Github actions 可重用工作流程目前不支持环境。我的黑客行为会阻止 secret 发挥作用吗？

Question

我在每个作业上使用输出作为 hack，以使 Github 环境能够控制我的可重用工作流程是否运行。

我唯一关心的是“ENV_AWS_ACCESS_KEY_ID”和“ENV_AWS_SECRET_ACCESS_KEY”。这些 secret 是特定于环境的。可重用工作流程如何知道我传递的 secret 是什么？

如果同时运行两个环境，当前设置是否存在被覆盖的风险？

name: Used to rollback docker containers

on:
  workflow_call:
    inputs:
      tag_to_identify_containers:
        description: The last known containers prior to deployment
        type: choice
        required: true
        options:
          - last-known-testing
          - last-known-integrate
          - last-known-production
      new_tag_to_apply_to_containers:
        type: choice
        required: true
        options:
        - testing-latest
        - integrate-latest
        - production-latest


jobs:

  rollback_on_testing:
    runs-on: ubuntu-latest
    name: Rollback on testing
    outputs:
      signal_deployment: ${{ steps.step_id.outputs.environment }}

    environment:
      name: test
      url: https://test.###/

    steps:
      - id: step_id
        run: echo "::set-output name=environment::test"

  retag_and_rollback_test:
    needs: rollback_on_testing
    if: needs.rollback_on_testing.outputs.signal_deployment == 'test'
    uses: ###/###/.github/workflows/container-tagger.yml@main
    with:
      tag_to_identify_containers: ${{ github.event.inputs.tag_to_identify_containers }}
      new_tag_to_apply_to_containers: ${{ github.event.inputs.new_tag_to_apply_to_containers }}
      aws-region: eu-west-2
      run_cron_and_cycle_containers: true
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.SHARED_AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.SHARED_AWS_SECRET_ACCESS_KEY }}
      ENV_AWS_ACCESS_KEY_ID: ${{ secrets.THIS_AWS_ACCESS_KEY_ID }}
      ENV_AWS_SECRET_ACCESS_KEY: ${{ secrets.THIS_AWS_SECRET_ACCESS_KEY }}

  rollback_on_integrate:
    runs-on: ubuntu-latest
    name: Rollback on Integrate
    outputs:
      signal_deployment: ${{ steps.step_id.outputs.environment }}

    environment:
      name: integrate
      url: https://integrate.###/

    steps:
      - id: step_id
        run: echo "::set-output name=environment::integrate"

  retag_and_rollback_integrate:
    needs: rollback_on_integrate
    if: needs.rollback_on_integrate.outputs.signal_deployment == 'integrate'
    uses: ###/###/.github/workflows/container-tagger.yml@main
    with:
      tag_to_identify_containers: ${{ github.event.inputs.tag_to_identify_containers }}
      new_tag_to_apply_to_containers: ${{ github.event.inputs.new_tag_to_apply_to_containers }}
      aws-region: eu-west-2
      run_cron_and_cycle_containers: true
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.SHARED_AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.SHARED_AWS_SECRET_ACCESS_KEY }}
      ENV_AWS_ACCESS_KEY_ID: ${{ secrets.THIS_AWS_ACCESS_KEY_ID }}
      ENV_AWS_SECRET_ACCESS_KEY: ${{ secrets.THIS_AWS_SECRET_ACCESS_KEY }}


  rollback_on_production:
    runs-on: ubuntu-latest
    name: Rollback on Production
    outputs:
      signal_deployment: ${{ steps.step_id.outputs.environment }}

    environment:
      name: production
      url: https://###/

    steps:
      - id: step_id
        run: echo "::set-output name=environment::production"

  retag_and_rollback_production:
    needs: rollback_on_integrate
    if: needs.rollback_on_integrate.outputs.signal_deployment == 'production'
    uses: ###/###/.github/workflows/container-tagger.yml@main
    with:
      tag_to_identify_containers: ${{ github.event.inputs.tag_to_identify_containers }}
      new_tag_to_apply_to_containers: ${{ github.event.inputs.new_tag_to_apply_to_containers }}
      aws-region: eu-west-2
      run_cron_and_cycle_containers: true
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.SHARED_AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.SHARED_AWS_SECRET_ACCESS_KEY }}
      ENV_AWS_ACCESS_KEY_ID: ${{ secrets.THIS_AWS_ACCESS_KEY_ID }}
      ENV_AWS_SECRET_ACCESS_KEY: ${{ secrets.THIS_AWS_SECRET_ACCESS_KEY }}

Answer 1

一个想法是为 GitHub 可重用工作流程使用矩阵。

name: Reusable workflow with matrix strategy

on:
  push:

jobs:
  ReuseableMatrixJobForDeployment:
    strategy:
      matrix:
        stage: [test, integration, production]
    uses: octocat/octo-repo/.github/workflows/deployment.yml@main
    with:
      environment: ${{ matrix.stage }}
      tag_to_identify_containers: ${{ github.event.inputs.tag_to_identify_containers }}
      new_tag_to_apply_to_containers: ${{ github.event.inputs.new_tag_to_apply_to_containers }}
      aws-region: eu-west-2
      run_cron_and_cycle_containers: true
    secrets: inherit

当 GitHub 运行工作流程时，您的可重用工作流程应将环境“名称”设置为:

jobs:

  rollback_on_testing:
    runs-on: ubuntu-latest
    name: Rollback on testing
    outputs:
      signal_deployment: ${{ steps.step_id.outputs.environment }}

    environment:
      name: ${{inputs.environment}}
      url: https://test.###/

这应该让您可以访问继承的环境 secret ...“ secret :继承”。