GitHub Actions Docker CI/CD 完全指南：多平台构建、安全扫描、Registry 推送与生产部署

# .github/workflows/docker.yml
name: Docker CI/CD

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          install: true
          driver-opts: image=moby/buildkit:master

      - name: Login to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          flavor: |
            latest=false
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=,suffix=,format=short

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            BUILDKIT_INLINE_CACHE=1
            BUILD_DATE=${{ github.event.head_commit.timestamp }}
            VCS_REF=${{ github.sha }}

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push to Docker Hub
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ${{ secrets.DOCKERHUB_USERNAME }}/myapp:${{ github.sha }}
            ${{ secrets.DOCKERHUB_USERNAME }}/myapp:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Login to Alibaba Cloud ACR
        uses: docker/login-action@v3
        with:
          registry: registry.cn-hangzhou.aliyuncs.com
          username: ${{ secrets.ACR_USERNAME }}
          password: ${{ secrets.ACR_PASSWORD }}

      - name: Build and push to ACR
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            registry.cn-hangzhou.aliyuncs.com/my-namespace/myapp:${{ github.sha }}
            registry.cn-hangzhou.aliyuncs.com/my-namespace/myapp:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push to ECR
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ${{ steps.login-ecr.outputs.registry }}/my-app:${{ github.sha }}
            ${{ steps.login-ecr.outputs.registry }}/my-app:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push to GHCR
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ghcr.io/${{ github.repository }}:${{ github.sha }}
            ghcr.io/${{ github.repository }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

jobs:
  scan:
    runs-on: ubuntu-latest
    needs: build
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ghcr.io/${{ github.repository }}:${{ github.sha }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH,MEDIUM'
          vuln-type: 'os,library'

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'
          category: 'trivy'

      - name: Scan and fail on critical
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ghcr.io/${{ github.repository }}:${{ github.sha }}
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
          ignore-unfixed: true
          format: 'table'

      - name: Scan with Grype
        uses: anchore/scan-action@v3
        with:
          image: ghcr.io/${{ github.repository }}:${{ github.sha }}
          severity-cutoff: high
          fail-build: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    needs: [build, scan]
    if: github.ref == 'refs/heads/main'
    permissions:
      contents: write
    steps:
      - name: Checkout manifest repo
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          ref: main

      - name: Update Kubernetes manifest
        run: |
          IMAGE="ghcr.io/${{ github.repository }}:${{ github.sha }}"
          sed -i "s|image: .*|image: ${IMAGE}|" k8s/deployment.yaml
          echo "Updated image to ${IMAGE}"

      - name: Commit and push
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add k8s/deployment.yaml
          git diff --cached --quiet || git commit -m "deploy: update image tag to ${{ github.sha }}"
          git push

      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1.0.0
        with:
          host: ${{ secrets.HOST }}
          port: ${{ secrets.SSH_PORT || '22' }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script_stop: true
          script: |
            set -euo pipefail
            cd /opt/myapp
            docker pull ghcr.io/${{ github.repository }}:${{ github.sha }}
            echo "IMAGE_TAG=${{ github.sha }}" > .env
            docker-compose up -d --remove-orphans
            docker system prune -af --volumes

      - name: Build and push with registry cache
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}
          cache-from: type=registry,ref=ghcr.io/${{ github.repository }}:cache
          cache-to: type=registry,ref=ghcr.io/${{ github.repository }}:cache,mode=max

      - name: Set up Docker Buildx with S3 cache
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            image=moby/buildkit:master
          buildkitd-flags: --debug

      - name: Build and push with S3 cache
        uses: docker/build-push-action@v5
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.CACHE_S3_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.CACHE_S3_SECRET }}
          AWS_REGION: us-east-1
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}
          cache-from: type=s3,region=us-east-1,bucket=my-buildkit-cache,prefix=cache/
          cache-to: type=s3,region=us-east-1,bucket=my-buildkit-cache,prefix=cache/,mode=max

  sign:
    runs-on: ubuntu-latest
    needs: build
    permissions:
      id-token: write  # 必需：用于 OIDC 身份验证
      packages: write
    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Sign container image (Keyless)
        env:
          COSIGN_YES: "true"
        run: |
          IMAGE="ghcr.io/${{ github.repository }}:${{ github.sha }}"
          cosign sign --yes \
            -a "repo=${{ github.repository }}" \
            -a "commit=${{ github.sha }}" \
            -a "workflow=${{ github.workflow }}" \
            "${IMAGE}"

      - name: Generate SBOM with Trivy
        run: |
          IMAGE="ghcr.io/${{ github.repository }}:${{ github.sha }}"
          trivy image --format cyclonedx --output sbom.json "${IMAGE}"

      - name: Attach SBOM to signed image
        env:
          COSIGN_YES: "true"
        run: |
          IMAGE="ghcr.io/${{ github.repository }}:${{ github.sha }}"
          cosign attest --yes \
            --predicate sbom.json \
            --type cyclonedx \
            "${IMAGE}"

# ---------- 编译阶段 ----------
FROM golang:1.22-alpine AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download -x
COPY . .
ENV CGO_ENABLED=0 GOOS=linux GOARCH=amd64
RUN go build -ldflags="-s -w" -o /bin/app ./cmd/app

# ---------- 运行时阶段 ----------
FROM gcr.io/distroless/static-debian12:nonroot
WORKDIR /app
COPY --from=builder /bin/app /app/app
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/app/app"]

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
WORKDIR /src
COPY . .
RUN dotnet restore && dotnet publish -c Release -o /app/publish

FROM mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled AS runtime
WORKDIR /app
COPY --from=build /app/publish .
EXPOSE 8080
USER app
ENTRYPOINT ["dotnet", "MyApp.dll"]

  benchmark:
    runs-on: ubuntu-latest
    needs: build
    if: github.event_name == 'pull_request'
    steps:
      - name: Install dive
        run: |
          wget -q https://github.com/wagoodman/dive/releases/download/v0.12.0/dive_0.12.0_linux_amd64.deb
          sudo dpkg -i dive_0.12.0_linux_amd64.deb

      - name: Analyze image size
        run: |
          IMAGE="ghcr.io/${{ github.repository }}:${{ github.sha }}"
          dive --ci --json dive-report.json "${IMAGE}" || true

      - name: Post PR comment with size diff
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const report = JSON.parse(fs.readFileSync('dive-report.json', 'utf8'));
            const sizeMB = (report.image.sizeBytes / 1024 / 1024).toFixed(2);
            const ineffMB = (report.image.inefficientBytes / 1024 / 1024).toFixed(2);
            const body = `📦 镜像基准测试报告\\n- 总大小: ${sizeMB} MB\\n- 浪费空间: ${ineffMB} MB\\n- 效率评分: ${report.image.efficiencyScore}`;
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: body
            });

      - name: Benchmark cache hit rate
        run: |
          docker buildx build \
            --cache-from type=gha \
            --cache-to type=gha,mode=max \
            --progress=plain \
            --output type=cacheonly \
            --platform linux/amd64 \
            . 2>&1 | tee build.log
          HIT=$(grep -c 'importing cache' build.log || true)
          MISS=$(grep -c 'RUN ' build.log || true)
          echo "Cache hit steps: ${HIT}, total RUN steps: ${MISS}"
          echo "hit=${HIT}" >> "$GITHUB_OUTPUT"

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: myapp
  namespace: production
spec:
  replicas: 10
  strategy:
    canary:
      steps:
        - setWeight: 5
        - pause: {duration: 3m}
        - setWeight: 15
        - pause: {duration: 3m}
        - setWeight: 30
        - pause: {duration: 3m}
        - setWeight: 60
        - pause: {duration: 3m}
        - setWeight: 100
      analysis:
        templates:
          - templateName: success-rate
        args:
          - name: service-name
            value: myapp
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
        - name: myapp
          image: ghcr.io/example/myapp:latest
          ports:
            - containerPort: 8080

apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: myapp
  namespace: production
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp
  autoscalerRef:
    apiVersion: autoscaling/v2
    kind: HorizontalPodAutoscaler
    name: myapp
  service:
    port: 8080
    targetPort: 8080
  analysis:
    interval: 30s
    threshold: 5
    maxWeight: 50
    stepWeight: 10
    metrics:
      - name: request-success-rate
        thresholdRange:
          min: 99
        interval: 1m
      - name: request-duration
        thresholdRange:
          max: 500
        interval: 1m
    webhooks:
      - name: load-test
        type: pre-rollout
        url: http://flagger-loadtester.test/
        timeout: 15s
        metadata:
          cmd: "hey -z 1m -q 10 -c 2 http://myapp.production:8080/"

      - name: Trigger Canary deployment
        run: |
          # 更新 GitOps 仓库中的 image tag
          git clone https://x-access-token:${{ secrets.GH_PAT }}@github.com/org/gitops-repo.git
          cd gitops-repo
          yq eval '.spec.template.spec.containers[0].image = "ghcr.io/${{ github.repository }}:${{ github.sha }}"' \
            -i apps/myapp/canary.yaml
          git add apps/myapp/canary.yaml
          git commit -m "canary: promote image to ${{ github.sha }}"
          git push origin main

permissions:
  contents: read        # 拉取代码
  packages: write       # 推送镜像到 GHCR
  security-events: write # 上传 SARIF 扫描结果
  id-token: write       # OIDC 身份令牌（用于 Cosign Keyless 签名）

      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsRole
          aws-region: us-east-1

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10

name: Hardened Docker CI/CD

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  packages: write
  security-events: write
  id-token: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout (pinned SHA)
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Set up Buildx (pinned SHA)
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0

      - name: Login to GHCR
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max