流水线设计

name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.9'
      - run: pip install -r requirements.txt
      - run: pytest -q

缓存依赖

- uses: actions/cache@v4
  with:
    path: ~/.cache/pip
    key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}

部署：打标签自动发布

1. push 标签触发构建镜像
2. 推送到镜像仓库
3. 服务器 watchtower 自动拉取更新

注意事项

• 敏感信息（服务器密钥）用 GitHub Secrets 存储
• 权限遵循最小化原则：permissions: contents: read
• 每个 Job 独立环境，状态检查要等所有 Job 通过