Merge pull request #60 from GAT2025/refactor/#58 #32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Deploy to EC2 via ECR | |
| on: | |
| push: | |
| branches: ["develop"] | |
| concurrency: | |
| group: ecr-ec2-deploy-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| AWS_REGION: ap-northeast-2 | |
| ECR_REPOSITORY: gat2025/gat_be | |
| permissions: | |
| id-token: write | |
| contents: read | |
| jobs: | |
| build_and_push: | |
| name: Build & Push Docker Image to ECR | |
| runs-on: ubuntu-latest | |
| outputs: | |
| image_uri: ${{ steps.meta.outputs.image_uri }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| # AWS 자격 증명 구성(OIDC) | |
| - name: Configure AWS credentials (OIDC) | |
| uses: aws-actions/configure-aws-credentials@v3 | |
| with: | |
| role-to-assume: ${{ secrets.ARN_ECR_PUSH_ROLE }} | |
| role-session-name: ecrPrivatePushRole | |
| aws-region: ${{ env.AWS_REGION }} | |
| audience: sts.amazonaws.com | |
| # ECR 로그인 | |
| - name: Login to Amazon ECR | |
| id: login-ecr | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| # Docker 이미지 빌드 전 application-secret.yml 생성 | |
| - name: Create application-secret.yml before Docker build | |
| run: | | |
| mkdir -p src/main/resources | |
| echo "${{ secrets.GAT_SECRET_YML }}" > src/main/resources/application-secret.yml | |
| # FCM을 위한 자격 증명 파일 fcm-service-key.json 생성 | |
| - name: Create fcm-service-key.json before Docker build | |
| run: | | |
| echo "${{ secrets.FCM_SERVICE_KEY }}" | base64 --decode > src/main/resources/fcm-service-key.json | |
| # Docker 이미지 태그 준비 (SHA 해시와 latest 태그 포함) | |
| - name: Prepare image tags | |
| id: meta | |
| run: | | |
| REGISTRY="${{ steps.login-ecr.outputs.registry }}" | |
| REPO="${{ env.ECR_REPOSITORY }}" | |
| SHA_TAG="${{ github.sha }}" | |
| echo "image_uri=${REGISTRY}/${REPO}:${SHA_TAG}" >> $GITHUB_OUTPUT | |
| echo "tags=${REGISTRY}/${REPO}:${SHA_TAG},${REGISTRY}/${REPO}:latest" >> $GITHUB_OUTPUT | |
| # Docker Buildx 설치 (멀티 플랫폼 빌드, 캐싱 등) | |
| - name: Set up Docker Buildx | |
| id: buildx | |
| uses: docker/setup-buildx-action@v3 | |
| with: | |
| driver: docker-container | |
| install: true | |
| # Docker 이미지 빌드 및 ECR로 푸시 | |
| - name: Build & Push (cache enabled) | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| builder: ${{ steps.buildx.outputs.name }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| deploy: | |
| name: Deploy on EC2 (pull & up) | |
| needs: build_and_push | |
| runs-on: ubuntu-latest | |
| steps: | |
| # EC2에서 최신 이미지 pull → 컨테이너 재시작 → 불필요한 이미지/컨테이너 정리 | |
| - name: Pull new image & restart containers (Compose v2) | |
| uses: appleboy/ssh-action@v1.0.3 | |
| with: | |
| host: ${{ secrets.EC2_HOST }} | |
| username: ${{ secrets.EC2_USER }} | |
| key: ${{ secrets.EC2_SSH_KEY }} | |
| script: | | |
| set -e | |
| cd ~/gat_be | |
| echo "IMAGE=${{ needs.build_and_push.outputs.image_uri }}" > .env | |
| REGISTRY="$(aws sts get-caller-identity --query 'Account' --output text).dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com" | |
| aws ecr get-login-password --region ${{ env.AWS_REGION }} \ | |
| | docker login --username AWS --password-stdin "$REGISTRY" | |
| docker compose pull | |
| docker compose up -d | |
| docker image prune -af || true | |
| docker container prune -f || true |