cicd.yml

# CI/CD에 필요한 GitHub Secrets (Repo Settings > Secrets and variables > Actions)

name: cicd

on:
  pull_request:
    branches: ["production", "develop"]
  push:
    branches: ["production", "develop"]
  workflow_dispatch:

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Log - Checkout done
        run: echo ">>> [CI] Checkout done"

      - name: Setup JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Log - JDK ready
        run: echo ">>> [CI] JDK 17 ready"

      - name: Setup Gradle cache
        uses: gradle/actions/setup-gradle@v4

      - name: Ensure Docker is available (Testcontainers)
        run: |
          echo ">>> [CI] Checking Docker daemon..."
          docker info

      - name: Run tests
        run: |
          echo ">>> [CI] Running tests..."
          ./gradlew test --no-daemon
          echo ">>> [CI] Tests passed"

  docker-build-and-push:
    name: Docker Build and Push
    runs-on: ubuntu-latest
    needs: test
    if: github.ref == 'refs/heads/production' && github.event_name == 'push'

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Log - Checkout done
        run: echo ">>> [Docker] Checkout done"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log - Buildx ready
        run: echo ">>> [Docker] Buildx ready"

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Log - Docker Hub login done
        run: echo ">>> [Docker] Docker Hub login done"

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ secrets.DOCKERHUB_USERNAME }}/dorumdorum-be
          tags: |
            type=raw,value=latest
            type=sha

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Build and push pinpoint image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile.pinpoint
          push: true
          tags: ${{ secrets.DOCKERHUB_USERNAME }}/dorumdorum-be:pinpoint

      - name: Log - Image pushed
        run: echo ">>> [Docker] Image built and pushed"

  deploy:
    name: Deploy to On-Premises
    runs-on: ubuntu-latest
    needs: docker-build-and-push
    if: github.ref == 'refs/heads/production' && github.event_name == 'push'

    steps:
      - name: Deploy over SSH
        uses: appleboy/ssh-action@v1.2.0
        env:
          IMAGE: ${{ secrets.DOCKERHUB_USERNAME }}/dorumdorum-be:pinpoint
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
          FIREBASE_SERVICE_ACCOUNT_B64: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_B64 }}
          RDB_USERNAME: ${{ secrets.RDB_USERNAME }}
          RDB_URL: ${{ secrets.RDB_URL }}
          RDB_PASSWORD: ${{ secrets.RDB_PASSWORD }}
          MYSQL_ROOT_PASSWORD: ${{ secrets.MYSQL_ROOT_PASSWORD }}
          MYSQL_DATABASE: ${{ secrets.MYSQL_DATABASE }}
          JWT_KEY: ${{ secrets.JWT_KEY }}
          JWT_ACCESS_EXPIRATION: ${{ secrets.JWT_ACCESS_EXPIRATION }}
          JWT_REFRESH_EXPIRATION: ${{ secrets.JWT_REFRESH_EXPIRATION }}
          SMTP_USERNAME: ${{ secrets.SMTP_USERNAME }}
          SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
          CONTAINER_NAME: dorumdorum-be
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO_FULL_NAME: ${{ github.repository }}
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SERVER_SSH_KEY }}
          port: ${{ secrets.SERVER_SSH_PORT }}
          envs: IMAGE,DOCKERHUB_USERNAME,DOCKERHUB_TOKEN,FIREBASE_SERVICE_ACCOUNT_B64,RDB_USERNAME,RDB_URL,RDB_PASSWORD,MYSQL_ROOT_PASSWORD,MYSQL_DATABASE,JWT_KEY,JWT_ACCESS_EXPIRATION,JWT_REFRESH_EXPIRATION,SMTP_USERNAME,SMTP_PASSWORD,CONTAINER_NAME,GITHUB_TOKEN,REPO_FULL_NAME,DISCORD_WEBHOOK
          script_stop: true
          script: |
            set -e
            echo ">>> [Deploy] SSH 연결됨, 환경 변수 정규화 중..."

            RDB_USERNAME="$(printf '%s' "$RDB_USERNAME" | tr -d '\r\n')"
            RDB_URL="$(printf '%s' "$RDB_URL" | tr -d '\r\n')"
            RDB_PASSWORD="$(printf '%s' "$RDB_PASSWORD" | tr -d '\r\n')"
            MYSQL_ROOT_PASSWORD="$(printf '%s' "$MYSQL_ROOT_PASSWORD" | tr -d '\r\n')"
            MYSQL_DATABASE="$(printf '%s' "$MYSQL_DATABASE" | tr -d '\r\n')"
            JWT_KEY="$(printf '%s' "$JWT_KEY" | tr -d '\r\n')"
            JWT_ACCESS_EXPIRATION="$(printf '%s' "$JWT_ACCESS_EXPIRATION" | tr -d '\r\n')"
            JWT_REFRESH_EXPIRATION="$(printf '%s' "$JWT_REFRESH_EXPIRATION" | tr -d '\r\n')"
            SMTP_USERNAME="$(printf '%s' "$SMTP_USERNAME" | tr -d '\r\n')"
            SMTP_PASSWORD="$(printf '%s' "$SMTP_PASSWORD" | tr -d '\r\n')"

            DEPLOY_PATH="${HOME}/dorumdorum"
            mkdir -p "$DEPLOY_PATH"
            cd "$DEPLOY_PATH"
            echo ">>> [Deploy] DEPLOY_PATH=$DEPLOY_PATH"

            # 1) Firebase 서비스 계정 파일 생성 (VM에 저장)
            printf '%s' "$FIREBASE_SERVICE_ACCOUNT_B64" | base64 -d > firebase-service-account.json
            chmod 600 firebase-service-account.json

            # 2) 컨테이너에서 참조할 경로를 env로 고정
            FIREBASE_SERVICE_ACCOUNT_PATH="/app/firebase-service-account.json"

            # 3) .env 생성
            # Pinpoint Web reads Spring datasource keys directly.
            printf '%s\n' \
              "SPRING_PROFILES_ACTIVE=prod" \
              "RDB_USERNAME=$RDB_USERNAME" \
              "RDB_URL=$RDB_URL" \
              "RDB_PASSWORD=$RDB_PASSWORD" \
              "MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD" \
              "MYSQL_DATABASE=$MYSQL_DATABASE" \
              "SPRING_DATASOURCE_URL=$RDB_URL" \
              "SPRING_DATASOURCE_USERNAME=$RDB_USERNAME" \
              "SPRING_DATASOURCE_PASSWORD=$RDB_PASSWORD" \
              "JWT_KEY=$JWT_KEY" \
              "JWT_ACCESS_EXPIRATION=$JWT_ACCESS_EXPIRATION" \
              "JWT_REFRESH_EXPIRATION=$JWT_REFRESH_EXPIRATION" \
              "SMTP_USERNAME=$SMTP_USERNAME" \
              "SMTP_PASSWORD=$SMTP_PASSWORD" \
              "DISCORD_WEBHOOK=$DISCORD_WEBHOOK" \
              "FIREBASE_SERVICE_ACCOUNT_PATH=$FIREBASE_SERVICE_ACCOUNT_PATH" > .env
            chmod 600 .env
            echo ">>> [Deploy] .env, firebase-service-account.json 생성 완료"

            docker info >/dev/null 2>&1 || {
              echo "Docker socket permission denied for current deploy user."
              echo "This user must be in docker group before running CI/CD."
              exit 1
            }

            echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
            echo ">>> [Deploy] Docker Hub 로그인 완료"

            echo ">>> [Deploy] MySQL 이미지 pull 중..."
            docker pull mysql:8.0
            echo ">>> [Deploy] Redis 이미지 pull 중..."
            docker pull redis:7-alpine
            echo ">>> [Deploy] Backend 이미지 pull 중..."
            docker pull "$IMAGE"

            echo ">>> [Deploy] 네트워크 확인/생성 중..."
            docker network inspect dorumdorum-net >/dev/null 2>&1 || docker network create dorumdorum-net

            # 통합 docker-compose 파일 및 설정 파일들 준비
            COMPOSE_PATH="${HOME}/dorumdorum-compose"
            mkdir -p "$COMPOSE_PATH"
            cd "$COMPOSE_PATH"
            echo ">>> [Deploy] COMPOSE_PATH=$COMPOSE_PATH, Git clone 중..."
            rm -rf temp_repo

            # Git에서 production 브랜치로 docker-compose.yml, monitoring 가져오기
            git clone --depth 1 -b production "https://x-access-token:${GITHUB_TOKEN}@github.com/${REPO_FULL_NAME}.git" temp_repo
            echo ">>> [Deploy] Clone 완료, docker-compose.yml · monitoring 복사 중..."
            
            if [ -f "temp_repo/BE/docker-compose.yml" ]; then
              cp temp_repo/BE/docker-compose.yml .
              echo ">>> [Deploy] BE/docker-compose.yml 복사 완료"
            elif [ -f "temp_repo/docker-compose.yml" ]; then
              cp temp_repo/docker-compose.yml .
              echo ">>> [Deploy] docker-compose.yml 복사 완료"
            else
              echo "ERROR: docker-compose.yml not found in temp_repo/"
              ls -la temp_repo/ || true
              exit 1
            fi
            
            if [ -d "temp_repo/BE/monitoring" ]; then
              mkdir -p monitoring
              cp -r temp_repo/BE/monitoring/* monitoring/
              echo ">>> [Deploy] monitoring 설정 파일 복사 완료 (BE)"
            elif [ -d "temp_repo/monitoring" ]; then
              mkdir -p monitoring
              cp -r temp_repo/monitoring/* monitoring/
              echo ">>> [Deploy] monitoring 설정 파일 복사 완료"
            elif [ -d "temp_repo/INFRA/monitoring" ]; then
              mkdir -p monitoring
              cp -r temp_repo/INFRA/monitoring/* monitoring/
              echo ">>> [Deploy] monitoring 설정 파일 복사 완료 (INFRA)"
            else
              echo "WARNING: monitoring directory not found, creating empty structure"
              mkdir -p monitoring/prometheus monitoring/grafana/provisioning/dashboards/json monitoring/grafana/provisioning/datasources
            fi

            rm -rf temp_repo
            echo ">>> [Deploy] temp_repo 삭제, compose 파일 확인 중..."

            # docker-compose.yml 파일 존재 확인
            if [ ! -f "docker-compose.yml" ]; then
              echo "ERROR: docker-compose.yml not found after copy"
              ls -la
              exit 1
            fi
            
            # .env 파일과 firebase-service-account.json 복사
            cp "$DEPLOY_PATH/.env" .
            cp "$DEPLOY_PATH/firebase-service-account.json" .
            echo ">>> [Deploy] .env, firebase-service-account.json 복사 완료"

            # docker-compose로 모든 서비스 실행
            export BACKEND_IMAGE="$IMAGE"
            export CONTAINER_NAME="$CONTAINER_NAME"
            echo ">>> [Deploy] 기존 컨테이너 정리 (down + 이름으로 강제 제거)..."
            docker compose -f docker-compose.yml down --remove-orphans >/dev/null 2>&1 || true
            docker rm -f dorumdorum-redis dorumdorum-be dorumdorum-prometheus dorumdorum-grafana zoo1 pinpoint-hbase pinpoint-collector pinpoint-web 2>/dev/null || true

            echo ">>> [Deploy] [1/6] ZooKeeper 기동..."
            docker compose -f docker-compose.yml up -d zoo1
            for i in $(seq 1 30); do
              if docker ps --format '{{.Names}}' | grep -q '^zoo1$'; then
                echo ">>> [Deploy] ZooKeeper up"
                break
              fi
              sleep 2
            done

            echo ">>> [Deploy] [2/6] HBase 기동..."
            docker compose -f docker-compose.yml up -d pinpoint-hbase
            echo ">>> [Deploy] HBase 초기화 대기..."
            HBASE_READY=0
            for i in $(seq 1 300); do
              if docker logs pinpoint-hbase 2>&1 | grep -Eq "Master has completed initialization|Tables already exist|15 row\(s\) in"; then
                echo ">>> [Deploy] HBase initialized"
                HBASE_READY=1
                break
              fi
              if ! docker ps --format '{{.Names}}' | grep -q '^pinpoint-hbase$'; then
                echo "ERROR: pinpoint-hbase container is not running"
                docker ps -a | grep pinpoint-hbase || true
                docker logs --tail 200 pinpoint-hbase || true
                exit 1
              fi
              sleep 2
            done
            if [ "$HBASE_READY" -ne 1 ]; then
              echo "ERROR: HBase initialization timeout"
              docker logs --tail 200 pinpoint-hbase || true
              exit 1
            fi

            echo ">>> [Deploy] [3/6] Pinpoint Collector 기동..."
            docker compose -f docker-compose.yml up -d pinpoint-collector
            COLLECTOR_READY=0
            for i in $(seq 1 60); do
              if docker logs pinpoint-collector 2>&1 | grep -Eq "Started .*CollectorApp|Started CollectorApp"; then
                echo ">>> [Deploy] Pinpoint Collector started"
                COLLECTOR_READY=1
                break
              fi
              sleep 2
            done
            if [ "$COLLECTOR_READY" -ne 1 ]; then
              echo "ERROR: Pinpoint Collector startup timeout"
              docker logs --tail 200 pinpoint-collector || true
              exit 1
            fi

            echo ">>> [Deploy] [4/6] Pinpoint Web 기동..."
            docker compose -f docker-compose.yml up -d pinpoint-web
            WEB_READY=0
            for i in $(seq 1 60); do
              if docker logs pinpoint-web 2>&1 | grep -Eq "Started .*WebApp|Started WebApp|Started .*PinpointWebApplication"; then
                echo ">>> [Deploy] Pinpoint Web started"
                WEB_READY=1
                break
              fi
              sleep 2
            done
            if [ "$WEB_READY" -ne 1 ]; then
              echo "ERROR: Pinpoint Web startup timeout"
              docker logs --tail 200 pinpoint-web || true
              exit 1
            fi

            echo ">>> [Deploy] [5/6] Backend 기동..."
            docker compose -f docker-compose.yml up -d backend

            echo ">>> [Deploy] [6/6] Redis/Monitoring 기동..."
            docker compose -f docker-compose.yml up -d redis prometheus grafana

            echo ">>> [Deploy] 오래된 이미지 정리 중..."
            docker image prune -af --filter "until=168h"

            echo ">>> [Deploy] 배포 완료"
            echo "- Backend: http://localhost:8080"
            echo "- Redis: localhost:6379"
            echo "- Prometheus: http://localhost:9090"
            echo "- Grafana: http://localhost:3000 (admin/admin)"
            echo "- Pinpoint Web: http://localhost:8079"