环境保护与部署门禁：环境规则、审批与 CD 流程

name: Deploy
on:
  push:
    branches: [main]

jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    environment:
      name: staging
      url: https://staging.example.com
    steps:
      - uses: actions/checkout@v4
      - run: ./deploy.sh staging

  deploy-production:
    needs: deploy-staging
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://app.example.com
    steps:
      - run: ./deploy.sh production

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - run: echo "使用环境变量 ${{ vars.REGION }}"
      - run: ./deploy.sh ${{ secrets.DEPLOY_KEY }}

# 引用 production 环境的 job 会：
# 1. 检查当前分支是否在 deployment branches 白名单内
# 2. 命中 wait timer 时先等待指定秒数
# 3. 有 required reviewers 时挂起等待审批
# 全部通过后才真正执行 steps
jobs:
  deploy-production:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - run: echo "开始生产部署"

# 在 Settings → Environments → production → Protection rules 配置：
# Required reviewers: 至少 1 名审批人，可指定 @team

jobs:
  approval-gate:
    runs-on: ubuntu-latest
    environment: production     # 只有这个 job 需要审批
    steps:
      - run: echo "审批通过，放行下游"

  deploy-aws:
    needs: approval-gate
    runs-on: ubuntu-latest
    environment: production
    steps:
      - run: ./deploy-aws.sh

  deploy-k8s:
    needs: approval-gate
    runs-on: ubuntu-latest
    environment: production
    steps:
      - run: ./deploy-k8s.sh

# Settings → Environments → production → Deployment branches
# 支持三类选择器：
# 1. 所有分支（默认）
# 2. 受保护分支（Protected branches）
# 3. 自定义分支选择器
#
# 自定义选择器示例：
# main                      # 仅 main
# releases/*                # 所有 release 前缀分支
# main, releases/v*         # 组合，支持 glob

on:
  workflow_dispatch:              # 手动触发：不限定分支
    inputs:
      environment:
        type: choice
        options: [staging, production]

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment:
      name: ${{ github.event.inputs.environment }}
    steps:
      - run: echo "部署到 ${{ github.event.inputs.environment }}"

name: Deploy
on:
  push:
    branches: [main]

concurrency:
  group: production-deploy          # 同组串行化
  cancel-in-progress: false         # 不要取消在跑的任务，排队等待

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - run: ./deploy.sh

on:
  workflow_dispatch:
    inputs:
      environment:
        required: true
        type: environment

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    concurrency:
      group: env-${{ inputs.environment }}
      cancel-in-progress: false
    steps:
      - run: ./deploy.sh ${{ inputs.environment }}

jobs:
  deploy-production:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - run: ./health-check.sh         # 1. 前置健康检查
      - run: ./deploy.sh               # 2. 执行部署
      - run: ./smoke-test.sh           # 3. 部署后冒烟

# Wait timer 常配合审批使用，例如：
# Wait timer: 300 秒
# 含义：审批通过后仍需等待 5 分钟才真正执行
# 用途：给部署窗口留出「反悔期」，配合 concurrency 排队

name: Deployment Status Notifier
on:
  deployment_status:

jobs:
  notify:
    runs-on: ubuntu-latest
    if: ${{ github.event.deployment_status.state == 'success' }}
    steps:
      - run: echo "部署成功，URL=${{ github.event.deployment_status.environment_url }}"
      - run: ./post-to-slack.sh

const { owner, repo } = context.repo;
const ref = context.sha;

// 创建 deployment
const deployment = await github.rest.repos.createDeployment({
  owner, repo,
  ref,
  environment: 'production',
  production_environment: true,
  required_contexts: [],
});

// 部署完成后回写状态
await github.rest.repos.createDeploymentStatus({
  owner, repo,
  deployment_id: deployment.data.id,
  state: 'success',
  description: '部署完成',
  environment_url: 'https://app.example.com',
});

jobs:
  rollback:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - run: ./rollback-to-last-tag.sh