deploy-dev.yml

name: deploy-dev

on:
  push:
    branches:
      - develop
  workflow_dispatch:
    inputs:
      tag:
        description: 'Optional explicit dev tag (default: dev-latest)'
        required: false
        default: 'dev-latest'

concurrency:
  group: deploy-dev
  cancel-in-progress: true

jobs:
  notify-failure:
    runs-on: ubuntu-latest
    needs: [build-deploy]
    if: failure()
    steps:
      - name: Notify deployment failure
        run: |
          echo "::error::배포 파이프라인 실패 (Build/Flyway/Docker/Deploy 중 하나). 워크플로우 로그를 확인하세요."
          echo "Flyway 마이그레이션 실패 시 이전 버전 앱이 계속 실행됩니다. SLACK_WEBHOOK_URL 시크릿을 설정하면 Slack 알림을 추가할 수 있습니다."

  build-deploy:
    runs-on: ubuntu-latest
    environment: dev
    permissions:
      id-token: write
      contents: read

    defaults:
      run:
        working-directory: ./

    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: 'gradle'

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Set secret yml file
        run: |
          mkdir -p src/main/resources
          echo "${{ secrets.APPLICANT_SYNC_MAPPING_DATA }}" > src/main/resources/applicant-sync-mapping-data.yml
          find src

      - name: Clean Build with Gradle (with Testing)
        env:
          JWT_ACCESS_KEY: ${{ secrets.JWT_ACCESS_KEY }}
          JWT_REFRESH_KEY: ${{ secrets.JWT_REFRESH_KEY }}

          GOOGLE_OAUTH_CLIENT_ID: ${{ secrets.GOOGLE_OAUTH_CLIENT_ID }}
          GOOGLE_OAUTH_CLIENT_SECRET: ${{ secrets.GOOGLE_OAUTH_CLIENT_SECRET }}
          GOOGLE_OAUTH_REDIRECT_URI: ${{ secrets.GOOGLE_OAUTH_REDIRECT_URI }}

          ALLOWED_REDIRECT_URI_LOCAL: ${{ vars.ALLOWED_REDIRECT_URI_LOCAL }}
          ALLOWED_REDIRECT_URI_DEV: ${{ vars.ALLOWED_REDIRECT_URI_DEV }}
          SWAGGER_OAUTH2_REDIRECT_URL: ${{ vars.SWAGGER_OAUTH2_REDIRECT_URL }}

          MAIL_STORAGE_S3_BUCKET: ${{ secrets.MAIL_STORAGE_S3_BUCKET }}
          MAIL_STORAGE_S3_REGION: ${{ secrets.MAIL_STORAGE_S3_REGION }}
          MAIL_STORAGE_S3_KEY_PREFIX: ${{ secrets.MAIL_STORAGE_S3_KEY_PREFIX }}
        run: |
          ./gradlew clean build --build-cache --parallel --daemon

      - name: Run Flyway migration
        env:
          DB_URL: ${{ secrets.DB_URL }}
          DB_USERNAME: ${{ secrets.DB_USERNAME }}
          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
        run: |
          if [ -z "$DB_URL" ] || [ -z "$DB_USERNAME" ] || [ -z "$DB_PASSWORD" ]; then
            echo "::error::DB_URL, DB_USERNAME, DB_PASSWORD 시크릿이 dev 환경에 설정되어 있는지 확인하세요."
            exit 1
          fi
          ./gradlew flywayMigrate --no-daemon

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: image=moby/buildkit:latest

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          role-session-name: GithubActions-${{ github.run_id }}
          aws-region: us-east-1

      - name: Login to Amazon ECR
        id: login-ecr-public
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Build, tag, and push image to Amazon ECR
        env:
          ECR_REGISTRY: public.ecr.aws/${{ vars.ECR_PUBLIC_REGISTRY_ID }}
          ECR_REPOSITORY: yourssu/${{ vars.PROJECT_NAME }}
        run: |
          DEV_IMAGE_LATEST_TAG=dev-latest
          DEV_IMAGE_SHA_TAG=dev-${GITHUB_SHA}
          echo "ECR_REGISTRY=$ECR_REGISTRY"
          echo "ECR_REPOSITORY=$ECR_REPOSITORY"
          echo "FULL_IMAGE_NAME=$ECR_REGISTRY/$ECR_REPOSITORY:$DEV_IMAGE_SHA_TAG"
          
          # create and use a new builder instance
          docker buildx create --use --name arm-builder          

          docker buildx build \
            --platform linux/arm64,linux/amd64 \
            --push \
            --provenance=false \
            --cache-from "type=gha" \
            --cache-to "type=gha,mode=max" \
            -t $ECR_REGISTRY/$ECR_REPOSITORY:$DEV_IMAGE_SHA_TAG \
            -t $ECR_REGISTRY/$ECR_REPOSITORY:$DEV_IMAGE_LATEST_TAG \
            .

      - name: Deploy to AWS EC2
        env:
          YOURSSU_PEM: ${{ secrets.YOURSSU_PEM }}
          HOST_URL: ${{ vars.HOST_URL }}

          SERVER_PORT: ${{ vars.SERVER_PORT }}
          CORS_ALLOWED_ORIGINS: ${{ vars.CORS_ALLOWED_ORIGINS }}

          DB_URL: ${{ secrets.DB_URL }}
          DB_USERNAME: ${{ secrets.DB_USERNAME }}
          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}

          PROJECT_NAME: ${{ vars.PROJECT_NAME }}
          ENVIRONMENT: ${{ vars.ENVIRONMENT }}

          ECR_REGISTRY: public.ecr.aws/${{ vars.ECR_PUBLIC_REGISTRY_ID }}

          # For this project
          JWT_ACCESS_KEY: ${{ secrets.JWT_ACCESS_KEY }}
          JWT_REFRESH_KEY: ${{ secrets.JWT_REFRESH_KEY }}

          GOOGLE_OAUTH_CLIENT_ID: ${{ secrets.GOOGLE_OAUTH_CLIENT_ID }}
          GOOGLE_OAUTH_CLIENT_SECRET: ${{ secrets.GOOGLE_OAUTH_CLIENT_SECRET }}
          GOOGLE_OAUTH_REDIRECT_URI: ${{ secrets.GOOGLE_OAUTH_REDIRECT_URI }}

          ALLOWED_REDIRECT_URI_LOCAL: ${{ vars.ALLOWED_REDIRECT_URI_LOCAL }}
          ALLOWED_REDIRECT_URI_DEV: ${{ vars.ALLOWED_REDIRECT_URI_DEV }}
          SWAGGER_OAUTH2_REDIRECT_URL: ${{ vars.SWAGGER_OAUTH2_REDIRECT_URL }}

          MAIL_STORAGE_S3_BUCKET: ${{ secrets.MAIL_STORAGE_S3_BUCKET }}
          MAIL_STORAGE_S3_REGION: ${{ secrets.MAIL_STORAGE_S3_REGION }}
          MAIL_STORAGE_S3_KEY_PREFIX: ${{ secrets.MAIL_STORAGE_S3_KEY_PREFIX }}
          INPUT_DEPLOY_TAG: ${{ github.event.inputs.tag }}

        run: |
          mkdir -p ~/.ssh
          ssh-keyscan -H $HOST_URL >> ~/.ssh/known_hosts
          echo "$YOURSSU_PEM" > yourssu.pem
          chmod 600 yourssu.pem

          if [ -n "$INPUT_DEPLOY_TAG" ]; then
            DEPLOY_TAG="$INPUT_DEPLOY_TAG"
          else
            DEPLOY_TAG="dev-${GITHUB_SHA}"
          fi
          
          # .env.dev 파일 생성
          echo "SERVER_PORT=$SERVER_PORT" >> .env.dev
          echo "CORS_ALLOWED_ORIGINS=$CORS_ALLOWED_ORIGINS" >> .env.dev
          
          echo "DB_URL=$DB_URL" >> .env.dev
          echo "DB_USERNAME=$DB_USERNAME" >> .env.dev
          echo "DB_PASSWORD=$DB_PASSWORD" >> .env.dev
          
          echo "PROJECT_NAME=$PROJECT_NAME" >> .env.dev
          echo "ENVIRONMENT=$ENVIRONMENT" >> .env.dev
          
          echo "ECR_REGISTRY=$ECR_REGISTRY" >> .env.dev
          
          echo "JWT_ACCESS_KEY=$JWT_ACCESS_KEY" >> .env.dev
          echo "JWT_REFRESH_KEY=$JWT_REFRESH_KEY" >> .env.dev
          
          echo "GOOGLE_OAUTH_CLIENT_ID=$GOOGLE_OAUTH_CLIENT_ID" >> .env.dev
          echo "GOOGLE_OAUTH_CLIENT_SECRET=$GOOGLE_OAUTH_CLIENT_SECRET" >> .env.dev
          echo "GOOGLE_OAUTH_REDIRECT_URI=$GOOGLE_OAUTH_REDIRECT_URI" >> .env.dev
          
          echo "ALLOWED_REDIRECT_URI_LOCAL=$ALLOWED_REDIRECT_URI_LOCAL" >> .env.dev
          echo "ALLOWED_REDIRECT_URI_DEV=$ALLOWED_REDIRECT_URI_DEV" >> .env.dev
          echo "SWAGGER_OAUTH2_REDIRECT_URL=$SWAGGER_OAUTH2_REDIRECT_URL" >> .env.dev
          
          echo "MAIL_STORAGE_S3_BUCKET=$MAIL_STORAGE_S3_BUCKET" >> .env.dev
          echo "MAIL_STORAGE_S3_REGION=$MAIL_STORAGE_S3_REGION" >> .env.dev
          echo "MAIL_STORAGE_S3_KEY_PREFIX=$MAIL_STORAGE_S3_KEY_PREFIX" >> .env.dev
          echo "IMAGE_TAG=$DEPLOY_TAG" >> .env.dev

          # create deployment directory structure
          ssh -i yourssu.pem ubuntu@$HOST_URL "mkdir -p ~/$PROJECT_NAME-dev-api/logs"

          # deploy environment file and docker script to host machine
          scp -i yourssu.pem .env.dev ubuntu@$HOST_URL:~/$PROJECT_NAME-dev-api/
          scp -i yourssu.pem scripts/docker-deploy.sh ubuntu@$HOST_URL:~/$PROJECT_NAME-dev-api/

          # Make the script executable
          ssh -i yourssu.pem ubuntu@$HOST_URL "chmod +x ~/$PROJECT_NAME-dev-api/docker-deploy.sh"

          # Execute the script
          ssh -i yourssu.pem ubuntu@$HOST_URL "cd ~/$PROJECT_NAME-dev-api && \
            PROJECT_NAME=$PROJECT_NAME IMAGE_TAG=$DEPLOY_TAG CONTAINER_SUFFIX=dev ENV_FILE=.env.dev ./docker-deploy.sh"