使用GitHub Actions 安全部署到阿里云 ECS

1
name: Secure Deploy to Aliyun ECS
2

3
on:
4
  push:
5
    branches: [ main ]   # 触发分支，可按需修改
6

7
jobs:
8
  deploy:
9
    runs-on: ubuntu-latest
10
    steps:
11
      # ---------- 1. 获取当前运行器的公网 IP ----------
12
      - name: Get Runner Public IP
13
        id: ip
14
        run: |
15
          RUNNER_IP=$(curl -s http://ifconfig.me)
16
          echo "CURRENT_IP=$RUNNER_IP" >> $GITHUB_OUTPUT
17
          echo "Runner IP: $RUNNER_IP"
18

19
      # ---------- 2. 安装阿里云 CLI（二进制方式）----------
20
      - name: Install Aliyun CLI
21
        run: |
22
          curl -LO "https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz"
23
          tar -xzf aliyun-cli-linux-latest-amd64.tgz
24
          mkdir -p $HOME/.local/bin
25
          mv aliyun $HOME/.local/bin/
26
          echo "$HOME/.local/bin" >> $GITHUB_PATH
27
          aliyun --version
28

29
      # ---------- 3. 临时放行当前 IP（22 端口）----------
30
      - name: Authorize Security Group (Add IP)
31
        env:
32
          ALIBABA_CLOUD_ACCESS_KEY_ID: ${{ secrets.ALIYUN_ACCESS_KEY_ID }}
33
          ALIBABA_CLOUD_ACCESS_KEY_SECRET: ${{ secrets.ALIYUN_ACCESS_KEY_SECRET }}
34
          ALIBABA_CLOUD_REGION_ID: ${{ secrets.ALIYUN_REGION }}
35
        run: |
36
          aliyun ecs AuthorizeSecurityGroup \
37
            --RegionId ${{ secrets.ALIYUN_REGION }} \
38
            --SecurityGroupId ${{ secrets.ALIYUN_SECURITY_GROUP_ID }} \
39
            --IpProtocol tcp \
40
            --PortRange 22/22 \
41
            --SourceCidrIp ${{ steps.ip.outputs.CURRENT_IP }}/32 \
42
            --Policy accept \
43
            --NicType intranet
44

45
      # （可选）等待几秒让规则生效
46
      - name: Wait for rule to take effect
47
        run: sleep 5
48

49
      # ---------- 在这里插入你的构建/部署步骤 ----------
50
      # 例如：
51
      # - name: Build and Deploy
52
      #   run: |
53
      #     echo "Your deployment commands here"
54
      #   # 或使用 SSH Action：
55
      # # ---------- 验证 SSH 访问成功 ----------
56
      # - name: Verify SSH Connection
57
      #   uses: appleboy/ssh-action@v1.0.3
58
      #   with:
59
      #     host: ${{ secrets.REMOTE_HOST }}          # ECS 公网 IP 或域名
60
      #     username: ${{ secrets.REMOTE_USER }}      # 登录用户名（如 root 或普通用户）
61
      #     key: ${{ secrets.SSH_PRIVATE_KEY }}       # 私钥内容（需在 secrets 中配置）
62
      #     port: 22                                   # SSH 端口，默认 22
63
      #     script: |
64
      #       echo "✅ SSH connection to ECS is successful!"
65
      #       echo "Hostname: $(hostname)"
66
      #       echo "Current user: $(whoami)"
67
      #       echo "Working directory: $(pwd)"
68
      #       # 可以在此处添加更多验证命令，如检查必要目录是否存在
69

70
      # ---------- 4. 撤销放行（删除刚才添加的规则）----------
71
      - name: Revoke Security Group (Remove IP)
72
        if: always()
73
        env:
74
          ALIBABA_CLOUD_ACCESS_KEY_ID: ${{ secrets.ALIYUN_ACCESS_KEY_ID }}
75
          ALIBABA_CLOUD_ACCESS_KEY_SECRET: ${{ secrets.ALIYUN_ACCESS_KEY_SECRET }}
76
          ALIBABA_CLOUD_REGION_ID: ${{ secrets.ALIYUN_REGION }}
77
        run: |
78
          aliyun ecs RevokeSecurityGroup \
79
            --RegionId ${{ secrets.ALIYUN_REGION }} \
80
            --SecurityGroupId ${{ secrets.ALIYUN_SECURITY_GROUP_ID }} \
81
            --IpProtocol tcp \
82
            --PortRange 22/22 \
83
            --SourceCidrIp ${{ steps.ip.outputs.CURRENT_IP }}/32 \
84
            --NicType intranet