GitHub Actions误用develop分支提交而非main分支的问题排查

当前存在两个GitHub Actions工作流，部署生产环境时始终使用develop分支的最新提交SHA，而非目标main分支，以下是问题分析与解决方案：

相关工作流配置 #

1. 生产部署工作流（Deploy to Production） #

name: Deploy to Production

on:
    workflow_run:
        workflows: [ "CI - Tests & Quality" ]
        types: [ completed ]
        branches: [ main ]
    workflow_dispatch:
        inputs:
            skip_tests:
                description: 'Skip test requirement (emergency only)'
                required: false
                type: boolean
                default: false

env:
    DEPLOY_PATH: ${{ vars.PRODUCTION_PATH }}

jobs:
    pre-deploy-checks:
        name: Pre-deployment Checks
        runs-on: ubuntu-latest
        if: |
            github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch'
        outputs:
            deployment-id: ${{ steps.prepare.outputs.deployment_id }}
        
        steps:
            -   name: Prepare deployment with branch validation
                id: prepare
                run: |
                    if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
                        COMMIT_SHA="${{ github.sha }}"
                        BRANCH="main"
                    else
                        WORKFLOW_BRANCH="${{ github.event.workflow_run.head_branch }}"

                        if [ "$WORKFLOW_BRANCH" != "main" ]; then
                            echo "❌ Deployment cancelled: CI workflow ran on branch '${WORKFLOW_BRANCH}', not 'main'"
                            exit 1
                        fi
                    
                        COMMIT_SHA="${{ github.event.workflow_run.head_sha }}"
                        BRANCH="$WORKFLOW_BRANCH"
                    fi
                    
                    DEPLOYMENT_ID="deploy-$(date +%Y%m%d-%H%M%S)-${COMMIT_SHA::7}"
                    echo "deployment_id=${DEPLOYMENT_ID}" >> $GITHUB_OUTPUT
                    echo "commit_sha=${COMMIT_SHA}" >> $GITHUB_OUTPUT
                    echo "branch=${BRANCH}" >> $GITHUB_OUTPUT
                    
                    echo "🚀 Starting deployment: ${DEPLOYMENT_ID}"
                    echo "📦 Branch: ${BRANCH}"
                    echo "📦 Commit: ${COMMIT_SHA}"
    
    deploy:
        name: Deploy to Production Server
        needs: pre-deploy-checks
        runs-on: self-hosted
        timeout-minutes: 10
        
        steps:
            -   name: Set deployment variables
                run: |
                    echo "DEPLOYMENT_ID=${{ needs.pre-deploy-checks.outputs.deployment-id }}" >> $GITHUB_ENV
                    echo "TIMESTAMP=$(date +%Y%m%d_%H%M%S)" >> $GITHUB_ENV
                    echo "CURRENT_USER=$(whoami)" >> $GITHUB_ENV

2. CI测试工作流（CI - Tests & Quality） #

name: CI - Tests & Quality

on:
    push:
        branches: [ main, develop ]
    pull_request:
        branches: [ main, develop ]
    workflow_run:
        workflows: [ "Build Docker Image" ]
        types: [ completed ]
    workflow_dispatch:

concurrency:
    group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
    cancel-in-progress: true

问题原因 #

部署工作流的触发过滤逻辑存在漏洞：

• 仅通过on.workflow_run.branches: [main]限制触发分支，未在任务执行的if条件中二次校验
• CI工作流的并发配置可能导致main分支的任务被取消，若develop分支的CI任务先完成，可能绕过分支过滤触发部署

解决方案 #

1. 强化分支校验逻辑 #

修改pre-deploy-checks任务的if条件，明确限制仅CI工作流在main分支运行成功时才执行，避免过滤失效：

if: |
  (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main') || 
  github.event_name == 'workflow_dispatch'

2. 优化CI工作流并发规则 #

调整CI工作流的并发组配置，确保不同分支的任务互不干扰，main分支的CI任务不会被develop分支的任务取消：

concurrency:
    group: ${{ github.workflow }}-${{ github.ref_name }}
    cancel-in-progress: true

3. 添加CI分支日志（可选） #

在CI工作流中添加日志步骤，方便排查分支与SHA是否正确：

steps:
  - name: Print branch and SHA
    run: |
      echo "Current branch: ${{ github.head_ref || github.ref_name }}"
      echo "Current SHA: ${{ github.sha }}"

内容的提问来源于stack exchange，提问作者Vincent Decaux