Github Actions：PR合并后如何从main分支部署到受保护Sandbox环境？

我们的GitHub仓库配置了名为Sandbox的受保护环境，仅允许main分支向其部署。需求是当带有「Sandbox」标签的Pull Request（PR）合并至main分支时，自动触发部署到该环境。当前使用的工作流能正常触发，但会尝试从功能分支而非main分支部署，因环境受保护导致失败。当前工作流代码如下：

name: Pull Request Merged

concurrency:
  group: ${{ github.ref }}

on:
  pull_request:
    types: [closed]

jobs:
  deploy_to_sandbox:
    if: |
      github.event.pull_request.merged == true && 
      contains(github.event.pull_request.labels.*.name, 'Sandbox')
    name: Deploy to Sandbox
    uses: ./.github/workflows/deploy.yml
    with:
      environment: Sandbox
    secrets: inherit

问题根源 #

当前工作流触发的是pull_request closed事件，此时GitHub Actions的上下文默认关联的是PR的功能分支，而非合并后的main分支，导致部署时使用的是功能分支代码，违反了Sandbox环境的分支保护规则。

解决方案 #

方案一：修改现有工作流，强制拉取main分支部署 #

在部署前添加checkout步骤，明确拉取main分支的代码，确保部署基于main分支执行：

name: Pull Request Merged

concurrency:
  group: sandbox-deploy

on:
  pull_request:
    types: [closed]

jobs:
  deploy_to_sandbox:
    if: |
      github.event.pull_request.merged == true && 
      contains(github.event.pull_request.labels.*.name, 'Sandbox')
    name: Deploy to Sandbox
    runs-on: ubuntu-latest
    steps:
      - name: Checkout main branch
        uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0
      - name: Trigger deployment
        uses: ./.github/workflows/deploy.yml
        with:
          environment: Sandbox
        secrets: inherit

说明：

• 替换原工作流中直接调用deploy.yml的逻辑，先拉取main分支再触发部署
• 调整concurrency的group为固定值sandbox-deploy，避免不同PR合并时的并发冲突（可根据需求调整）

方案二：改用push事件监听main分支，过滤合并PR的标签 #

这种方案更贴合GitHub Actions的触发逻辑，直接监听main分支的push事件，同时验证该push来自带有Sandbox标签的PR合并：

name: Deploy to Sandbox on PR Merge

concurrency:
  group: sandbox-deploy

on:
  push:
    branches: [main]

jobs:
  check_pr_labels:
    name: Verify merged PR has Sandbox label
    outputs:
      has_sandbox_label: ${{ steps.check_label.outputs.has_label }}
    runs-on: ubuntu-latest
    steps:
      - name: Fetch merged PR details
        id: get_pr
        uses: actions/github-script@v7
        with:
          script: |
            const pulls = await github.rest.pulls.list({
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'closed',
              base: 'main',
              sort: 'updated',
              direction: 'desc'
            });
            const targetPR = pulls.data.find(pr => pr.merged_at && pr.merge_commit_sha === context.sha);
            const hasSandboxLabel = targetPR ? targetPR.labels.some(l => l.name === 'Sandbox') : false;
            core.setOutput('has_label', hasSandboxLabel.toString());
      - name: Export label check result
        id: check_label
        run: echo "has_label=${{ steps.get_pr.outputs.has_label }}" >> $GITHUB_OUTPUT

  deploy_to_sandbox:
    needs: check_pr_labels
    if: ${{ needs.check_pr_labels.outputs.has_sandbox_label == 'true' }}
    name: Deploy to Sandbox
    uses: ./.github/workflows/deploy.yml
    with:
      environment: Sandbox
    secrets: inherit

说明：

• 监听main分支的push事件，天然基于main分支执行，无需额外切换分支
• 通过github-script查询与当前提交对应的合并PR，验证是否带有Sandbox标签
• 只有标签验证通过时才触发部署，完全符合需求

推荐方案 #

方案二更推荐，它逻辑更清晰，避免了分支切换的额外步骤，且完全贴合GitHub Actions的事件触发机制，能更可靠地满足从main分支部署的要求。

内容的提问来源于stack exchange，提问作者Hermann.Gruber