[deploy] OCI 마이그레이션 배포

.github/workflows/ci.yml

@@ -57,4 +57,15 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        run: ./gradlew test sonar --info --stacktrace
+        run: |
+          # 포크에서 온 PR: PR 연동 시 원본 레포에 PR이 없어 실패하므로 브랜치 분석만 수행
+          # 같은 레포 PR: PR 데코레이션 사용
+          if [ "${{ github.event.pull_request.head.repo.full_name }}" = "${{ github.repository }}" ]; then
+            ./gradlew test sonar --info --stacktrace \
+              -Dsonar.pullrequest.key=${{ github.event.pull_request.number }} \
+              -Dsonar.pullrequest.branch=${{ github.head_ref }} \
+              -Dsonar.pullrequest.base=${{ github.base_ref }}
+          else
+            ./gradlew test sonar --info --stacktrace \
+              -Dsonar.branch.name=pr-${{ github.event.pull_request.number }}
+          fi

.github/workflows/dev-cd.yml

@@ -33,6 +33,14 @@ jobs:
       - name: Grant gradlew permission
         run: chmod +x ./gradlew
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          install: true
+
       - name: Log in to DockerHub
         uses: docker/login-action@v2
         with:
@@ -42,60 +50,70 @@ jobs:
       - name: Build & Push App Image
         run: |
           docker buildx build \
-            --platform linux/amd64 \
+            --platform linux/arm64 \
             --push \
             --file clokey-api/Dockerfile \
-            --tag ${{ secrets.DOCKERHUB_USERNAME }}/clokey-docker-2025:dev-app \
+            --tag ${{ secrets.DOCKERHUB_USERNAME }}/clokey-docker-2026:dev-app \
             .
 
-      - name: Copy dev-docker-compose.yml
+      - name: Copy dev-compose
         uses: appleboy/scp-action@v0.1.3
         with:
           username: ubuntu
-          host: ${{ secrets.DEV_EC2_HOST }}
-          key: ${{ secrets.DEV_EC2_SSH_KEY }}
-          source: ./clokey-api/dev-compose.yml
+          host: ${{ secrets.OCI_HOST }}
+          key: ${{ secrets.OCI_INSTANCE_SSH_KEY }}
+          source: "clokey-api/dev-compose.yml"
           target: /home/ubuntu/
 
+      - name: Set OCI private key env (multiline)
+        run: |
+          echo "OCI_PRIVATE_KEY<<ENDOFKEY" >> $GITHUB_ENV
+          echo "${{ secrets.OCI_PRIVATE_KEY }}" >> $GITHUB_ENV
+          echo "ENDOFKEY" >> $GITHUB_ENV
+
+      - name: Prepare OCI key base64 for Deploy script
+        run: echo "OCI_PRIVATE_KEY_B64=$(echo -n "$OCI_PRIVATE_KEY" | base64 -w 0)" >> $GITHUB_ENV
+
       - name: Deploy App
         uses: appleboy/ssh-action@master
         with:
           username: ubuntu
-          host: ${{ secrets.DEV_EC2_HOST }}
-          key: ${{ secrets.DEV_EC2_SSH_KEY }}
+          host: ${{ secrets.OCI_HOST }}
+          key: ${{ secrets.OCI_INSTANCE_SSH_KEY }}
+          envs: DOCKERHUB_USERNAME,CODIVE_DEV_BASE_URL,CODIVE_PROD_BASE_URL,OCI_MYSQL_HEATWAVE_HOST,OCI_DEV_MYSQL_DB_NAME,OCI_MYSQL_USERNAME,OCI_MYSQL_PASSWORD,REDIS_PASSWORD,KAKAO_CLIENT_ID,KAKAO_CLIENT_SECRET,APPLE_CLIENT_ID,APPLE_CLIENT_SECRET,JWT_ACCESS_TOKEN_SECRET,JWT_REFRESH_TOKEN_SECRET,JWT_ACCESS_TOKEN_EXPIRATION_TIME,JWT_REFRESH_TOKEN_EXPIRATION_TIME,JWT_ISSUER,OCI_TENANCY_ID,OCI_USER_ID,OCI_FINGERPRINT,OCI_REGION,OCI_PASSPHRASE,OCI_OBJECTSTORAGE_NAMESPACE,OCI_DEV_OBJECTSTORAGE_BUCKET,SWAGGER_USERNAME,SWAGGER_PASSWORD,FIREBASE_SA_JSON_B64,AI_SERVER_IP,CLOTH_INFERENCE_PATH,STYLE_INFERENCE_PATH,HISTORY_CLOTH_DETECT_PATH,MEILISEARCH_ENDPOINT,MEILISEARCH_KEY
           script: |
-            export DOCKERHUB_NAME=${{ secrets.DOCKERHUB_USERNAME }}
+            export DOCKERHUB_USERNAME=${{ secrets.DOCKERHUB_USERNAME }}
             export DOCKER_TAG=dev-app
+
+            export CODIVE_DEV_BASE_URL=${{ secrets.CODIVE_DEV_BASE_URL }}
+            export CODIVE_PROD_BASE_URL=${{ secrets.CODIVE_PROD_BASE_URL }}
 
-            export DEV_MYSQL_HOST=${{ secrets.DEV_MYSQL_HOST }}
-            export MYSQL_PORT=${{ secrets.MYSQL_PORT }}
-            export DB_NAME=${{ secrets.DB_NAME }}
-            export DB_USERNAME=${{ secrets.DB_USERNAME }}
-            export DB_PASSWORD=${{ secrets.DB_PASSWORD }}
+            export OCI_MYSQL_HEATWAVE_HOST=${{ secrets.OCI_MYSQL_HEATWAVE_HOST }}
+            export OCI_DEV_MYSQL_DB_NAME=${{ secrets.OCI_DEV_MYSQL_DB_NAME }}
+            export OCI_MYSQL_USERNAME=${{ secrets.OCI_MYSQL_USERNAME }}
+            export OCI_MYSQL_PASSWORD=${{ secrets.OCI_MYSQL_PASSWORD }}
 
-            export REDIS_HOST=${{ secrets.REDIS_HOST }}
-            export REDIS_PORT=${{ secrets.REDIS_PORT }}
             export REDIS_PASSWORD=${{ secrets.REDIS_PASSWORD }}
 
             export KAKAO_CLIENT_ID=${{ secrets.KAKAO_CLIENT_ID }}
-            export KAKAO_CLIENT_SECRET=${{ secrets.DEV_KAKAO_CLIENT_SECRET }}
-            export KAKAO_REDIRECT_URI=${{ secrets.KAKAO_REDIRECT_URI }}
+            export KAKAO_CLIENT_SECRET=${{ secrets.KAKAO_CLIENT_SECRET }}
 
             export APPLE_CLIENT_ID=${{ secrets.APPLE_CLIENT_ID }}
             export APPLE_CLIENT_SECRET=${{ secrets.APPLE_CLIENT_SECRET }}
-            export APPLE_REDIRECT_URI=${{ secrets.APPLE_REDIRECT_URI }}
 
             export JWT_ACCESS_TOKEN_SECRET=${{ secrets.JWT_ACCESS_TOKEN_SECRET }}
             export JWT_REFRESH_TOKEN_SECRET=${{ secrets.JWT_REFRESH_TOKEN_SECRET }}
             export JWT_ACCESS_TOKEN_EXPIRATION_TIME=${{ secrets.JWT_ACCESS_TOKEN_EXPIRATION_TIME }}
             export JWT_REFRESH_TOKEN_EXPIRATION_TIME=${{ secrets.JWT_REFRESH_TOKEN_EXPIRATION_TIME }}
             export JWT_ISSUER=${{ secrets.JWT_ISSUER }}
 
-            export DEV_AWS_ACCESS_KEY_ID=${{ secrets.DEV_AWS_ACCESS_KEY_ID }}
-            export DEV_AWS_SECRET_ACCESS_KEY=${{ secrets.DEV_AWS_SECRET_ACCESS_KEY }}
-            export AWS_REGION=${{ secrets.AWS_REGION }}
-            export DEV_S3_BUCKET=${{ secrets.DEV_S3_BUCKET }}
-            export DEV_S3_ENDPOINT=${{ secrets.DEV_S3_ENDPOINT }}
+            export OCI_TENANCY_ID=${{ secrets.OCI_TENANCY_ID }}
+            export OCI_USER_ID=${{ secrets.OCI_USER_ID }}
+            export OCI_FINGERPRINT=${{ secrets.OCI_FINGERPRINT }}
+            export OCI_REGION=${{ secrets.OCI_REGION }}
+            export OCI_PASSPHRASE=${{ secrets.OCI_PASSPHRASE }}
+            export OCI_OBJECTSTORAGE_NAMESPACE=${{ secrets.OCI_OBJECTSTORAGE_NAMESPACE }}
+            export OCI_DEV_OBJECTSTORAGE_BUCKET=${{ secrets.OCI_DEV_OBJECTSTORAGE_BUCKET }}
 
             export SWAGGER_USERNAME=${{ secrets.SWAGGER_USERNAME }}
             export SWAGGER_PASSWORD=${{ secrets.SWAGGER_PASSWORD }}
@@ -106,21 +124,24 @@ jobs:
             export AI_SERVER_IP=${{ secrets.AI_SERVER_IP }}
             export CLOTH_INFERENCE_PATH=${{ secrets.CLOTH_INFERENCE_PATH }}
             export STYLE_INFERENCE_PATH=${{ secrets.STYLE_INFERENCE_PATH }}
-            export CLOTH_DETECT_PATH=${{ secrets.CLOTH_DETECT_PATH }}
+            export HISTORY_CLOTH_DETECT_PATH=${{ secrets.HISTORY_CLOTH_DETECT_PATH }}
             export DEFAULT_PROFILE_IMAGE_URL=${{ secrets.DEFAULT_PROFILE_IMAGE_URL }}
             export TODAY_TEMPERATURE_IMAGE_URL=${{ secrets.TODAY_TEMPERATURE_IMAGE_URL }}
 
-            sudo mkdir -p /home/ubuntu/secrets
-            echo "${{ secrets.FIREBASE_SA_JSON_B64 }}" | base64 -d | sudo tee /home/ubuntu/secrets/firebase-sa.json > /dev/null
-            sudo chmod 600 /home/ubuntu/secrets/firebase-sa.json
+            mkdir -p /home/ubuntu/secrets
+            echo "${{ secrets.FIREBASE_SA_JSON_B64 }}" | base64 -d | tee /home/ubuntu/secrets/firebase-sa.json > /dev/null
+            chmod 600 /home/ubuntu/secrets/firebase-sa.json
+
+            echo '${{ env.OCI_PRIVATE_KEY_B64 }}' | base64 -d | tee /home/ubuntu/secrets/oci_key.pem > /dev/null
+            chmod 600 /home/ubuntu/secrets/oci_key.pem
+            export OCI_PRIVATE_KEY="$(cat /home/ubuntu/secrets/oci_key.pem)"
 
             export FIREBASE_CREDENTIALS_PATH=/home/ubuntu/secrets/firebase-sa.json
 
             echo "${{ secrets.DOCKERHUB_TOKEN }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
 
             cd /home/ubuntu
-            docker compose -f clokey-api/dev-compose.yml up -d
-            
+            docker compose -p clokey-dev -f clokey-api/dev-compose.yml up -d
+
             echo "Cleaning up dangling Docker images..."
-            docker image prune -f
-
+            docker image prune -f

.github/workflows/prod-cd.yml

@@ -5,7 +5,7 @@ on:
     branches: [ main ]
 
 jobs:
-  dev-cd:
+  prod-cd:
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -33,6 +33,9 @@ jobs:
       - name: Grant gradlew permission
         run: chmod +x ./gradlew
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
@@ -52,60 +55,71 @@ jobs:
       - name: Build & Push App Image
         run: |
           docker buildx build \
-            --platform linux/amd64 \
+            --platform linux/arm64 \
             --push \
             --file clokey-api/Dockerfile \
-            --tag ${{ secrets.DOCKERHUB_USERNAME }}/clokey-docker-2025:prod-app \
+            --tag ${{ secrets.DOCKERHUB_USERNAME }}/clokey-docker-2026:prod-app \
             .
 
-      - name: Copy prod-docker-compose.yml
+      - name: Copy prod-compose
         uses: appleboy/scp-action@v0.1.3
         with:
           username: ubuntu
-          host: ${{ secrets.PROD_EC2_HOST }}
-          key: ${{ secrets.PROD_EC2_SSH_KEY }}
-          source: ./clokey-api/prod-compose.yml
+          host: ${{ secrets.OCI_HOST }}
+          key: ${{ secrets.OCI_INSTANCE_SSH_KEY }}
+          source: "clokey-api/prod-compose.yml"
           target: /home/ubuntu/
 
+      - name: Set OCI private key env (multiline)
+        run: |
+          echo "OCI_PRIVATE_KEY<<ENDOFKEY" >> $GITHUB_ENV
+          echo "${{ secrets.OCI_PRIVATE_KEY }}" >> $GITHUB_ENV
+          echo "ENDOFKEY" >> $GITHUB_ENV
+
+      - name: Prepare OCI key base64 for Deploy script
+        run: echo "OCI_PRIVATE_KEY_B64=$(echo -n "$OCI_PRIVATE_KEY" | base64 -w 0)" >> $GITHUB_ENV
+
       - name: Deploy App
         uses: appleboy/ssh-action@master
         with:
           username: ubuntu
-          host: ${{ secrets.PROD_EC2_HOST }}
-          key: ${{ secrets.PROD_EC2_SSH_KEY }}
+          host: ${{ secrets.OCI_HOST }}
+          key: ${{ secrets.OCI_INSTANCE_SSH_KEY }}
+          envs: DOCKERHUB_USERNAME,CODIVE_DEV_BASE_URL,CODIVE_PROD_BASE_URL,OCI_MYSQL_HEATWAVE_HOST,OCI_PROD_MYSQL_DB_NAME,OCI_MYSQL_USERNAME,OCI_MYSQL_PASSWORD,REDIS_PASSWORD,KAKAO_CLIENT_ID,KAKAO_CLIENT_SECRET,APPLE_CLIENT_ID,APPLE_CLIENT_SECRET,JWT_ACCESS_TOKEN_SECRET,JWT_REFRESH_TOKEN_SECRET,JWT_ACCESS_TOKEN_EXPIRATION_TIME,JWT_REFRESH_TOKEN_EXPIRATION_TIME,JWT_ISSUER,OCI_TENANCY_ID,OCI_USER_ID,OCI_FINGERPRINT,OCI_PRIVATE_KEY,OCI_REGION,OCI_PASSPHRASE,OCI_OBJECTSTORAGE_NAMESPACE,OCI_PROD_OBJECTSTORAGE_BUCKET,SWAGGER_USERNAME,SWAGGER_PASSWORD,FIREBASE_SA_JSON_B64,AI_SERVER_IP,CLOTH_INFERENCE_PATH,STYLE_INFERENCE_PATH,HISTORY_CLOTH_DETECT_PATH,MEILISEARCH_ENDPOINT,MEILISEARCH_KEY
           script: |
-            export DOCKERHUB_NAME=${{ secrets.DOCKERHUB_USERNAME }}
+            export DOCKERHUB_USERNAME=${{ secrets.DOCKERHUB_USERNAME }}
             export DOCKER_TAG=prod-app
 
-            export PROD_MYSQL_HOST=${{ secrets.PROD_MYSQL_HOST }}
-            export MYSQL_PORT=${{ secrets.MYSQL_PORT }}
-            export DB_NAME=${{ secrets.DB_NAME }}
-            export DB_USERNAME=${{ secrets.DB_USERNAME }}
-            export DB_PASSWORD=${{ secrets.DB_PASSWORD }}
+            export CODIVE_DEV_BASE_URL=${{ secrets.CODIVE_DEV_BASE_URL }}
+            export CODIVE_PROD_BASE_URL=${{ secrets.CODIVE_PROD_BASE_URL }}
+
+            export OCI_MYSQL_HEATWAVE_HOST=${{ secrets.OCI_MYSQL_HEATWAVE_HOST }}
+            export OCI_PROD_MYSQL_DB_NAME=${{ secrets.OCI_PROD_MYSQL_DB_NAME }}
+            export OCI_MYSQL_USERNAME=${{ secrets.OCI_MYSQL_USERNAME }}
+            export OCI_MYSQL_PASSWORD=${{ secrets.OCI_MYSQL_PASSWORD }}
 
-            export REDIS_HOST=${{ secrets.REDIS_HOST }}
-            export REDIS_PORT=${{ secrets.REDIS_PORT }}
             export REDIS_PASSWORD=${{ secrets.REDIS_PASSWORD }}
 
             export KAKAO_CLIENT_ID=${{ secrets.KAKAO_CLIENT_ID }}
             export KAKAO_CLIENT_SECRET=${{ secrets.KAKAO_CLIENT_SECRET }}
-            export KAKAO_REDIRECT_URI=${{ secrets.KAKAO_REDIRECT_URI }}
 
             export APPLE_CLIENT_ID=${{ secrets.APPLE_CLIENT_ID }}
             export APPLE_CLIENT_SECRET=${{ secrets.APPLE_CLIENT_SECRET }}
-            export APPLE_REDIRECT_URI=${{ secrets.APPLE_REDIRECT_URI }}
-
+
             export JWT_ACCESS_TOKEN_SECRET=${{ secrets.JWT_ACCESS_TOKEN_SECRET }}
             export JWT_REFRESH_TOKEN_SECRET=${{ secrets.JWT_REFRESH_TOKEN_SECRET }}
             export JWT_ACCESS_TOKEN_EXPIRATION_TIME=${{ secrets.JWT_ACCESS_TOKEN_EXPIRATION_TIME }}
             export JWT_REFRESH_TOKEN_EXPIRATION_TIME=${{ secrets.JWT_REFRESH_TOKEN_EXPIRATION_TIME }}
             export JWT_ISSUER=${{ secrets.JWT_ISSUER }}
 
-            export PROD_AWS_ACCESS_KEY_ID=${{ secrets.PROD_AWS_ACCESS_KEY_ID }}
-            export PROD_AWS_SECRET_ACCESS_KEY=${{ secrets.PROD_AWS_SECRET_ACCESS_KEY }}
-            export AWS_REGION=${{ secrets.AWS_REGION }}
-            export PROD_S3_BUCKET=${{ secrets.PROD_S3_BUCKET }}
-            export PROD_S3_ENDPOINT=${{ secrets.PROD_S3_ENDPOINT }}
+            export OCI_TENANCY_ID=${{ secrets.OCI_TENANCY_ID }}
+            export OCI_USER_ID=${{ secrets.OCI_USER_ID }}
+            export OCI_FINGERPRINT=${{ secrets.OCI_FINGERPRINT }}
+            export OCI_PRIVATE_KEY=${{ secrets.OCI_PRIVATE_KEY }}
+            export OCI_REGION=${{ secrets.OCI_REGION }}
+            export OCI_PASSPHRASE=${{ secrets.OCI_PASSPHRASE }}
+            export OCI_OBJECTSTORAGE_NAMESPACE=${{ secrets.OCI_OBJECTSTORAGE_NAMESPACE }}
+            export OCI_PROD_OBJECTSTORAGE_BUCKET=${{ secrets.OCI_PROD_OBJECTSTORAGE_BUCKET }}
 
             export SWAGGER_USERNAME=${{ secrets.SWAGGER_USERNAME }}
             export SWAGGER_PASSWORD=${{ secrets.SWAGGER_PASSWORD }}
@@ -116,21 +130,24 @@ jobs:
             export AI_SERVER_IP=${{ secrets.AI_SERVER_IP }}
             export CLOTH_INFERENCE_PATH=${{ secrets.CLOTH_INFERENCE_PATH }}
             export STYLE_INFERENCE_PATH=${{ secrets.STYLE_INFERENCE_PATH }}
-            export CLOTH_DETECT_PATH=${{ secrets.CLOTH_DETECT_PATH }}
+            export HISTORY_CLOTH_DETECT_PATH=${{ secrets.HISTORY_CLOTH_DETECT_PATH }}
             export DEFAULT_PROFILE_IMAGE_URL=${{ secrets.DEFAULT_PROFILE_IMAGE_URL }}
             export TODAY_TEMPERATURE_IMAGE_URL=${{ secrets.TODAY_TEMPERATURE_IMAGE_URL }}
 
-            sudo mkdir -p /home/ubuntu/secrets
-            echo "${{ secrets.FIREBASE_SA_JSON_B64 }}" | base64 -d | sudo tee /home/ubuntu/secrets/firebase-sa.json > /dev/null
-            sudo chmod 600 /home/ubuntu/secrets/firebase-sa.json
+            mkdir -p /home/ubuntu/secrets
+            echo "${{ secrets.FIREBASE_SA_JSON_B64 }}" | base64 -d | tee /home/ubuntu/secrets/firebase-sa.json > /dev/null
+            chmod 600 /home/ubuntu/secrets/firebase-sa.json
+
+            echo '${{ env.OCI_PRIVATE_KEY_B64 }}' | base64 -d | tee /home/ubuntu/secrets/oci_key.pem > /dev/null
+            chmod 600 /home/ubuntu/secrets/oci_key.pem
+            export OCI_PRIVATE_KEY="$(cat /home/ubuntu/secrets/oci_key.pem)"
 
             export FIREBASE_CREDENTIALS_PATH=/home/ubuntu/secrets/firebase-sa.json
 
             echo "${{ secrets.DOCKERHUB_TOKEN }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
 
             cd /home/ubuntu
-            docker compose -f clokey-api/prod-compose.yml up -d
+            docker compose -p clokey-prod -f clokey-api/prod-compose.yml up -d
 
             echo "Cleaning up dangling Docker images..."
-            docker image prune -f
-
+            docker image prune -f

.github/workflows/prod-openapi.yml

@@ -20,6 +20,7 @@ jobs:
 
     env:
       CODIVEAPI_BRANCH: main
+      PROD_OPENAPI_URL: "${{ secrets.CODIVE_PROD_BASE_URL }}/v3/api-docs"
       TARGET_PATH: Sources/CodiveAPI/openapi.yaml
       SWAGGER_USERNAME: ${{ secrets.SWAGGER_USERNAME }}
       SWAGGER_PASSWORD: ${{ secrets.SWAGGER_PASSWORD }}
@@ -31,8 +32,6 @@ jobs:
           fetch-depth: 1
 
       - name: Wait for production server to be ready
-        env:
-          PROD_OPENAPI_URL: ${{ secrets.PROD_OPENAPI_URL }}
         run: |
           set -euo pipefail
           echo "Waiting for production OpenAPI to be ready..."
@@ -53,8 +52,6 @@ jobs:
 
 
       - name: Fetch OpenAPI JSON from production
-        env:
-          PROD_OPENAPI_URL: ${{ secrets.PROD_OPENAPI_URL }}
         run: |
           set -euo pipefail
           echo "Fetching OpenAPI from: $PROD_OPENAPI_URL"

build.gradle

@@ -128,6 +128,7 @@ tasks.register('updateGitHooks', Copy) {
 }
 
 tasks.register('makeGitHooksExecutable', Exec) {
+    onlyIf { !System.getProperty('os.name').toLowerCase(java.util.Locale.ROOT).contains('windows') }
     commandLine 'chmod', '+x', './.git/hooks/pre-commit'
     dependsOn updateGitHooks
 }

clokey-api/build.gradle

@@ -21,4 +21,6 @@ dependencies {
     implementation 'org.springframework.boot:spring-boot-starter-data-redis'
 
     implementation 'io.vanslog:spring-data-meilisearch:0.7.3'
+
+    testImplementation 'com.oracle.oci.sdk:oci-java-sdk-objectstorage:3.47.0'
 }