appsettings.json变量替换失效问题排查与解决请求

问题重现 #

尝试通过GitHub Actions将appsettings.json中的连接字符串替换为GitHub Secrets中的值，再部署到Kubernetes，但替换步骤执行后，文件中的值仍为"substitute from pipeline"。

相关文件内容 #

appsettings.json：

{
  "ConnectionStrings": {
    "DatabaseConnection": "substitute from pipeline"
  }
}

GitHub Actions工作流片段：

jobs:
  build-and-push-image:
    runs-on: ubuntu-latest
    steps:
      # 省略checkout、登录ACR步骤
      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          push: true
          file: ABC.Monitoring/Metrics.Ingestion/Dockerfile
          tags: |
            ${{ secrets.ACR_ENDPOINT }}/${{ env.IMAGE_NAME }}:latest 
            ${{ secrets.ACR_ENDPOINT }}/${{ env.IMAGE_NAME }}:${{ github.run_number }}${{ github.run_attempt }}

  Deploy-Preprod:
    runs-on: ubuntu-latest
    needs: [build-and-push-image]
    steps:
      - uses: actions/checkout@v3
  
      - name: Substitute variables in appsettings.json
        uses: microsoft/variable-substitution@v1
        with:
          files: 'ABC.Monitoring/Metrics.Ingestion/appsettings.json'
        env:
          ConnectionStrings.DatabaseConnection: ${{ secrets.DATABASE_CONNECTION }}

      - name: Deploy to Kubernetes
        uses: Maersk-Global/custom-github-actions-kubernetes-deploy@v1
        # 省略部署参数

核心原因 #

1. 镜像构建与替换步骤顺序错误：build-and-push-image job已将原始appsettings.json打包进镜像并推送至容器仓库，后续Deploy-Preprod job替换的是本地checkout的文件，并未修改镜像内的文件，部署时仍使用旧镜像。
2. 路径匹配问题：Linux环境下文件名和路径区分大小写，需确认指定的文件路径ABC.Monitoring/Metrics.Ingestion/appsettings.json与实际文件结构完全一致。

修复方案 #

方案一：镜像构建前完成变量替换（直接修改镜像内容） #

将替换步骤移至build-and-push-image job中，确保替换后的文件被打包进镜像：

jobs:
  build-and-push-image:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Substitute variables in appsettings.json
        uses: microsoft/variable-substitution@v1
        with:
          files: 'ABC.Monitoring/Metrics.Ingestion/appsettings.json'
        env:
          ConnectionStrings.DatabaseConnection: ${{ secrets.DATABASE_CONNECTION }}

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ secrets.ACR_ENDPOINT }}
          username: ${{ secrets.ACR_USERNAME }}
          password: ${{ secrets.ACR_PASSWORD }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          push: true
          file: ABC.Monitoring/Metrics.Ingestion/Dockerfile
          tags: |
            ${{ secrets.ACR_ENDPOINT }}/${{ env.IMAGE_NAME }}:latest 
            ${{ secrets.ACR_ENDPOINT }}/${{ env.IMAGE_NAME }}:${{ github.run_number }}${{ github.run_attempt }}

方案二：Kubernetes环境变量覆盖（推荐，无需修改镜像） #

利用.NET Core支持环境变量覆盖配置的特性，通过Kubernetes资源直接注入连接字符串：

1. 在Kubernetes部署模板中添加环境变量配置：

   env:
     - name: ConnectionStrings__DatabaseConnection
       valueFrom:
         secretKeyRef:
           name: db-secret
           key: DatabaseConnection
   

2. 在GitHub Actions部署步骤中创建/更新Kubernetes Secret：

   - name: Create/Update Database Secret
     run: |
       kubectl create secret generic db-secret --namespace=${{ env.KUBERNETES_NAMESPACE }} \
         --from-literal=DatabaseConnection=${{ secrets.DATABASE_CONNECTION }} \
         --dry-run=client -o yaml | kubectl apply -f -
   

方案三：验证替换步骤有效性（仅适用于部署本地文件场景） #

若坚持在部署阶段替换文件，需补充验证步骤确认替换结果：

- name: Substitute variables in appsettings.json
  uses: microsoft/variable-substitution@v1
  with:
    files: 'ABC.Monitoring/Metrics.Ingestion/appsettings.json'
  env:
    ConnectionStrings.DatabaseConnection: ${{ secrets.DATABASE_CONNECTION }}

- name: Verify substitution result
  run: cat ABC.Monitoring/Metrics.Ingestion/appsettings.json

同时检查路径大小写是否与实际文件一致，避免因Linux环境大小写敏感导致的路径匹配失败。

内容的提问来源于stack exchange，提问作者PPB