在AKS自托管GitHub Actions中用Kaniko构建ACR镜像遇Node缺失问题

方案1：在Kaniko Job中手动安装Node环境 #

Kaniko官方镜像（如gcr.io/kaniko-project/executor:latest）基于Debian，可通过apt包管理器安装Node.js，之后就能正常使用download-artifact Action：

jobs:
  pre-build:
    runs-on: self-hosted
    steps:
      - name: 检出代码
        uses: actions/checkout@v4
      # 其他前置步骤：生成配置文件、编译代码等
      - name: 上传构建上下文
        uses: actions/upload-artifact@v4
        with:
          name: build-context
          path: ./path-to-your-context

  build-with-kaniko:
    runs-on: self-hosted
    container:
      image: gcr.io/kaniko-project/executor:latest
      options: --user root # 需要root权限安装包
    steps:
      - name: 安装Node.js
        run: |
          apt-get update && apt-get install -y nodejs npm
          npm install -g npm@latest # 可选：更新npm
      - name: 下载构建上下文
        uses: actions/download-artifact@v4
        with:
          name: build-context
          path: ./build-context
      - name: 构建并推送镜像到ACR
        run: |
          echo "{\"auths\":{\"${{ secrets.ACR_REGISTRY }}\":{\"username\":\"${{ secrets.ACR_USERNAME }}\",\"password\":\"${{ secrets.ACR_PASSWORD }}\"}}}" > /kaniko/.docker/config.json
          /kaniko/executor \
            --context ./build-context \
            --dockerfile ./build-context/Dockerfile \
            --destination ${{ secrets.ACR_REGISTRY }}/your-image:${{ github.sha }}

方案2：跳过download-artifact Action，直接用curl下载工件 #

如果不想在Kaniko镜像中安装Node，可利用GitHub的工件API直接下载，无需依赖Node环境：

jobs:
  pre-build:
    # 同方案1的pre-build步骤

  build-with-kaniko:
    runs-on: self-hosted
    container:
      image: gcr.io/kaniko-project/executor:latest
    steps:
      - name: 下载构建上下文
        run: |
          # 获取工件下载URL
          ARTIFACT_URL=$(curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
            "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
            | grep -E 'browser_download_url.*build-context' | cut -d '"' -f 4)
          # 下载并解压工件
          curl -L -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" $ARTIFACT_URL -o build-context.zip
          unzip build-context.zip -d ./build-context
      - name: 构建并推送镜像到ACR
        # 同方案1的构建步骤

方案3：自定义包含Node环境的Kaniko镜像 #

如果需要长期使用，可预先构建一个包含Node.js的Kaniko镜像，推送到ACR或其他镜像仓库，之后在Job中直接使用该自定义镜像：

自定义镜像Dockerfile #

FROM gcr.io/kaniko-project/executor:latest
USER root
RUN apt-get update && apt-get install -y nodejs npm && npm install -g npm@latest
USER kaniko

推送自定义镜像到ACR #

az acr build --registry your-acr-name --image kaniko-with-node:latest .

GitHub Actions Job中使用自定义镜像 #

jobs:
  build-with-kaniko:
    runs-on: self-hosted
    container:
      image: your-acr-name.azurecr.io/kaniko-with-node:latest
      options: --user root # 若需要root权限执行步骤
    steps:
      - name: 下载构建上下文
        uses: actions/download-artifact@v4
        with:
          name: build-context
          path: ./build-context
      # 后续构建推送步骤同方案1

方案4：在同一个Job中完成前置步骤与Kaniko构建 #

如果AKS自托管Runner的节点环境本身支持运行Kaniko二进制（无需Docker），可合并两个Job，在Runner环境中完成前置步骤后，直接调用Kaniko执行构建：

jobs:
  build-and-push:
    runs-on: self-hosted
    steps:
      - name: 检出代码
        uses: actions/checkout@v4
      # 执行所有前置步骤：生成配置、编译代码等
      - name: 下载Kaniko二进制
        run: |
          curl -L https://github.com/GoogleContainerTools/kaniko/releases/download/v1.22.0/kaniko-executor_v1.22.0_linux_amd64.tar.gz | tar xz
      - name: 构建并推送镜像到ACR
        run: |
          echo "{\"auths\":{\"${{ secrets.ACR_REGISTRY }}\":{\"username\":\"${{ secrets.ACR_USERNAME }}\",\"password\":\"${{ secrets.ACR_PASSWORD }}\"}}}" > ./config.json
          ./kaniko-executor \
            --context ./ \
            --dockerfile ./Dockerfile \
            --destination ${{ secrets.ACR_REGISTRY }}/your-image:${{ github.sha }} \
            --docker-config ./config.json

内容的提问来源于stack exchange，提问作者Felipe