Demo:review build-test-deploy 工作流
Workflow 图应该让依赖和部署 gate 一眼可见,也能帮助发现权限过宽或 secrets 过早暴露。
- deploy job 应通过 needs 依赖 test job。
- 在 workflow 或 job 层设置最小 permissions。
- 生产部署使用 environments 做审批和保护。
name: CI
on: [push, pull_request]
permissions:
contents: read
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: npm test
deploy:
needs: test
environment: production
runs-on: ubuntu-latest
steps:
- run: ./deploy.sh