dev-deploy.yml

name: DEV Deploy

on:                                    # ① 트리거 조건 : develop에 push
  push:
    branches: [develop]

env:                                   # ② 워크플로 전역 환경변수
  APP_HOST: 10.0.2.177                 # 개발용 App EC2 Private IP
  NGINX_HOST: 10.0.1.18                # 공통 Nginx EC2 Private IP
  TZ: Asia/Seoul                       # Runner 로그 타임존

jobs:
  deploy:
    runs-on: ubuntu-latest             # GitHub Hosted Runner

    steps:
      - uses: actions/checkout@v4      # ③ 레포지토리 코드 체크아웃

      - uses: actions/setup-java@v4    # ④ JDK 설치 + Gradle 캐시
        with:
          distribution: temurin
          java-version: 17
          cache: gradle

      - name: Build JAR   # ⑤ 컴파일
        run: |
          chmod +x ./gradlew && ./gradlew clean build -x test

      - name: 🗂️ Prepare target directory on Nginx EC2
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ env.NGINX_HOST }}
          username: ubuntu
          key: ${{ secrets.SSH_KEY }}
          proxy_host: ${{ secrets.BASTION_IP }}
          proxy_username: ubuntu
          proxy_key: ${{ secrets.SSH_KEY }}
          script_stop: true
          script: |
            set -e
            sudo mkdir -p /home/ubuntu/nginx
            sudo chown -R ubuntu:ubuntu /home/ubuntu/nginx
            grep -E '^Subsystem' /etc/ssh/sshd_config || true
            ls -al /home/ubuntu/nginx

      - name: 📦 Copy NGINX bundle to Nginx EC2
        uses: appleboy/scp-action@v0.1.6
        with:
          host: ${{ env.NGINX_HOST }}
          proxy_host: ${{ secrets.BASTION_IP }}
          proxy_username: ubuntu
          proxy_key: ${{ secrets.SSH_KEY }}
          username: ubuntu
          key: ${{ secrets.SSH_KEY }}
          source: "nginx/*"
          target: "/home/ubuntu/nginx/"
          strip_components: 1
          debug: true

      - name: 🧾 List files on Nginx EC2
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ env.NGINX_HOST }}
          username: ubuntu
          key: ${{ secrets.SSH_KEY }}
          proxy_host: ${{ secrets.BASTION_IP }}
          proxy_username: ubuntu
          proxy_key: ${{ secrets.SSH_KEY }}
          script_stop: true
          script: |
            set -e
            ls -al /home/ubuntu
            echo "----"
            ls -al /home/ubuntu/nginx

      - name: 🔧 Ensure Nginx container is up (DEV)
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ env.NGINX_HOST }}
          username: ubuntu
          key: ${{ secrets.SSH_KEY }}
          proxy_host: ${{ secrets.BASTION_IP }}
          proxy_username: ubuntu
          proxy_key: ${{ secrets.SSH_KEY }}
          script_stop: true
          script: |
            set -e
            cd ~/nginx
            sudo systemctl start docker
            sudo systemctl enable docker >/dev/null 2>&1 || true
            sudo docker compose -p hilingual up -d --remove-orphans nginx
            
      

      - name: 📦 Copy JAR to Target
        uses: appleboy/scp-action@v0.1.6
        with:
          host:        ${{ env.APP_HOST }}
          proxy_host:  ${{ secrets.BASTION_IP }}
          proxy_username: ubuntu
          proxy_key: ${{ secrets.SSH_KEY }}
          username:    ubuntu
          key:         ${{ secrets.SSH_KEY }}
          source:      "build/libs/*.jar"
          target:      "/home/ubuntu/artifacts/"
          strip_components: 2

      - name: 🔑 Prepare upstream-switch key on App EC2
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ env.APP_HOST }}
          username: ubuntu
          key: ${{ secrets.SSH_KEY }}
          proxy_host: ${{ secrets.BASTION_IP }}
          proxy_username: ubuntu
          proxy_key: ${{ secrets.SSH_KEY }}
          script_stop: true
          script: |
            set -e
            mkdir -p ~/.ssh
            chmod 700 ~/.ssh

            # 프라이빗 키 저장
            cat > ~/.ssh/hilingual_actions <<'EOF'
            ${{ secrets.SSH_KEY }}
            EOF
            
            # 🔧 잡음 제거 (Drone 등에서 섞여든 행, BOM 등)
            LC_ALL=C sed -i -e '1s/^\xEF\xBB\xBF//' -e '/^DRONE_/d' ~/.ssh/hilingual_actions
            
            # 🔒 BEGIN~END 블록만 남기고 나머지 잡음 제거 (재발 방지 핵심)
            awk 'f||/-----BEGIN .* PRIVATE KEY-----/{f=1;print} /-----END .* PRIVATE KEY-----/{exit}' \
              ~/.ssh/hilingual_actions > ~/.ssh/hilingual_actions.clean && mv ~/.ssh/hilingual_actions.clean ~/.ssh/hilingual_actions

            # 윈도우 개행 제거 + 권한
            sed -i 's/\r$//' ~/.ssh/hilingual_actions
            chmod 600 ~/.ssh/hilingual_actions

            # 키 유효성 검사 (깨진 키면 즉시 실패 지점 명확화)
            ssh-keygen -y -f ~/.ssh/hilingual_actions >/dev/null || { echo "Invalid SSH private key in secrets.SSH_KEY"; exit 1; }

            # bastion에서 Nginx로 넘어갈 때 호스트 키 확인 프롬프트 방지
            ssh-keyscan -H ${{ env.NGINX_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
      

      - name: 🔐 Deploy via Bastion(DEV)    # ⑥ Bastion 경유 SSH 배포
        uses: appleboy/ssh-action@v1.0.3
        env:
          APP_HOST:   ${{ env.APP_HOST }}        # deploy.sh 에 전달될 변수
          NGINX_HOST: ${{ env.NGINX_HOST }}
          UPSTREAM_ENV: dev
        with:
          host:          ${{ env.APP_HOST }}  #  dev App EC2
          username:      ubuntu
          key:           ${{ secrets.SSH_KEY }}     # Repo Secret
          proxy_host:    ${{ secrets.BASTION_IP }}  # (Jump Host = 동일)
          proxy_username: ubuntu
          proxy_key:     ${{ secrets.SSH_KEY }}
          script_stop:   true                       # 서버 오류 시 Job Fail.
          envs: APP_HOST,NGINX_HOST,UPSTREAM_ENV
          script: |
            set -e
            mkdir -p /home/ubuntu/artifacts
            cd ~/project
            if [ ! -d .git ]; then
              git init
              git remote add origin https://github.com/${{ github.repository }}
            fi
            git fetch --depth 1 origin
            git reset --hard ${{ github.sha }}
            
            mkdir -p build/libs
            mv /home/ubuntu/artifacts/*.jar build/libs/
            
            chmod +x deploy.sh
            UPSTREAM_ENV=${UPSTREAM_ENV} APP_HOST=${APP_HOST} NGINX_HOST=${NGINX_HOST} ./deploy.sh

      - name: 📢 Discord notify
        if: always()
        uses: sarisia/actions-status-discord@v1
        with:
          webhook:      ${{ secrets.DISCORD_WEBHOOK }}
          title:        "${{ github.workflow }} – ${{ job.status }}"
          description:  "**Ref**: ${{ github.ref_name }}\n**SHA**: ${{ github.sha }}"
          color:        ${{ job.status == 'success' && '0x57F287' || '0xED4245' }}