[DEPLOY] v2.3.0

[DEPLOY] v2.3.0

Author: whqtker

.github/workflows/dev-cd.yml

@@ -6,10 +6,15 @@ on:
   workflow_dispatch:
 
 jobs:
-  build-gradle:
+  # --- Job 1: 빌드 및 이미지 푸시 (쓰기 권한 필요) ---
+  build-and-push:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      packages: write
+
+    outputs:
+      image_tag: ${{ steps.image_meta.outputs.image_tag }}
 
     steps:
       - name: Checkout the code
@@ -18,81 +23,128 @@ jobs:
           token: ${{ secrets.SUBMODULE_ACCESS_TOKEN }}
           submodules: true
 
+      # --- Java, Gradle 설정 ---
       - name: Set up JDK 17
         uses: actions/setup-java@v4
         with:
           java-version: '17'
           distribution: 'temurin'
-
-      # Configure Gradle for optimal use in GitHub Actions, including caching of downloaded dependencies.
-      # See: https://github.com/gradle/actions/blob/main/setup-gradle/README.md
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@417ae3ccd767c252f5661f1ace9f835f9654f2b5 # v3.1.0
-
-      - name: Grant execute permission for Gradle wrapper(gradlew)
+        uses: gradle/actions/setup-gradle@v3
+      - name: Grant execute permission for Gradle wrapper
         run: chmod +x ./gradlew
-
       - name: Build with Gradle
         run: ./gradlew bootJar
 
-      - name: Copy jar file to remote
-        uses: appleboy/scp-action@master
+      # --- Docker 설정 ---
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
         with:
-          host: ${{ secrets.DEV_HOST }}
-          username: ${{ secrets.DEV_USERNAME }}
-          key: ${{ secrets.DEV_PRIVATE_KEY }}
-          source: "./build/libs/*.jar"
-          target: "/home/${{ secrets.DEV_USERNAME }}/solid-connection-dev/"
+          platforms: linux/arm64
 
-      - name: Copy docker file to remote
-        uses: appleboy/scp-action@master
+      - name: Log in to GitHub Container Registry (GHCR)
+        uses: docker/login-action@v3
         with:
-          host: ${{ secrets.DEV_HOST }}
-          username: ${{ secrets.DEV_USERNAME }}
-          key: ${{ secrets.DEV_PRIVATE_KEY }}
-          source: "./Dockerfile"
-          target: "/home/${{ secrets.DEV_USERNAME }}/solid-connection-dev/"
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Copy docker compose file to remote
-        uses: appleboy/scp-action@master
-        with:
-          host: ${{ secrets.DEV_HOST }}
-          username: ${{ secrets.DEV_USERNAME }}
-          key: ${{ secrets.DEV_PRIVATE_KEY }}
-          source: "./docker-compose.dev.yml"
-          target: "/home/${{ secrets.DEV_USERNAME }}/solid-connection-dev/"
+      # --- 이미지 메타데이터 정의 ---
+      - name: Define image name and tag
+        id: image_meta
+        run: |
+          OWNER_LOWERCASE=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          IMAGE_TAG=$(date +'%Y%m%d-%H%M%S')
+          echo "image_name=ghcr.io/${OWNER_LOWERCASE}/solid-connection-dev" >> $GITHUB_OUTPUT
+          echo "image_tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT
 
-      - name: Copy alloy config file to remote
-        uses: appleboy/scp-action@master
+      # --- Docker 빌드 및 푸시 ---
+      - name: Build, push, and cache Docker image
+        uses: docker/build-push-action@v5
         with:
-          host: ${{ secrets.DEV_HOST }}
-          username: ${{ secrets.DEV_USERNAME }}
-          key: ${{ secrets.DEV_PRIVATE_KEY }}
-          source: "./docs/infra-config/config.alloy"
-          target: "/home/${{ secrets.DEV_USERNAME }}/solid-connection-dev/"
+          context: .
+          platforms: linux/arm64
+          push: true
+          tags: ${{ format('{0}:{1}', steps.image_meta.outputs.image_name, steps.image_meta.outputs.image_tag) }}
+          cache-from: type=registry,ref=${{ steps.image_meta.outputs.image_name }}:buildcache
+          cache-to: type=registry,ref=${{ steps.image_meta.outputs.image_name }}:buildcache,mode=max
 
-      - name: Copy nginx config to remote
-        uses: appleboy/scp-action@master
+      # --- 이미지 정리 (이전 Job에 있던 것) ---
+      - name: Clean up old image versions from GHCR
+        uses: snok/container-retention-policy@v2
         with:
-          host: ${{ secrets.DEV_HOST }}
-          username: ${{ secrets.DEV_USERNAME }}
-          key: ${{ secrets.DEV_PRIVATE_KEY }}
-          source: "./docs/infra-config/nginx.dev.conf"
-          target: "/home/${{ secrets.DEV_USERNAME }}/solid-connection-dev/nginx"
-          rename: "default.conf"
+          token: ${{ secrets.PACKAGE_DELETE_TOKEN }}
+          image-names: solid-connection-dev
+          delete-untagged: true
+          keep-n-tags: 5
+          account-type: org
+          org-name: ${{ github.repository_owner }}
+          cut-off: '7 days ago UTC'
+
+  # --- Job 2: 배포 (읽기 권한만 필요) ---
+  deploy:
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
 
-      - name: Run docker compose and apply nginx config
-        uses: appleboy/ssh-action@master
+    steps:
+      # 설정 파일 전송을 위해 코드 체크아웃 (서브모듈 불필요)
+      - name: Checkout config files
+        uses: actions/checkout@v4
         with:
-          host: ${{ secrets.DEV_HOST }}
-          username: ${{ secrets.DEV_USERNAME }}
-          key: ${{ secrets.DEV_PRIVATE_KEY }}
-          script_stop: true
-          script: |
-            sudo cp /home/${{ secrets.DEV_USERNAME }}/solid-connection-dev/nginx/default.conf /etc/nginx/conf.d/default.conf
-            sudo nginx -t
-            sudo nginx -s reload
+          sparse-checkout: |
+            docker-compose.dev.yml
+            docs/infra-config
+          sparse-checkout-cone-mode: false
+
+      # --- 설정 파일 전송 ---
+      - name: Copy config files to remote
+        run: |
+          echo "${{ secrets.DEV_PRIVATE_KEY }}" > deploy_key.pem
+          chmod 600 deploy_key.pem
+          
+          scp -i deploy_key.pem \
+            -o StrictHostKeyChecking=no \
+            ./docker-compose.dev.yml \
+            ${{ secrets.DEV_USERNAME }}@${{ secrets.DEV_HOST }}:/home/${{ secrets.DEV_USERNAME }}/solid-connection-dev/
 
+      # --- 서버에서 Docker Pull 및 재시작 ---
+      - name: Run deployment on server
+        run: |
+          ssh -i deploy_key.pem \
+           -o StrictHostKeyChecking=no \
+           ${{ secrets.DEV_USERNAME }}@${{ secrets.DEV_HOST }} \
+           '
+            set -e
+          
+            # 1. 환경 변수 설정 (이전 Job의 Output 사용)
+            export OWNER_LOWERCASE=$(echo "${{ github.repository_owner }}" | tr "[:upper:]" "[:lower:]")
+            export IMAGE_TAG_ONLY="${{ needs.build-and-push.outputs.image_tag }}"
+            export FULL_IMAGE_NAME="ghcr.io/${OWNER_LOWERCASE}/solid-connection-dev:${IMAGE_TAG_ONLY}"
+          
+            # 2. GHCR 로그인 & Pull
+            echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+            echo "Pulling new image: $FULL_IMAGE_NAME"
+            docker pull $FULL_IMAGE_NAME
+          
+            # 3. Spring Boot 앱 재시작
+            echo "Restarting Docker Compose with tag: $IMAGE_TAG_ONLY"
             cd /home/${{ secrets.DEV_USERNAME }}/solid-connection-dev
-            docker compose -f docker-compose.dev.yml down
-            docker compose -f docker-compose.dev.yml up -d --build
+            docker compose -f docker-compose.dev.yml down || true
+            OWNER_LOWERCASE=$OWNER_LOWERCASE IMAGE_TAG=$IMAGE_TAG_ONLY docker compose -f docker-compose.dev.yml up -d
+          
+            # 4. 정리 작업
+            echo "Pruning dangling images..."
+            docker image prune -f
+          
+            echo "Cleaning up old tagged images (keeping last 5)..."
+            IMAGE_NAME_BASE="ghcr.io/${OWNER_LOWERCASE}/solid-connection-dev"
+            docker images "${IMAGE_NAME_BASE}" --format "{{.Tag}}" | \
+            sort -r | \
+            tail -n +6 | \
+            xargs -I {} docker rmi "${IMAGE_NAME_BASE}:{}" || true
+          
+            echo "Deployment finished successfully."
+           '