如何基于输入反转GitHub Workflow中的作业执行顺序？

当然可以通过GitHub Workflows的输入参数和动态依赖来实现基于操作类型的作业顺序切换，下面是两种实用方案：

方案一：用输入参数动态控制作业依赖 #

1. 给工作流定义一个action_type输入参数，用来区分是apply还是destroy操作
2. 在每个作业的needs字段中使用条件表达式，根据输入值动态调整依赖关系

示例Workflow代码：

name: Terraform Deploy/Destroy
on:
  workflow_dispatch:
    inputs:
      action_type:
        description: '操作类型'
        required: true
        default: 'apply'
        type: choice
        options:
          - apply
          - destroy

jobs:
  job1-vpc:
    runs-on: ubuntu-latest
    needs: ${{ inputs.action_type == 'destroy' && 'job2-alb' || '' }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Terraform ${{ inputs.action_type }} VPC
        run: |
          cd vpc-module
          terraform init
          terraform ${{ inputs.action_type }} -auto-approve

  job2-alb:
    runs-on: ubuntu-latest
    needs: ${{ inputs.action_type == 'apply' && 'job1-vpc' || '' }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Terraform ${{ inputs.action_type }} ALB
        run: |
          cd alb-module
          terraform init
          terraform ${{ inputs.action_type }} -auto-approve

• 当选择apply时，job2-alb依赖job1-vpc，按正常顺序执行
• 当选择destroy时，job1-vpc依赖job2-alb，实现自下而上的销毁顺序

方案二：拆分独立的销毁作业序列 #

直接为销毁操作单独定义一套作业顺序，和部署流程完全分开，通过触发条件区分执行哪一套：

示例Workflow代码：

name: Terraform Operations
on:
  workflow_dispatch:
    inputs:
      action_type:
        description: '操作类型'
        required: true
        type: choice
        options:
          - apply
          - destroy

jobs:
  # 部署流程：VPC → ALB
  apply-vpc:
    if: inputs.action_type == 'apply'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Terraform apply VPC
        run: |
          cd vpc-module
          terraform init
          terraform apply -auto-approve

  apply-alb:
    if: inputs.action_type == 'apply'
    runs-on: ubuntu-latest
    needs: apply-vpc
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Terraform apply ALB
        run: |
          cd alb-module
          terraform init
          terraform apply -auto-approve

  # 销毁流程：ALB → VPC
  destroy-alb:
    if: inputs.action_type == 'destroy'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Terraform destroy ALB
        run: |
          cd alb-module
          terraform init
          terraform destroy -auto-approve

  destroy-vpc:
    if: inputs.action_type == 'destroy'
    runs-on: ubuntu-latest
    needs: destroy-alb
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Terraform destroy VPC
        run: |
          cd vpc-module
          terraform init
          terraform destroy -auto-approve

这种方式逻辑更清晰，作业职责明确，适合组件较多的场景。

补充：Terraform层面的依赖加固 #

虽然你已经在处理Terraform层面的依赖，但还是建议在模块间明确配置depends_on或者通过变量引用建立隐式依赖，比如ALB模块引用VPC的子网ID。这样即使Workflow偶尔出现顺序问题，Terraform自身的依赖解析也能保证销毁操作的正确性，双重保险。

内容的提问来源于stack exchange，提问作者sakula