如何在GitHub Actions多Job间复用ECR登录与AWS凭证配置步骤

简化方案 #

你可以通过以下两种方式消除重复配置，其中矩阵构建是最适配你当前场景的方案：

方案1：使用Job矩阵（仅需保留1个Job，无额外文件） #

你三个Job的逻辑完全一致，仅ECR仓库名不同，直接把差异参数放到矩阵配置里即可，重复步骤只需写一次：

jobs:
  build-app:
    runs-on: ubuntu-latest # 可替换为你原本使用的运行环境
    strategy:
      matrix:
        ecr-repo: [reponame, reponame2, reponame3]
    steps:
    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v1
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-1

    - name: Log in to Amazon ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v1

    - name: Build, tag, and push image to Amazon ECR
      env:
        ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        ECR_REPOSITORY: ${{ matrix.ecr-repo }}
        IMAGE_TAG: ${{ github.sha }}
      run: |
        docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
        docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG

配置运行后会自动并行生成3个构建任务，分别对应三个ECR仓库，效果和你原来的三个独立Job完全一致。

方案2：封装可复用工作流（适合跨仓库/多工作流复用） #

如果这套ECR构建逻辑需要在多个仓库或者同一个仓库的多个工作流里用到，可以把公共步骤封装成可复用工作流：

1. 新建公共工作流文件 .github/workflows/reusable-build-ecr.yaml：

name: Reusable ECR Build Push
on:
  workflow_call:
    inputs:
      ecr-repo:
        required: true
        type: string
      aws-region:
        required: false
        type: string
        default: us-east-1
    secrets:
      AWS_ACCESS_KEY_ID:
        required: true
      AWS_SECRET_ACCESS_KEY:
        required: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v1
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: ${{ inputs.aws-region }}

    - name: Log in to Amazon ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v1

    - name: Build, tag, and push image to Amazon ECR
      env:
        ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        ECR_REPOSITORY: ${{ inputs.ecr-repo }}
        IMAGE_TAG: ${{ github.sha }}
      run: |
        docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
        docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG

2. 主工作流直接调用即可，不需要再写重复步骤：

jobs:
  build-app1:
    uses: ./.github/workflows/reusable-build-ecr.yaml
    with:
      ecr-repo: reponame
    secrets: inherit
  build-app2:
    uses: ./.github/workflows/reusable-build-ecr.yaml
    with:
      ecr-repo: reponame2
    secrets: inherit
  build-app3:
    uses: ./.github/workflows/reusable-build-ecr.yaml
    with:
      ecr-repo: reponame3
    secrets: inherit

内容的提问来源于stack exchange，提问作者Vikas Rathore