如何将GCP Cloud Build的Django命令转为GitHub Actions工作流？

以下是将你的Cloud Build流程转换为GitHub Actions的完整配置，包含所有对应步骤：

前置准备 #

1. 在GitHub仓库的Settings > Secrets and variables > Actions中添加以下机密：
   • GCP_SERVICE_ACCOUNT_KEY：具有以下权限的GCP服务账号JSON密钥：
     • Cloud Run Admin
     • Cloud SQL Client
     • Secret Manager Secret Accessor
     • Storage Admin
     • Artifact Registry Writer
   • GCP_PROJECT_ID：你的GCP项目ID
   • GCP_REGION：部署区域（如europe-west9）
   • GCP_INSTANCE_NAME：Cloud SQL实例名称（如my-db-instance）
   • GCP_SERVICE_NAME：Cloud Run服务名称（如my-project）

工作流文件（.github/workflows/deploy.yml） #

name: Deploy to Cloud Run
on:
  push:
    branches: [ main ] # 触发部署的分支

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      # 1. 拉取代码
      - name: Checkout code
        uses: actions/checkout@v4

      # 2. 认证到GCP
      - name: Authenticate to GCP
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
          project_id: ${{ secrets.GCP_PROJECT_ID }}

      # 3. 配置Docker访问GCR
      - name: Configure Docker for GCR
        uses: google-github-actions/docker-auth@v2
        with:
          credentials: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
          registries: gcr.io

      # 4. 构建并推送Docker镜像到GCR
      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            gcr.io/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_SERVICE_NAME }}:${{ github.sha }}
            gcr.io/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_SERVICE_NAME }}:latest

      # 5. 从GCP Secret Manager拉取环境变量
      - name: Fetch secrets from GCP Secret Manager
        uses: google-github-actions/get-secretmanager-secrets@v2
        with:
          secrets: |-
            ENVIRONMENT:projects/${{ secrets.GCP_PROJECT_ID }}/secrets/ENVIRONMENT/latest
            SECRET_KEY:projects/${{ secrets.GCP_PROJECT_ID }}/secrets/SECRET_KEY/latest
            DATABASE_URL:projects/${{ secrets.GCP_PROJECT_ID }}/secrets/DATABASE_URL/latest
            GS_BUCKET_NAME:projects/${{ secrets.GCP_PROJECT_ID }}/secrets/GS_BUCKET_NAME/latest
        id: secrets

      # 6. 启动Cloud SQL代理（Unix套接字模式，与原exec-wrapper行为一致）
      - name: Start Cloud SQL Proxy
        uses: google-github-actions/cloud-sql-proxy@v2
        with:
          credentials: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
          project_id: ${{ secrets.GCP_PROJECT_ID }}
          instance: ${{ secrets.GCP_REGION }}:${{ secrets.GCP_INSTANCE_NAME }}
          unix_socket: /tmp/cloudsql

      # 7. 执行Django数据库迁移
      - name: Run Django migrations
        run: |
          docker run --rm \
            -v /tmp/cloudsql:/tmp/cloudsql \
            -e ENVIRONMENT="${{ steps.secrets.outputs.ENVIRONMENT }}" \
            -e SECRET_KEY="${{ steps.secrets.outputs.SECRET_KEY }}" \
            -e DATABASE_URL="${{ steps.secrets.outputs.DATABASE_URL }}" \
            -e GS_BUCKET_NAME="${{ steps.secrets.outputs.GS_BUCKET_NAME }}" \
            gcr.io/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_SERVICE_NAME }}:latest \
            python manage.py migrate

      # 8. 收集静态文件
      - name: Collect static files
        run: |
          docker run --rm \
            -v /tmp/cloudsql:/tmp/cloudsql \
            -e ENVIRONMENT="${{ steps.secrets.outputs.ENVIRONMENT }}" \
            -e SECRET_KEY="${{ steps.secrets.outputs.SECRET_KEY }}" \
            -e DATABASE_URL="${{ steps.secrets.outputs.DATABASE_URL }}" \
            -e GS_BUCKET_NAME="${{ steps.secrets.outputs.GS_BUCKET_NAME }}" \
            gcr.io/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_SERVICE_NAME }}:latest \
            python manage.py collectstatic --verbosity 2 --no-input

      # 9. 部署到Cloud Run（若原流程未自动部署，可添加此步骤）
      - name: Deploy to Cloud Run
        uses: google-github-actions/deploy-cloudrun@v2
        with:
          service: ${{ secrets.GCP_SERVICE_NAME }}
          region: ${{ secrets.GCP_REGION }}
          image: gcr.io/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_SERVICE_NAME }}:latest
          env_vars: |-
            ENVIRONMENT=${{ steps.secrets.outputs.ENVIRONMENT }}
            SECRET_KEY=${{ steps.secrets.outputs.SECRET_KEY }}
            DATABASE_URL=${{ steps.secrets.outputs.DATABASE_URL }}
            GS_BUCKET_NAME=${{ steps.secrets.outputs.GS_BUCKET_NAME }}

关键步骤说明 #

• 镜像构建推送：使用docker/build-push-action替代Cloud Build的docker构建步骤，同时推送到GCR。
• Secret Manager集成：通过google-github-actions/get-secretmanager-secrets直接拉取GCP Secret Manager中的机密，无需手动复制到GitHub Secrets。
• Cloud SQL访问：使用google-github-actions/cloud-sql-proxy创建Unix套接字，挂载到容器中，与原exec-wrapper的数据库访问方式完全一致。
• 命令执行：通过docker run直接在构建好的镜像中执行Django命令，传递所需环境变量。

内容的提问来源于stack exchange，提问作者bolino