(#102) 운동기록 리스트 캘린더 페이지 달력 아래로 이동 #168
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD | |
| on: | |
| push: | |
| paths: | |
| - '**' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| env: | |
| LONG_CACHE: '--cache-control public,max-age=31536000,immutable' | |
| SHORT_CACHE: '--cache-control public,max-age=0,no-cache,must-revalidate' | |
| S3_SYNC_OPTS: '--delete' | |
| CSP_NONCE: '' | |
| jobs: | |
| client-CI-CD: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Branch | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: 'npm' | |
| cache-dependency-path: package-lock.json | |
| - name: Generate build-time nonce | |
| id: nonce | |
| run: | | |
| NONCE=$(openssl rand -base64 16 | tr -d '=+/') | |
| echo "CSP_NONCE=$NONCE" >> $GITHUB_ENV | |
| - name: Create .env | |
| run: | | |
| echo "ref = $GITHUB_REF" | |
| if [ "$GITHUB_REF" = "refs/heads/main" ]; then | |
| echo "${{ secrets.MAIN_ENV }}" > .env | |
| echo "NEXT_PUBLIC_CSP_NONCE=${{ env.CSP_NONCE }}" >> .env | |
| else | |
| echo "${{ secrets.DEV_ENV }}" > .env | |
| echo "NEXT_PUBLIC_CSP_NONCE=${{ env.CSP_NONCE }}" >> .env | |
| fi | |
| - name: Build and Export | |
| env: | |
| NEXT_PUBLIC_CSP_NONCE: ${{ env.CSP_NONCE }} | |
| run: | | |
| npm install | |
| npm run build | |
| - name: Set deploy env vars | |
| id: setenv | |
| run: | | |
| if [[ "${GITHUB_REF}" == "refs/heads/main" ]]; then | |
| echo "TARGET=main" >> "$GITHUB_OUTPUT" | |
| echo "POLICY_ID=${{ secrets.CF_RH_POLICY_MAIN_ID }}" >> "$GITHUB_ENV" | |
| elif [[ "${GITHUB_REF}" == "refs/heads/develop" ]]; then | |
| echo "TARGET=dev" >> "$GITHUB_OUTPUT" | |
| echo "POLICY_ID=${{ secrets.CF_RH_POLICY_DEV_ID }}" >> "$GITHUB_ENV" | |
| else | |
| echo "TARGET=none" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Configure AWS credentials | |
| if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop' }} | |
| uses: aws-actions/configure-aws-credentials@v3 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: ${{ secrets.AWS_REGION }} | |
| - name: Upload assets to S3 (MAIN) | |
| if: ${{ github.ref == 'refs/heads/main' }} | |
| run: | | |
| BUCKET=${{ secrets.AWS_S3_CLIENT_MAIN_BUCKET_NAME }} | |
| aws s3 sync ./out s3://$BUCKET \ | |
| --exclude "*.html" --exclude "legal/*" $LONG_CACHE $S3_SYNC_OPTS | |
| aws s3 sync ./out s3://$BUCKET \ | |
| --exclude "*" --include "*.html" --exclude "legal/*" $SHORT_CACHE $S3_SYNC_OPTS | |
| - name: Upload assets to S3 (DEV) | |
| if: ${{ github.ref == 'refs/heads/develop' }} | |
| run: | | |
| BUCKET=${{ secrets.AWS_S3_CLIENT_DEV_BUCKET_NAME }} | |
| aws s3 sync ./out s3://$BUCKET \ | |
| --exclude "*.html" --exclude "legal/*" $LONG_CACHE $S3_SYNC_OPTS | |
| aws s3 sync ./out s3://$BUCKET \ | |
| --exclude "*" --include "*.html" --exclude "legal/*" $SHORT_CACHE $S3_SYNC_OPTS | |
| - name: Update CloudFront CSP header | |
| if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop' }} | |
| env: | |
| POLICY_ID: ${{ env.POLICY_ID }} | |
| NONCE: ${{ env.CSP_NONCE }} | |
| run: | | |
| sleep 5 | |
| aws cloudfront get-response-headers-policy-config --id "$POLICY_ID" > old.json | |
| ETag=$(jq -r '.ETag' old.json) | |
| jq --arg nonce "nonce-${NONCE}" ' | |
| .ResponseHeadersPolicyConfig | |
| .SecurityHeadersConfig | |
| .ContentSecurityPolicy | |
| .ContentSecurityPolicy |= sub("nonce-[A-Za-z0-9_-]+"; $nonce) | |
| | .ResponseHeadersPolicyConfig | |
| ' old.json > new.json | |
| aws cloudfront update-response-headers-policy \ | |
| --id "$POLICY_ID" \ | |
| --if-match "$ETag" \ | |
| --response-headers-policy-config file://new.json |