如何通过GitHub Actions部署含双容器的ECS服务

一、准备Docker Compose配置 #

先编写docker-compose.yml，明确两个服务的镜像命名规则，对齐ECR仓库地址：

version: '3.8'
services:
  dotnet-api:
    build: ./path-to-dotnet-api  # 替换为你的dotnet项目目录
    image: ${ECR_REPO_URI}/dotnet-api:${IMAGE_TAG}
  nginx:
    build: ./path-to-nginx  # 替换为你的Nginx配置目录
    image: ${ECR_REPO_URI}/nginx:${IMAGE_TAG}

二、GitHub Actions工作流配置 #

以下是完整的工作流YAML，核心解决镜像构建推送和任务定义双容器更新两个问题：

name: Deploy Dual-Container ECS Service

on:
  push:
    branches: [ main ]

env:
  AWS_REGION: us-east-1  # 替换为你的AWS区域
  ECR_REPO_URI: 123456789012.dkr.ecr.us-east-1.amazonaws.com/your-repo-name  # 替换为你的ECR仓库URI
  IMAGE_TAG: ${{ github.sha }}  # 用提交SHA作为镜像标签，确保唯一性
  ECS_CLUSTER: your-ecs-cluster-name  # 替换为你的ECS集群名
  ECS_SERVICE: your-ecs-service-name  # 替换为你的ECS服务名
  ECS_TASK_DEFINITION: .aws/task-definition.json  # 替换为你的任务定义文件路径

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push images with Docker Compose
        run: |
          # 传递环境变量给docker-compose，构建并推送两个镜像
          ECR_REPO_URI=${{ env.ECR_REPO_URI }} IMAGE_TAG=${{ env.IMAGE_TAG }} docker-compose build
          ECR_REPO_URI=${{ env.ECR_REPO_URI }} IMAGE_TAG=${{ env.IMAGE_TAG }} docker-compose push

      - name: Update dotnet-api container in task definition
        id: render-dotnet-task-def
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: ${{ env.ECS_TASK_DEFINITION }}
          container-name: dotnet-api  # 要和任务定义中的容器名一致
          image: ${{ env.ECR_REPO_URI }}/dotnet-api:${{ env.IMAGE_TAG }}

      - name: Update nginx container in task definition
        id: render-nginx-task-def
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: ${{ steps.render-dotnet-task-def.outputs.task-definition }}  # 基于上一步更新后的任务定义继续修改
          container-name: nginx  # 要和任务定义中的容器名一致
          image: ${{ env.ECR_REPO_URI }}/nginx:${{ env.IMAGE_TAG }}

      - name: Deploy to ECS service
        uses: aws-actions/amazon-ecs-deploy-task-definition@v1
        with:
          task-definition: ${{ steps.render-nginx-task-def.outputs.task-definition }}
          service: ${{ env.ECS_SERVICE }}
          cluster: ${{ env.ECS_CLUSTER }}
          wait-for-service-stability: true

关键细节说明 #

• 镜像构建推送：通过环境变量传递ECR地址和镜像标签给docker-compose，一次命令完成两个镜像的构建和推送，无需单独执行docker build。
• 任务定义更新：两次调用amazon-ecs-render-task-definition，第一次更新dotnet容器的镜像地址，第二次基于更新后的任务定义再更新Nginx容器的镜像地址，确保两个容器的镜像都被替换为最新构建的版本。
• 镜像标签唯一性：使用GitHub提交的SHA作为标签，避免镜像覆盖，同时便于追溯部署版本。

内容的提问来源于stack exchange，提问作者Mike