tsum tsis yog ib qho token uas muaj cai tswj txhua yam thiab khaws rau hauv text file. Tom qab siv lawm, revoke lossis rotate credential, kuaj log, thiab sau tseg lub commit, artefact, tus neeg pom zoo thiab lub sijhawm deploy.
Runbook thaum GitHub Actions lossis API pib ua haujlwm tsis zoo
1. Tshawb xyuas thiab lees paub qhov teeb meem ntawm platform
Tshawb xyuas nplooj xwm txheej ntawm GitHub, sim xa ib qho API request uas nyab xeeb, sau lub sijhawm pib muaj qhov yuam kev thiab muab piv rau lwm lub repository lossis workflow. Tsis txhob maj hloov YAML lossis tsim ntau qhov kev khiav dua thaum qhov kev pabcuam tseem tsis ruaj khov.
Yog API xa rov qab tus lej 403 lossis 429, yuav tsum cais qhov rate limit ntawm outage. Ua raws retry-after, lub sijhawm reset thiab siv backoff uas nce zuj zus; kev xa request txuas ntxiv tom qab raug txwv yuav ua rau integration raug thaiv (raws li docs.github.com).
2. Nres ib ntus cov haujlwm uas yuav ua rau qhov teeb meem hnyav dua
- Nres ib ntus auto-deploy, kev migration ntawm cov ntaub ntawv thiab cov job uas muaj kev sau lossis hloov pauv sab nraud ntawm lub system.
- Tsis txhob rho workflow run, artefact lossis runner kom “ntxuav queue”.
- Sau tseg lub commit, qhov release thiab cov kev hloov pauv uas tseem tos.
- Ceeb toom pab pawg tsim kho, pab pawg khiav haujlwm thiab tus neeg saib xyuas khoom lag luam txog xwm txheej los ntawm ib qho communication channel uas tsis yog GitHub.
3. Xaiv hom kev khiav haujlwm
- Hom tos: siv thaum tseem tsis muaj qhov xav tau tso release; tsuas saib xyuas thiab npaj rollback xwb.
- Hom tso release ceev: siv thaum muaj qhov yuam kev loj; khiav route hloov nrog commit uas tau teeb tseg, ua cov kev kuaj yam tsawg kawg nkaus thiab yuav tsum muaj ob tug neeg pom zoo.
- Hom manually uas muaj kev tswj: tsuas siv thaum route CI hloov tseem tsis tau npaj txhij; ib tug neeg build, ib tug neeg tshuaj xyuas log thiab artefact, thiab tsuas yog tus muaj cai cais thiaj li deploy tau.
4. Sau tseg txhua qhov kev nqis tes
Tsim ib daim ntawv teev tseg sab nraud GitHub uas muaj tus lej xwm txheej, lub sijhawm pib, commit uas siv, cov txiaj ntsig kuaj, checksum ntawm artefact, cov neeg pom zoo, cov lus txib deploy, cov txiaj ntsig health check thiab qhov kev txiav txim rollback. Daim ntawv no yuav yog lub hauv paus rau kev sib piv thaum GitHub rov ua haujlwm.
Rov qab ua haujlwm tom qab outage thiab tiv thaiv kev tso releaseซ้ำ
Thaum GitHub rov ua haujlwm li qub, tsis txhob khiav tag nrho cov workflow dua tam sim ntawd. Ua raws li theem no:
- Sib piv cov workflow uas ua tiav, ua tsis tiav, nyob hauv queue thiab cov uas yeej tsis tau tsim ib qho run li.
- Muab lub commit uas tau build hauv route hloov piv rau lub commit uas twb muaj nyob hauv GitHub.
- Kuaj cov artefact thiab production environment kom tsis txhob deploy tib qho kev hloov pauv ob zaug.
- Tsuas khiav dua cov workflow uas tsim nyog; muab qhov tseem ceeb rau commit SHA lossis ib qho event tshiab uas tau txhob txwm tsim.
- Kos kom meej tias qhov release tau ua manually hauv qhov system tswj kev hloov pauv.
- Tshem tawm cov credential ceev, tshuaj xyuas cov cai nkag thiab khaws cov log rau post-incident review.
GitHub tau sau tseg tias thaum muaj incident, tej event yuav tsis tuaj yeem replay tau automatically; yog li tsis txhob xav tias system yuav rov khiav them cov haujlwm uas ploj lawm. Txhua workflow tseem ceeb yuav tsum muaj tus qauv txiav txim kom meej: retry, trigger dua nrog ib lub commit tshiab, lossis hla vim twb tau tso artefact lawm.
Daim ntawv txheeb xyuas ua ntej suav tias txoj kev npaj tiav
- Muaj daim duab qhia dependency thiab tus tswv rau source code, CI, runner, registry, secret thiab deploy.
- Muaj source-code mirror sab nraud GitHub thiab twb tau kuaj tias tuaj yeem rub tau lub commit uas raug.
- Muaj artefact lossis container image nyob hauv ib lub repository ywj pheej, nrog checksum thiab cov ntaub ntawv build.
- Muaj route build–test–deploy hloov uas tsis tas siv GitHub Actions control plane.
- Muaj credential ceev uas txwv cai, muaj hnub tas sijhawm siv thiab muaj txheej txheem tshem tawm.
- Muaj runbook uas qhia meej cov xwm txheej hloov hom, cov neeg pom zoo thiab txheej txheem rollback.
- Muaj txheej txheem tiv thaiv kom tsis txhob build los ntawm dependency uas tsis tau lock version.
- Twb tau xyaum qhov xwm txheej uas GitHub API tsis teb thiab tau kuaj ua ntej hauv ib puag ncig uas tsis yog production.
- Muaj txheej txheem los sib piv workflow, artefact thiab log tom qab GitHub rov qab ua haujlwm.
Qhov chaw pib uas siv tau tiag: ua ntej, ua kom tiav source-code mirror, khaws ib qho release artefact sab nraud GitHub, sau runbook rollback thiab sim khiav build–test–deploy nrog ib lub commit uas tau teeb tseg hauv ib puag ncig uas tsis yog production. Thaum paub tseeb tias route no ua haujlwm lawm, mam li txiav txim seb puas tsim nyog nqis peev rau ib qho CI/CD hloov uas muaj txhij txhua.
Cov ntaub ntawv siv
