如何在GitHub Actions中定义嵌套环境变量？

你遇到的错误是因为GitHub Actions的env字段仅支持键值对形式的字符串变量，不允许嵌套的映射（也就是不能在env里定义dev、qa这类包含子键的对象），直接写嵌套结构会触发"A mapping was not expected"报错。

下面提供两种可行的实现方式，满足你根据分支动态加载对应AWS凭证的需求：

方式一：利用矩阵策略（Matrix）+ 条件筛选 #

通过定义环境矩阵，结合分支条件匹配对应环境配置，逻辑清晰且易维护：

name: push-deploy-docker

on:
  push:
    branches:
      - 'develop'
      - 'master'
      - 'release-*' # 补充release分支匹配规则

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - env: dev
            aws-access-key: ${{ secrets.DEV_AWS_ACCESS_KEY_ID }}
            aws-secret-key: ${{ secrets.DEV_AWS_SECRET_ACCESS_KEY }}
            aws-region: us-east-1 # 替换为dev环境实际区域
          - env: qa
            aws-access-key: ${{ secrets.QA_AWS_ACCESS_KEY_ID }}
            aws-secret-key: ${{ secrets.QA_AWS_SECRET_ACCESS_KEY }}
            aws-region: us-east-1 # 替换为qa环境实际区域
          - env: prod
            aws-access-key: ${{ secrets.PROD_AWS_ACCESS_KEY_ID }}
            aws-secret-key: ${{ secrets.PROD_AWS_SECRET_ACCESS_KEY }}
            aws-region: us-east-1 # 替换为prod环境实际区域
    # 根据当前分支筛选对应的矩阵项
    if: >-
      (github.ref_name == 'master' && matrix.env == 'prod') ||
      (contains(github.ref_name, 'release') && matrix.env == 'qa') ||
      (github.ref_name == 'develop' && matrix.env == 'dev')
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ matrix.aws-access-key }}
          aws-secret-access-key: ${{ matrix.aws-secret-key }}
          aws-region: ${{ matrix.aws-region }}

方式二：通过表达式动态拼接Secret名称 #

不需要额外定义嵌套结构，直接在步骤中根据AWS_ENV的值拼接对应Secret名称，实现动态引用：

name: push-deploy-docker

on:
  push:
    branches:
      - 'develop'
      - 'master'
      - 'release-*'

env:
  AWS_ENV: ${{ github.ref_name == 'master' && 'prod' || contains(github.ref_name, 'release') && 'qa' || 'dev' }}

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets[format('{0}_AWS_ACCESS_KEY_ID', env.AWS_ENV)] }}
          aws-secret-access-key: ${{ secrets[format('{0}_AWS_SECRET_ACCESS_KEY', env.AWS_ENV)] }}
          aws-region: ${{ secrets[format('{0}_AWS_DEFAULT_REGION', env.AWS_ENV)] }}
          # 注意：需提前在仓库Secrets中创建对应环境的区域变量，比如DEV_AWS_DEFAULT_REGION

注意事项 #

• 方式二中的format函数会将AWS_ENV的值（dev/qa/prod）与固定前缀拼接，需确保仓库Secrets命名严格遵循{ENV}_AWS_*格式。
• 若prod环境凭证未定义，需补充对应的PROD_AWS_ACCESS_KEY_ID等Secrets。

内容的提问来源于stack exchange，提问作者Chris Dao