这里有一个完整的工作示例,注意版本需要为2.1或以上。staging_workflow仅在推送到主分支时运行(不在git标签推送时运行),而prod_workflow仅在以“R..”开头的git标签推送时运行(不在主分支上推送)- 旨在用于生产部署,将您的提交与发布标签一起使用:
git tag -a R2.1.0 -m“一些新的发布功能”
然后推送标签:
git push origin --tags
还包括如何使用assume-role-with-web-identity与AWS集成的示例(这比在CirceCI上存储永久AWS凭据更可取)。它假定您已在AWS中设置了IDP(您只需要CircleCI组织ID并添加管理员角色),然后将角色ARN存储在CircleCI组织上下文中。此处的示例是,如果您有两个用于staging和prod的AWS帐户,则上下文分别为aws-staging和aws-prod,那么上下文中唯一需要的环境变量是:AWS_ROLE_ARN,尽管您可能希望包括AWS_DEFAULT_REGION。
这是我的 package.json(nodeJs 项目)的一部分,你可以看到管道正在运行的脚本,包括 linting、testing 和 CICDPackage & CICDDeploy(AWS SAM/serverless 项目 - 用于 staging 和 prod,使用 'sam package' 和 'sam deploy',我在 dev stacks 中使用
sam sync
,因为它更快):
package.json 摘录:
"scripts": {
"test": "jest",
"watchTestFiles": "jest --watch --verbose=false",
"lint": "eslint \"src/**/*.js\"",
"build": "node scripts/bundle",
"CICDPackage": "sam package --s3-bucket serverless-packaged-artifacts --template template.yaml --output-template-file templateOut.yaml --region eu-west-1",
"CICDDeploy": "sam deploy --template-file templateOut.yaml --stack-name some-stack-name --capabilities CAPABILITY_NAMED_IAM --region eu-west-1"
}
config.yml
version: 2.1
orbs:
aws-cli: circleci/aws-cli@3.1.1
jobs:
test_and_lint:
docker:
- image: cimg/node:lts
steps:
- checkout
- run: npm i
- run: npm run lint
- run: npm run test
deploy_staging:
docker:
- image: cimg/node:lts
steps:
- checkout
- run: npm i
- run: npm run build
- aws-cli/setup
- run: curl -L https://github.com/aws/aws-sam-cli/releases/latest/download/aws-sam-cli-linux-x86_64.zip -o aws-sam-cli-linux-x86_64.zip
- run: unzip aws-sam-cli-linux-x86_64.zip -d sam-installation
- run: sudo ./sam-installation/install
- run:
name: AWS authentication
command: |
read -r AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN \<<< \
$(aws sts assume-role-with-web-identity \
--role-arn ${AWS_ROLE_ARN} \
--role-session-name "CircleCI-${CIRCLE_WORKFLOW_ID}-${CIRCLE_JOB}" \
--web-identity-token $CIRCLE_OIDC_TOKEN \
--duration-seconds 3600 \
--query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
--output text)
echo export AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" >> $BASH_ENV
echo export AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" >> $BASH_ENV
echo export AWS_SESSION_TOKEN="$AWS_SESSION_TOKEN" >> $BASH_ENV
- run: npm run CICDPackage
- run: npm run CICDDeploy
deploy_prod:
docker:
- image: cimg/node:lts
steps:
- checkout
- run: npm i
- run: npm run build
- aws-cli/setup
- run: curl -L https://github.com/aws/aws-sam-cli/releases/latest/download/aws-sam-cli-linux-x86_64.zip -o aws-sam-cli-linux-x86_64.zip
- run: unzip aws-sam-cli-linux-x86_64.zip -d sam-installation
- run: sudo ./sam-installation/install
- run:
name: AWS authentication
command: |
read -r AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN \<<< \
$(aws sts assume-role-with-web-identity \
--role-arn ${AWS_ROLE_ARN} \
--role-session-name "CircleCI-${CIRCLE_WORKFLOW_ID}-${CIRCLE_JOB}" \
--web-identity-token $CIRCLE_OIDC_TOKEN \
--duration-seconds 3600 \
--query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
--output text)
echo export AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" >> $BASH_ENV
echo export AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" >> $BASH_ENV
echo export AWS_SESSION_TOKEN="$AWS_SESSION_TOKEN" >> $BASH_ENV
- run: npm run CICDPackage
- run: npm run CICDDeploy
workflows:
staging_workflow:
when:
and:
- or:
- matches:
pattern: "^master$"
value: << pipeline.git.branch >>
- not:
matches:
pattern: "^R.+$"
value: << pipeline.git.tag >>
jobs:
- test_and_lint
- deploy_staging:
context: aws-staging
requires:
- test_and_lint
prod_workflow:
when:
and:
- or:
- matches:
pattern: "^master$"
value: << pipeline.git.branch >>
- or:
- matches:
pattern: "^R.+$"
value: << pipeline.git.tag >>
jobs:
- test_and_lint
- deploy_prod:
context: aws-prod
requires:
- test_and_lint
请注意,它还将临时的AWS凭证导出到 >> $BASH_ENV 中,以便在其他步骤中可用。
s3_location
部分,其中包含key_pattern: builds/{TAG}-{BUILD_NUM}.zip
和key_pattern: builds/{CIRCLE_TAG}-{BUILD_NUM}.zip
。两者都没有填充{tag}。 - sthompstag: /regexp/
特性不能正常工作的原因是:Circle 上的 git checkout 步骤无法获取标签... 我认为这是一个 bug。但是有一个简单的解决方法:将git fetch --tags
添加为 pre 步骤。 - lalyoscheckout
中没有“pre”步骤,只有“post”,而且它不起作用。 - mediafreakch