注: GitHub 托管的运行器目前在 GitHub Enterprise Server 上不受支持。 您可以在 GitHub 公共路线图 上查看有关未来支持计划的更多信息。
简介
本指南介绍如何使用 GitHub Actions 构建容器化应用程序,将其推送到 Amazon Elastic Container Registry (ECR),以及要推送到 main
分支时将其部署到 Amazon Elastic Container Service (ECS)。
在每次推送到 GitHub 仓库中的 main
时,GitHub Actions 工作流程将构建新的容器� 像并将其推送到 Amazon ECR,然后将新的任务定义部署到 Amazon ECS。
基本要求
在创建 GitHub Actions 工作流程之前,首先需要对 Amazon ECR 和 ECS 完成以下设置步骤:
-
创建 Amazon ECR 仓库以存储� 像。
例如,使用 AWS CLI:
Shell aws ecr create-repository \ --repository-name MY_ECR_REPOSITORY \ --region MY_AWS_REGION
Ensure that you use the same Amazon ECR repository name (represented here by
MY_ECR_REPOSITORY
) for theECR_REPOSITORY
variable in the workflow below.Ensure that you use the same AWS region value for the
AWS_REGION
(represented here byMY_AWS_REGION
) variable in the workflow below. -
Create an Amazon ECS task definition, cluster, and service.
For details, follow the Getting started wizard on the Amazon ECS console, or the Getting started guide in the Amazon ECS documentation.
Ensure that you note the names you set for the Amazon ECS service and cluster, and use them for the
ECS_SERVICE
andECS_CLUSTER
variables in the workflow below. -
Store your Amazon ECS task definition as a JSON file in your GitHub repository.
The format of the file should be the same as the output generated by:
Shell aws ecs register-task-definition --generate-cli-skeleton
Ensure that you set the
ECS_TASK_DEFINITION
variable in the workflow below as the path to the JSON file.Ensure that you set the
CONTAINER_NAME
variable in the workflow below as the container name in thecontainerDefinitions
section of the task definition. -
Create GitHub Actions secrets named
AWS_ACCESS_KEY_ID
andAWS_SECRET_ACCESS_KEY
to store the values for your Amazon IAM access key.For more information on creating secrets for GitHub Actions, see "Encrypted secrets."
See the documentation for each action used below for the recommended IAM policies for the IAM user, and methods for handling the access key credentials.
-
Optionally, configure a deployment environment. 环境用于描述一般的部署目� �,如
生产
、暂存
或开发
。 当 GitHub Actions 工作流程部署到某个环境时,该环境将显示在存储库的主页上。 您可以使用环境来要求批准才能继续作业,限制哪些分支可以触发工作流程,或限制对机密的访问。 有关创建环境的更多信息,请参阅“使用环境进行部署”。
Creating the workflow
Once you've completed the prerequisites, you can proceed with creating the workflow.
The following example workflow demonstrates how to build a container image and push it to Amazon ECR. It then updates the task definition with the new image ID, and deploys the task definition to Amazon ECS.
Ensure that you provide your own values for all the variables in the env
key of the workflow.
如果配置了部署环境,请将 environment
的值更改为环境的名称。 如果未配置环境,则� 除 environment
键。
# 此工作流使用未经 GitHub 认证的操作。
# 它们由第三方提供,并受
# 单独的服务条款、隐私政策和支持
# 文档管理。
name: Deploy to Amazon ECS
on:
push:
branches:
- main
env:
AWS_REGION: MY_AWS_REGION # set this to your preferred AWS region, e.g. us-west-1
ECR_REPOSITORY: MY_ECR_REPOSITORY # set this to your Amazon ECR repository name
ECS_SERVICE: MY_ECS_SERVICE # set this to your Amazon ECS service name
ECS_CLUSTER: MY_ECS_CLUSTER # set this to your Amazon ECS cluster name
ECS_TASK_DEFINITION: MY_ECS_TASK_DEFINITION # set this to the path to your Amazon ECS task definition
# file, e.g. .aws/task-definition.json
CONTAINER_NAME: MY_CONTAINER_NAME # set this to the name of the container in the
# containerDefinitions section of your task definition
jobs:
deploy:
name: Deploy
runs-on: ubuntu-latest
environment: production
steps:
- name: Checkout
uses: actions/checkout@v2
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@13d241b293754004c80624b5567555c4a39ffbe3
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ env.AWS_REGION }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@aaf69d68aa3fb14c1d5a6be9ac61fe15b48453a2
- name: Build, tag, and push image to Amazon ECR
id: build-image
env:
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
IMAGE_TAG: ${{ github.sha }}
run: |
# Build a docker container and
# push it to ECR so that it can
# be deployed to ECS.
docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
- name: Fill in the new image ID in the Amazon ECS task definition
id: task-def
uses: aws-actions/amazon-ecs-render-task-definition@97587c9d45a4930bf0e3da8dd2feb2a463cf4a3a
with:
task-definition: ${{ env.ECS_TASK_DEFINITION }}
container-name: ${{ env.CONTAINER_NAME }}
image: ${{ steps.build-image.outputs.image }}
- name: Deploy Amazon ECS task definition
uses: aws-actions/amazon-ecs-deploy-task-definition@de0132cf8cdedb79975c6d42b77eb7ea193cf28e
with:
task-definition: ${{ steps.task-def.outputs.task-definition }}
service: ${{ env.ECS_SERVICE }}
cluster: ${{ env.ECS_CLUSTER }}
wait-for-service-stability: true
其他资源
有关原始入门工作流程,请参阅 GitHub Actions starter-workflows
仓库中的 aws.yml
。
有关这些示例中使用的服务的详细信息,请参阅以下文档:
- Amazon AWS 文档中的“IAM 中的安全最佳实践”。
- 正式 AWS“配置 AWS 凭据”操作。
- 正式 AWS Amazon ECR“登录”操作。
- 正式 AWS Amazon ECS“渲染任务定义”操作。
- 正式 AWS Amazon ECS“部署任务定义”操作。