知识检查

  • 3 分钟

请考虑以下工作流定义：

.github/workflows/workflow.yml:

name: workflow

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  deploy-sandbox:
    uses: /.github/workflows/deploy.yml
    with:
      environmentName: Sandbox
    secrets:
      client-id: ${{ secrets.AZURE_CLIENT_ID }}
      tenant-id: ${{ secrets.AZURE_TENANT_ID }}
      subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

  deploy-production:
    uses: /.github/workflows/deploy.yml
    needs: deploy-sandbox
    with:
      environmentName: Production
    secrets:
      client-id: ${{ secrets.AZURE_CLIENT_ID }}
      tenant-id: ${{ secrets.AZURE_TENANT_ID }}
      subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

.github/workflows/deploy.yml:

name: deploy

on:
  workflow_call:
    inputs:
      environmentName:
        required: true
        type: string
    secrets:
      AZURE_CLIENT_ID:
        required: true
      AZURE_TENANT_ID:
        required: true
      AZURE_SUBSCRIPTION_ID:
        required: true

jobs:
  deploy:
    environment: ${{ inputs.environmentType }}
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - uses: azure/login@v1
      with:
        client-id: ${{ secrets.AZURE_CLIENT_ID }}
        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
    - uses: azure/arm-deploy@v1
      with:
        failOnStdErr: false
        deploymentName: ${{ github.run_number }}
        resourceGroupName: ${{ inputs.environmentName }}_rg
        template: ./deploy/main.bicep
        parameters: deploy/parameters.${{ inputs.environmentName }}.json

Git 存储库的 deploy 文件夹还包含 Bicep 文件和参数文件。

1.

如何提高此工作流的安全性？

2.

需要向工作流添加一个名为“集成”的新环境。 在添加新环境时，应执行哪些操作？

3.

需要向部署添加一个包含连接字符串和密码的新参数，以访问数据库。 应考虑采用哪种方法？