docker-build-develop.yaml

name: Docker Build & 무중단 배포

on:
  push:
    branches:
      - develop
      - main

    paths-ignore:
      - 'README.md'

jobs:
  build:
    runs-on: ubuntu-latest

    outputs:
      docker_tag: ${{ steps.docker.outputs.tag }}

    steps:
      - name: 리포지토리 체크아웃
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GIT_TOKEN }}
          submodules: true

      - name: JDK 17 설치
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '17'
          cache: 'gradle'

      - name: Gradle 명령 실행 권한 부여
        run: chmod +x ./gradlew

      - name: Gradle 종속성 캐싱
        uses: actions/cache@v4
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
          restore-keys: ${{ runner.os }}-gradle

      - name: Gradle bootJar
        run: ./gradlew bootJar

      - name: GitHub Container Registry 로그인
        run: |
          export CR_PAT=${{ secrets.GIT_TOKEN }}
          echo $CR_PAT | docker login ghcr.io -u ${{ secrets.GIT_ID }} --password-stdin

      - name: Docker Image Tag 설정
        id: docker
        run: |
          echo "tag=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"

      - name: Docker Image 생성
        run: |
          docker build -t test -f submodule/docker/dev.Dockerfile .
          DOCKER_IMAGE=${{ secrets.DOCKER_REGISTRY }}/signal-buddy:${{ steps.docker.outputs.tag }}
          docker tag test $DOCKER_IMAGE
          docker push $DOCKER_IMAGE

      - name: SonarQube 캐싱
        uses: actions/cache@v4
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar

      - name: SonarCloud 분석
        env:
          GITHUB_TOKEN: ${{ secrets.GIT_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: ./gradlew sonar --info --stacktrace

  deploy:
    runs-on: ubuntu-latest
    needs: build

    concurrency:
      group: deploy
      cancel-in-progress: true  # 기존 실행 중인 워크플로우는 취소, 새 커밋 기준으로 실행

    permissions:
      id-token: write

    steps:
      - name: GitHub Actions Runner의 Public IP 가져오기
        run : |
          echo "IPV4=$(curl -s ifconfig.me)" >> "$GITHUB_ENV"

      - name: AWS credentials 설정
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: GitHub Actions IP를 인바운드 룰에 임시 추가
        run: |
          aws ec2 authorize-security-group-ingress --group-id ${{ secrets.AWS_SECURITY_GROUP_ID }} \
          --protocol tcp --port 22 --cidr ${{ env.IPV4 }}/32

      - name: AWS EC2 SSH 접속 및 배포
        uses: appleboy/ssh-action@v1
        env:
          DOCKER_IMAGE: ${{ secrets.DOCKER_REGISTRY }}/signal-buddy:${{ needs.build.outputs.docker_tag }}
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ${{ secrets.EC2_USERNAME }}
          key: ${{ secrets.EC2_SSH_KEY }}
          envs: DOCKER_IMAGE
          script: |
            set -e
            echo ${{ secrets.GIT_TOKEN }} | docker login ghcr.io -u ${{ secrets.GIT_ID }} --password-stdin
            docker pull "$DOCKER_IMAGE"
            echo "DOCKER_IMAGE=$DOCKER_IMAGE" > ${{ secrets.SUBMODULE_DIRECTORY }}/docker/.env
            sudo sh ${{ secrets.SUBMODULE_DIRECTORY }}/script/deploy.sh
            docker system prune -a -f || true
            
      - name: GitHub Actions Runner의 IP를 인바운드에서 삭제
        if: always()
        run: |
          aws ec2 revoke-security-group-ingress --group-id ${{ secrets.AWS_SECURITY_GROUP_ID }} \
          --protocol tcp --port 22 --cidr ${{ env.IPV4 }}/32

  slack-workflow-status:
    if: always()

    runs-on: ubuntu-latest
    needs:
      - build
      - deploy

    permissions:
      actions: read

    steps:
      - name: Workflow 결과 Slack에 알림
        uses: Gamesight/slack-workflow-status@master
        with:
          repo_token: ${{secrets.GIT_TOKEN}}
          slack_webhook_url: ${{secrets.SLACK_WEBHOOK_URL}}
          name: 'Signal-Buddy Workflow Bot'
          icon_url: 'https://github.githubassets.com/assets/GitHub-Mark-ea2971cee799.png'