创建GitHub Release时触发多个Action工作流问题排查

我们配置了GitHub Action用于发布部署，但每次创建Release时，系统会生成3个GitHub Actions任务，而非预期的1个。怀疑是Action配置逻辑错误，以下是具体配置代码：

name: Trigger auto deployment

# When this action will be executed
on:
  # Automatically trigger it when detected changes in repo
  push:
    branches:
      - main
  # Allow manual trigger
  workflow_dispatch:
  pull_request:
    types: ["opened", "edited", "reopened", "synchronize", "ready_for_review"]

jobs:
  fail_if_pull_request_is_draft:
    if: github.event.pull_request.draft == true
    runs-on: ubuntu-latest
    steps:
      - name: Fails in order to indicate that pull request needs to be marked as ready to review
        run: exit 1

  ci:
    name: 🫠 Build, lint, test
    runs-on: ubuntu-latest
    if: github.event.pull_request.draft == false
    timeout-minutes: 30
    services:
      edgedb:
        image: edgedb/edgedb:4
        env:
          EDGEDB_SERVER_SECURITY: insecure_dev_mode
        ports:
          - 5656:5656
    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@v4

      - name: ⎔ Setup node
        uses: actions/setup-node@v4
        with:
          cache: npm
          cache-dependency-path: ./package-lock.json
          node-version: 18

      - name: 📥 Install deps
        run: npm ci

      # We can lint before installing EdgeDB, so do that first to fail fast
      - name: 🔬 Lint
        run: npm run lint

      - name: 💿 Install EdgeDB
        uses: edgedb/setup-edgedb@v1
        with:
          server-dsn: edgedb://localhost:5656
          instance-name: ci_edgedb_instance

      - name: Test edgedb query
        run: edgedb query "SELECT 'Hello from GitHub Actions'"

      # Don't need migration as setup above does it
      - name: 👾 Generate EdgeQL client
        run: npm run db:migrate

      - name: 🔎 Type check
        run: npm run typecheck

      - name: 🏄 Copy test env vars
        run: cp .env.example .en

      - name: 🌱 Seed the database
        run: npm run seed

      - name: 🏗️ Build the server
        run: npm run build

      - name: 🌳 Cypress run
        uses: cypress-io/github-action@v6

        with:
          start: npm run start
          wait-on: "http://localhost:5173"
          record: true
        env:
          PORT: "5173"
          # pass GitHub token to detect new build vs re-run build
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
          # overwrite commit message sent to Cypress Cloud
          COMMIT_INFO_MESSAGE: ${{github.event.pull_request.title}}
          # re-enable PR comment bot
          COMMIT_INFO_SHA: ${{github.event.pull_request.head.sha}}
          # For recording and parallelization to work you must set your CYPRESS_RECORD_KEY
          # in GitHub repo → Settings → Secrets → Actions
          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}

      - name: Archive screenshots
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: screenshots
          path: ./cypress/screenshots

      - name: Archive videos
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cypress-videos
          path: ./cypress/videos

  build-and-deploy:
    name: 🏗️ build and deploy
    runs-on: ubuntu-latest
    if: startsWith( github.ref, 'refs/tags/')
    timeout-minutes: 30
    environment: AXPEnv
    permissions:
      id-token: write
      contents: read
    services:
      edgedb:
        image: edgedb/edgedb:4
        env:
          EDGEDB_SERVER_SECURITY: insecure_dev_mode
        ports:
          - 5656:5656
    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@v4

      - name: ⎔ Setup node
        uses: actions/setup-node@v4
        with:
          cache: npm
          cache-dependency-path: ./package-lock.json
          node-version: 18

      - name: 💿 Install EdgeDB
        uses: edgedb/setup-edgedb@v1
        with:
          server-dsn: edgedb://localhost:5656
          instance-name: ci_edgedb_instance

      - name: ✈️ Azure Login
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: 🤨 Querybuilder
        run: npm run db:migrate

      - name: Build and push container image to registry
        uses: azure/container-apps-deploy-action@v2
        with:
          registryUrl: axpreg.azurecr.io
          registryUsername: ${{ secrets.REGISTRY_USERNAME }}
          registryPassword: ${{ secrets.REGISTRY_PASSWORD }}
          containerAppName: someapp
          resourceGroup: somegroup
          appSourcePath: ${{ github.workspace }}
          imageToBuild: axpreg.azurecr.io/someapp:${{ github.ref_name }}
          environmentVariables: "..."

原因分析 #

创建Release时会同时触发三个符合当前Workflow规则的事件：

1. push事件（分支）：如果Release对应的提交在main分支上，会触发push: branches: [main]规则
2. push事件（标签）：创建Release会推送一个tag，符合build-and-deploy任务的startsWith(github.ref, 'refs/tags/')判断
3. pull_request事件：如果该Release的提交关联了已合并的PR，会触发PR相关的事件规则

这三个事件会各自触发一次Workflow运行，最终生成3个任务。

解决方案 #

1. 拆分Workflow（推荐方案） #

将CI/PR检查和发布部署拆分为两个独立的Workflow，彻底避免触发规则冲突：

第一个Workflow（CI与PR检查）

name: CI & PR Checks

on:
  push:
    branches: [main]
  pull_request:
    types: ["opened", "edited", "reopened", "synchronize", "ready_for_review"]
  workflow_dispatch:

jobs:
  fail_if_pull_request_is_draft:
    if: github.event.pull_request.draft == true
    runs-on: ubuntu-latest
    steps:
      - name: 草稿状态PR终止运行
        run: exit 1

  ci:
    name: 🫠 Build, lint, test
    runs-on: ubuntu-latest
    if: github.event.pull_request.draft == false
    timeout-minutes: 30
    services:
      edgedb:
        image: edgedb/edgedb:4
        env:
          EDGEDB_SERVER_SECURITY: insecure_dev_mode
        ports: [5656:5656]
    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@v4

      - name: ⎔ Setup node
        uses: actions/setup-node@v4
        with:
          cache: npm
          cache-dependency-path: ./package-lock.json
          node-version: 18

      - name: 📥 Install deps
        run: npm ci

      - name: 🔬 Lint
        run: npm run lint

      - name: 💿 Install EdgeDB
        uses: edgedb/setup-edgedb@v1
        with:
          server-dsn: edgedb://localhost:5656
          instance-name: ci_edgedb_instance

      - name: Test edgedb query
        run: edgedb query "SELECT 'Hello from GitHub Actions'"

      - name: 👾 Generate EdgeQL client
        run: npm run db:migrate

      - name: 🔎 Type check
        run: npm run typecheck

      - name: 🏄 Copy test env vars
        run: cp .env.example .env

      - name: 🌱 Seed the database
        run: npm run seed

      - name: 🏗️ Build the server
        run: npm run build

      - name: 🌳 Cypress run
        uses: cypress-io/github-action@v6
        with:
          start: npm run start
          wait-on: "http://localhost:5173"
          record: true
        env:
          PORT: "5173"
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
          COMMIT_INFO_MESSAGE: ${{github.event.pull_request.title}}
          COMMIT_INFO_SHA: ${{github.event.pull_request.head.sha}}
          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}

      - name: Archive screenshots
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: screenshots
          path: ./cypress/screenshots

      - name: Archive videos
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cypress-videos
          path: ./cypress/videos

第二个Workflow（发布部署）

name: Build & Deploy

on:
  push:
    tags: ['*'] # 仅在推送标签时触发
  workflow_dispatch: # 保留手动触发选项

jobs:
  build-and-deploy:
    name: 🏗️ build and deploy
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment: AXPEnv
    permissions:
      id-token: write
      contents: read
    services:
      edgedb:
        image: edgedb/edgedb:4
        env:
          EDGEDB_SERVER_SECURITY: insecure_dev_mode
        ports: [5656:5656]
    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@v4

      - name: ⎔ Setup node
        uses: actions/setup-node@v4
        with:
          cache: npm
          cache-dependency-path: ./package-lock.json
          node-version: 18

      - name: 💿 Install EdgeDB
        uses: edgedb/setup-edgedb@v1
        with:
          server-dsn: edgedb://localhost:5656
          instance-name: ci_edgedb_instance

      - name: ✈️ Azure Login
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: 🤨 Querybuilder
        run: npm run db:migrate

      - name: Build and push container image to registry
        uses: azure/container-apps-deploy-action@v2
        with:
          registryUrl: axpreg.azurecr.io
          registryUsername: ${{ secrets.REGISTRY_USERNAME }}
          registryPassword: ${{ secrets.REGISTRY_PASSWORD }}
          containerAppName: someapp
          resourceGroup: somegroup
          appSourcePath: ${{ github.workspace }}
          imageToBuild: axpreg.azurecr.io/someapp:${{ github.ref_name }}
          environmentVariables: "..."

2. 原Workflow内添加事件判断（不推荐） #

如果不想拆分Workflow，可以给每个job的if条件增加事件类型过滤：

• PR相关job：if: github.event_name == 'pull_request' && github.event.pull_request.draft == true
• CI job：if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.draft == false)
• 部署job：if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')

这种方式会让配置逻辑复杂化，长期维护成本高，不推荐使用。

内容的提问来源于stack exchange，提问作者Yunti