Use variables, contexts, artifacts and caches — GitHub Actions Hoofdstuk 4

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Set environment variables

env: sets variables for the workflow, a job or a step. Steps can add more through $GITHUB_ENV.

.github/workflows/env.yml

env:
  TF_IN_AUTOMATION: "true"
jobs:
  plan:
    runs-on: ubuntu-latest
    env:
      TF_VAR_env: staging
    steps:
      - run: echo "BUILD_DATE=$(date +%F)" >> "$GITHUB_ENV"
      - run: echo "Env $TF_VAR_env, built $BUILD_DATE"

4.2

Read contexts with expressions

${{ … }} reads contexts — data about the run, the repository, secrets, inputs and earlier steps.

Context	Examples
`github`	`github.ref`, `github.sha`, `github.actor`, `github.event_name`, `github.repository`
`env` / `vars`	Environment variables / configuration variables
`secrets`	`secrets.AZURE_CLIENT_SECRET`
`inputs`	Inputs of `workflow_dispatch` or `workflow_call`
`steps` / `needs`	Outputs of steps / of earlier jobs
`runner`	`runner.os`, `runner.temp`
`matrix`	The current matrix values

.github/workflows/deploy.yml

jobs:
  deploy:
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    steps:
      - run: echo "Release ${{ github.ref_name }} by ${{ github.actor }}"
      - if: failure()
        run: echo "Something failed"

Status function	True when
`success()`	All earlier steps passed (the default)
`failure()`	An earlier step failed
`always()`	Always, even after a failure or cancel
`cancelled()`	The run was cancelled

4.3

Use configuration variables

Non-secret settings (region, resource group, client ID) live in variables: Settings → Secrets and variables → Actions → Variables. Read them with vars.NAME.

.github/workflows/deploy.yml

- run: az group show -n "${{ vars.RESOURCE_GROUP }}"

4.4

Pass files with artifacts

Each job has a fresh runner. An artifact carries files (a build, a plan, a report) to later jobs and keeps them for download.

.github/workflows/terraform.yml

jobs:
  plan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: terraform init && terraform plan -out=tfplan
      - uses: actions/upload-artifact@v4
        with:
          name: tfplan
          path: tfplan
          retention-days: 5
  apply:
    needs: plan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: tfplan
      - run: terraform init && terraform apply tfplan

Let op

A Terraform plan file can contain secrets. Keep the retention short and the repository private.

4.5

Speed up runs with caches

A cache keeps downloaded dependencies between runs, keyed by a hash of the lock file.

.github/workflows/ci.yml

- uses: actions/cache@v4
  with:
    path: |
      ~/.cache/pip
      ~/.terraform.d/plugin-cache
    key: ${{ runner.os }}-deps-${{ hashFiles('requirements.txt', '**/.terraform.lock.hcl') }}
    restore-keys: |
      ${{ runner.os }}-deps-

Onthoud

Artifacts = results of this run (for people and later jobs). Caches = speed-up for future runs.

Alle commando's in dit hoofdstuk

env