ci-cd

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

CI/CD Integration

CI/CD集成

Use this skill when the user wants GitHub Actions workflows around gh-infra.

当用户需要围绕gh-infra搭建GitHub Actions工作流时使用本指南。

Choose A Pattern

选择模式

Self-managed: each repository owns its own
```
.github/infra.yaml
```
Central management: one config repo manages many target repos

Read:

Self-managed workflow: references/self-managed.md
Central management workflow: references/central.md

自管理：每个仓库自行维护其
```
.github/infra.yaml
```
集中管理：单个配置仓库管理多个目标仓库

参考文档：

自管理工作流：references/self-managed.md
集中管理工作流：references/central.md

Common Building Blocks

通用构建模块

```
gh infra apply ... --auto-approve
```
on merge to
```
main
```
```
gh infra plan ... --ci
```
on a schedule for drift detection
use
```
GITHUB_TOKEN
```
only for self-managed single-repo workflows
use a fine-grained PAT or GitHub App token for cross-repo central management

合并到
```
main
```
分支时执行
```
gh infra apply ... --auto-approve
```
定时执行
```
gh infra plan ... --ci
```
进行漂移检测
仅在自管理单仓库工作流中使用
```
GITHUB_TOKEN
```
跨仓库集中管理场景使用细粒度PAT或GitHub App令牌

Authentication

身份验证

Self-managed

自管理

Use the default workflow token:

yaml

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

使用默认工作流令牌：

yaml

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Central management

集中管理

The default workflow token cannot manage other repositories. Use:

a fine-grained PAT with the required per-repo permissions
or a GitHub App installation token

Pass it as:

yaml

env:
  GITHUB_TOKEN: ${{ secrets.GH_INFRA_TOKEN }}

Never use a broad classic PAT.

默认工作流令牌无法管理其他仓库，请使用：

具备所需仓库级权限的细粒度PAT
或GitHub App安装令牌

按如下方式传入：

yaml

env:
  GITHUB_TOKEN: ${{ secrets.GH_INFRA_TOKEN }}

切勿使用权限范围过大的经典PAT。

Important Constraints

重要约束

gh-infra reads only top-level
```
*.yaml
```
/
```
*.yml
```
in the target directory
if manifests are split across
```
repos/
```
and
```
files/
```
, run once per directory
```
--auto-approve
```
is required in CI
```
--ci
```
makes
```
plan
```
exit 1 when drift exists

gh-infra仅读取目标目录下的顶层
```
*.yaml
```
/
```
*.yml
```
文件
如果清单文件拆分在
```
repos/
```
和
```
files/
```
目录下，需针对每个目录各执行一次命令
CI环境中必须使用
```
--auto-approve
```
参数
存在漂移时，带
```
--ci
```
参数的
```
plan
```
命令会返回退出码1

Typical Flows

典型流程

PR review flow: run
```
plan
```
on pull requests touching manifests
Auto-apply flow: run
```
apply --auto-approve
```
on merge
Drift detection flow: run
```
plan --ci
```
on a schedule

Use both auto-apply and drift detection unless the user explicitly wants review-only behavior.

PR审核流程：当拉取请求修改了清单文件时执行
```
plan
```
自动应用流程：合并代码时执行
```
apply --auto-approve
```
漂移检测流程：定时执行
```
plan --ci
```

除非用户明确要求仅审核模式，否则建议同时使用自动应用和漂移检测功能。