🌟 ABP VNext + GitHub Actions：CI/CD 全流程自動化

---

---

🤩 TL;DR

• 🚀 端到端流水線：Push → 并行編譯/測試 → 靜態掃描 (SonarCloud/CodeQL) → NuGet/Docker 打包 → 分環境部署 → 自動回滾
• 🔒 嚴格審批：在 GitHub Environments 中分別為 staging 與 production 配置 Required Reviewers
• ? 性能優化：NuGet 緩存、actions/cache、Docker Layer 緩存、并行 Jobs、Concurrency 控制
• 🛠? 深度契合 ABP VNext：自動執行 EF Core 遷移、Swagger/UI、Health Checks 與 AKS 探針

---

🔄 全局流程概覽

---

1?? 準備工作與項目結構

1.1 🛠? 工具鏈與 Secrets

在倉庫 Settings → Secrets 添加以下憑據：

• AZURE_CREDENTIALS：Azure Service Principal JSON（az ad sp create-for-rbac … --sdk-auth）
• NUGET_API_KEY：NuGet.org 發布 Key
• SONAR_TOKEN：SonarCloud Access Token
• SLACK_WEBHOOK_URL：Slack Incoming Webhook URL
• GITHUB_TOKEN（Actions 內置，用于 GHCR）

🎯 示例 CLI：

az ad sp create-for-rbac \--name "abp-ci-sp" \--role contributor \--scopes /subscriptions/<SUB_ID>/resourceGroups/<RG_NAME> \--sdk-auth > azure-credentials.json

1.2 📁 項目目錄示例

.
├─ .github/workflows/ci-cd.yml
├─ src/
│    ├─ MyApp.Domain/
│    ├─ MyApp.Application/
│    ├─ MyApp.EntityFrameworkCore/
│    └─ MyApp.HttpApi.Host/
└─ tests/└─ MyApp.Tests/

---

2?? 🔨 Build & Test（并行編譯與單測）

📝 本 Job 目標：并行 Restore/Build/Test，上傳測試報告

build-test:name: 🔨 Build & Testruns-on: ubuntu-lateststrategy:matrix:dotnet-version: ['8.0.x']steps:- name: Checkout Codeuses: actions/checkout@v3- name: Cache NuGet packagesuses: actions/cache@v3with:path: ~/.nuget/packageskey: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj') }}restore-keys: ${{ runner.os }}-nuget-- name: Setup .NET SDKuses: actions/setup-dotnet@v3with:dotnet-version: ${{ matrix.dotnet-version }}cache: true- name: Restore Dependenciesrun: dotnet restore src/MyApp.sln --locked-mode- name: Build Solutionrun: dotnet build src/MyApp.sln --no-restore --configuration Release- name: Run Unit Testsrun: dotnet test tests/MyApp.Tests/MyApp.Tests.csproj \--no-build --configuration Release --logger "trx"- name: Upload Test Resultsuses: actions/upload-artifact@v3with:name: test-resultspath: '**/*.trx'retention-days: 7

🔄 子流程圖

---

3?? 🕵? Static Analysis（SonarCloud & CodeQL）

📝 本 Job 目標：Shift‐Left 質量與安全保障

static-scan:name: 🕵? Static Analysisruns-on: ubuntu-latestneeds: build-teststrategy:matrix:tool: ['sonarcloud','codeql']steps:- name: Checkout Full Historyuses: actions/checkout@v3with:fetch-depth: 0# SonarCloud- if: matrix.tool == 'sonarcloud'name: SonarCloud Prepareuses: SonarSource/sonarcloud-github-action@v1.9.0- if: matrix.tool == 'sonarcloud'name: Build for SonarCloudrun: dotnet build src/MyApp.sln --configuration Release- if: matrix.tool == 'sonarcloud'name: SonarCloud Publishuses: SonarSource/sonarcloud-github-action@v1.9.0# CodeQL- if: matrix.tool == 'codeql'name: Initialize CodeQLuses: github/codeql-action/init@v2with:languages: csharpconfig-file: .github/codeql/codeql-config.yml- if: matrix.tool == 'codeql'name: Autobuilduses: github/codeql-action/autobuild@v2- if: matrix.tool == 'codeql'name: Perform CodeQL Analysisuses: github/codeql-action/analyze@v2

🔄 子流程圖

---

4?? 📦 Package & Publish（NuGet 與 Docker）

📝 本 Job 目標：僅在 Push 時執行包與鏡像發布

package-publish:name: 📦 Package & Publishif: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')runs-on: ubuntu-latestneeds: static-scansteps:- name: Checkout Codeuses: actions/checkout@v3# NuGet- name: Pack NuGet Packagerun: dotnet pack src/MyApp.Application/MyApp.Application.csproj \--no-build -o ./artifacts- uses: NuGet/setup-nuget@v2- name: Push to NuGet.orgrun: dotnet nuget push ./artifacts/*.nupkg \--api-key ${{ secrets.NUGET_API_KEY }} \--source https://api.nuget.org/v3/index.json# Docker (GHCR)- name: Login to GHCRuses: docker/login-action@v3with:registry: ghcr.iousername: ${{ github.repository_owner }}password: ${{ secrets.GITHUB_TOKEN }}- name: Build & Push Docker Imageuses: docker/build-push-action@v4with:context: src/MyApp.HttpApi.Hostfile: src/MyApp.HttpApi.Host/Dockerfilepush: truetags: |ghcr.io/${{ github.repository_owner }}/myapp:${{ github.sha }}ghcr.io/${{ github.repository_owner }}/myapp:latestcache-from: type=gha,scope=src-MyApp.HttpApi.Hostcache-to: type=gha,mode=max,scope=src-MyApp.HttpApi.Host

---

5?? 🚀 Deploy to Staging（預發布環境）

📝 本 Job 目標：在 develop 分支推送時執行，需審批

deploy-staging:name: 🚀 Deploy to Stagingruns-on: ubuntu-latestneeds: package-publishif: github.ref == 'refs/heads/develop'environment: stagingsteps:- name: Azure Loginuses: azure/login@v1with:creds: ${{ secrets.AZURE_CREDENTIALS }}- name: Set AKS Contextuses: azure/aks-set-context@v2with:creds: ${{ secrets.AZURE_CREDENTIALS }}cluster-name: myClusterresource-group: myRG- name: Install EF CLIrun: |dotnet tool install --global dotnet-ef --version 8.* echo "$HOME/.dotnet/tools" >> $GITHUB_PATH- name: Run EF Core Migrationsrun: dotnet ef database update \--project src/MyApp.EntityFrameworkCore/MyApp.EntityFrameworkCore.csproj \--startup-project src/MyApp.HttpApi.Host/MyApp.HttpApi.Host.csproj \--configuration Release- name: Helm Upgrade (Staging)run: |helm upgrade myapp-staging ./charts/myapp \--namespace staging --install \--set image.tag=${{ github.sha }}

---

6?? 🏭 Deploy to Production（生產環境）

📝 本 Job 目標：在 main 分支推送時執行，需審批

deploy-prod:name: 🏭 Deploy to Productionruns-on: ubuntu-latestneeds: deploy-stagingif: github.ref == 'refs/heads/main'environment: productionsteps:- name: Azure Loginuses: azure/login@v1with:creds: ${{ secrets.AZURE_CREDENTIALS }}- name: Set AKS Contextuses: azure/aks-set-context@v2with:creds: ${{ secrets.AZURE_CREDENTIALS }}cluster-name: myClusterresource-group: myRG- name: Helm Upgrade (Production)run: |helm upgrade myapp-prod ./charts/myapp \--namespace prod --install \--set image.tag=${{ github.sha }}

---

7?? ? Rollback & Alert（自動回滾與告警）

Rollback Staging

rollback-staging:name: ? Rollback & Notify (Staging)if: failure() && github.ref == 'refs/heads/develop'runs-on: ubuntu-latestneeds: deploy-stagingsteps:- name: Determine Last Successful Revisionid: histrun: |rev=$(helm history myapp-staging -n staging --max 5 \--output json | jq -r '.[] | select(.status=="DEPLOYED") | .revision' | tail -1)if [[ -z "$rev" || "$rev" -le 0 ]]; thenecho "No valid revision to rollback"; exit 1fiecho "::set-output name=revision::$rev"- name: Helm Rollback (Staging)run: helm rollback myapp-staging ${{ steps.hist.outputs.revision }} -n staging- name: Slack Notificationuses: rtCamp/action-slack-notify@v2with:webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}message: ":warning: Staging 部署失敗，已回滾到 revision ${{ steps.hist.outputs.revision }}"

Rollback Production

rollback-prod:name: ? Rollback & Notify (Production)if: failure() && github.ref == 'refs/heads/main'runs-on: ubuntu-latestneeds: deploy-prodsteps:- name: Determine Last Successful Revisionid: histrun: |rev=$(helm history myapp-prod -n prod --max 5 \--output json | jq -r '.[] | select(.status=="DEPLOYED") | .revision' | tail -1)if [[ -z "$rev" || "$rev" -le 0 ]]; thenecho "No valid revision to rollback"; exit 1fiecho "::set-output name=revision::$rev"- name: Helm Rollback (Production)run: helm rollback myapp-prod ${{ steps.hist.outputs.revision }} -n prod- name: Slack Notificationuses: rtCamp/action-slack-notify@v2with:webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}message: ":x: Production 部署失敗，已回滾到 revision ${{ steps.hist.outputs.revision }}"

---

🔧 ABP VNext 專屬集成示例

Program.cs 示例

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddApplication<MyAppHttpApiHostModule>();
builder.Host.UseAutofac();var app = builder.Build();
app.UseAbpRequestLocalization();
app.UseAbpSwaggerUI(options =>
{options.SwaggerEndpoint("/swagger/v1/swagger.json", "MyApp API V1");
});
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();
app.MapHealthChecks("/health");
app.MapHealthChecks("/health/ready", new HealthCheckOptions
{Predicate = reg => reg.Name.Contains("ready")
});
app.Run();

Helm Chart 探針示例 (charts/myapp/values.yaml)

livenessProbe:httpGet:path: /healthport: httpinitialDelaySeconds: 30readinessProbe:httpGet:path: /health/readyport: httpinitialDelaySeconds: 10

---

📦 附錄：配置文件

sonar-project.properties

sonar.projectKey=<YOUR_PROJECT_KEY>
sonar.organization=<YOUR_ORGANIZATION>
sonar.sources=src
sonar.tests=tests
sonar.dotnet.visualstudio.solution.file=src/MyApp.sln

CodeQL 配置 (.github/codeql/codeql-config.yml)

queries:- security-and-quality- security-and-performance

---