Skip to content

[infra] 개발 / 운영 서버 분리 #182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
buzz0331 merged 2 commits into from
Aug 12, 2025
Merged

[infra] 개발 / 운영 서버 분리 #182

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e24f32d
[chore] cd workflow 분리 (#179)
buzz0331 Aug 9, 2025
898e787
[chore] 운영서버 cd에서 PROD yml파일 사용 (#179)
buzz0331 Aug 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions .github/workflows/cd-workflow-dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,10 +67,14 @@ jobs:
echo "🗂️ Change Directory to Compose Path"
cd ${{ env.COMPOSE_PATH }}

echo "✋🏻Stopping existing container and Cleaning up old images"
sudo docker-compose down --rmi all

Comment on lines +70 to +72

@coderabbitai coderabbitai Bot Aug 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

이미지 일괄 삭제(--rmi all)로 불필요한 풀/다운타임 증가 가능성

docker-compose down --rmi all는 서비스 이미지까지 전부 지워 매 배포 시 풀이 강제되어 느리고, 장애 시 롤백 여지도 줄어듭니다. dangling/미사용 이미지는 마지막 prune으로 충분합니다. --rmi all 제거를 권장합니다.

-            sudo docker-compose down --rmi all
+            sudo docker-compose down --remove-orphans
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
echo "✋🏻Stopping existing container and Cleaning up old images"
sudo docker-compose down --rmi all
echo "✋🏻Stopping existing container and Cleaning up old images"
sudo docker-compose down --remove-orphans
🧰 Tools
🪛 YAMLlint (1.37.1)

[error] 72-72: trailing spaces

(trailing-spaces)

🤖 Prompt for AI Agents 
In .github/workflows/cd-workflow-dev.yml around lines 70 to 72, remove the --rmi
all option from the docker-compose down command to avoid deleting all service
images during each deployment. This prevents unnecessary image pulls and
downtime, and preserves the ability to roll back in case of failure. Keep the
command as sudo docker-compose down without --rmi all, relying on a final prune
step to clean up dangling or unused images.

sudo docker ps -a

echo "🥳 Pulling new image"
sudo docker pull ${{ secrets.DOCKER_USERNAME }}/${{ secrets.DOCKER_IMAGE }}

echo "🚀 Run Blue-Green Deploy Script"
sudo bash deploy.sh

echo "🌱 Starting new container"
sudo docker-compose up -d
sudo docker image prune -f
76 changes: 76 additions & 0 deletions .github/workflows/cd-workflow-prod.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,76 @@
name: CD with Gradle and Docker

on:
push:
branches:
- 'main'

permissions:
contents: read

env:
RESOURCE_PATH: src/main/resources
COMPOSE_PATH: /home/ec2-user/compose
APP_PORT: 8000

jobs:
build:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4
- name: ☕️ set up JDK 17
uses: actions/setup-java@v3
with:
java-version: '17'
distribution: 'temurin'
server-id: github
Comment on lines +22 to +27

@coderabbitai coderabbitai Bot Aug 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

GitHub 공식 액션 버전 업데이트 권장 (actionlint 지적사항 반영)

actionlint가 actions/setup-java@v3, actions/cache@v3가 오래되었다고 지적합니다. v4로 올리는 것을 권장합니다. 또한 보안상 태그 고정 또는 커밋 SHA 핀ning이 좋습니다.

예시:

-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
@@
-        uses: actions/cache@v3
+        uses: actions/cache@v4

동일 변경을 dev 워크플로우에도 적용해주세요.

Also applies to: 36-44

🌐 Web query:

GitHub actions/setup-java 리포지토리의 최신 메이저 버전은 무엇인가요?

💡 Result:

GitHub Actions의 setup-java 액션의 최신 메이저 버전은 v4입니다. 이 버전은 Java 21을 지원하며, distribution 매개변수로 'temurin'을 사용하여 Eclipse Temurin 배포판을 설정할 수 있습니다. (github.com)

예를 들어, setup-java 액션을 사용하여 Java 21을 설정하려면 다음과 같이 워크플로우를 구성할 수 있습니다:

steps:
  - uses: actions/checkout@v4
  - name: Set up JDK 21
    uses: actions/setup-java@v4
    with:
      java-version: '21'
      distribution: 'temurin'

이렇게 설정하면 Java 21이 설치되고, 이후 단계에서 해당 버전을 사용할 수 있습니다.

Citations:

🌐 Web query:

GitHub actions/cache 리포지토리의 최신 메이저 버전은 무엇인가요?

💡 Result:

GitHub Actions의 actions/cache 리포지토리의 최신 메이저 버전은 v4입니다. 이 버전은 이전 버전들에 비해 성능 향상과 버그 수정이 포함되어 있습니다. 예를 들어, actions/cache@v4를 사용하면 캐시 복원 및 저장 속도가 개선되어 워크플로의 실행 시간을 단축할 수 있습니다. (docs.github.com)

actions/cache는 GitHub Actions 워크플로에서 종속성 및 빌드 아티팩트를 캐시하여 CI/CD 파이프라인의 효율성을 높이는 데 사용됩니다. 최신 버전으로 업그레이드하면 이러한 캐시 작업의 성능과 안정성이 향상됩니다.

Citations:

actions/setup-java·actions/cache를 v4로 업그레이드하고 태그 고정 적용하기

actionlint 지적사항에 따라 아래 파일들에서 @v3 → @v4로 메이저 버전을 올려주세요.
보안 강화를 위해 커밋 SHA(pinning) 또는 정확한 태그 고정을 함께 적용하는 것도 권장합니다.

확인 및 수정 위치:

  • .github/workflows/cd-workflow-prod.yml: 22–27, 36–44
  • .github/workflows/cd-workflow-dev.yml: 동일 범위

예시 diff:

-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4  # 또는 uses: actions/setup-java@<커밋 SHA>

@@

-        uses: actions/cache@v3
+        uses: actions/cache@v4       # 또는 uses: actions/cache@<커밋 SHA>

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 actionlint (1.7.7)

23-23: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🤖 Prompt for AI Agents 
In .github/workflows/cd-workflow-prod.yml at lines 22 to 27 and 36 to 44, update
the GitHub Actions usage from actions/setup-java@v3 to actions/setup-java@v4 and
apply version pinning by replacing the version tag with a specific commit SHA or
exact tag to enhance security. Do the same for actions/cache if used. This
involves changing the 'uses' field to reference the pinned version instead of
the floating v3 tag.

settings-path: ${{ github.workspace }}

- name: 🧾 Create application.yml from secret (base64)
run: |
mkdir -p ${{ env.RESOURCE_PATH }}
echo "${{ secrets.APPLICATION_YML_PROD }}" | base64 --decode > ${{ env.RESOURCE_PATH }}/application.yml
shell: bash

- name: 🐘 Cache Gradle dependencies
uses: actions/cache@v3
with:
path: |
~/.gradle/caches
~/.gradle/wrapper
key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
restore-keys: |
gradle-${{ runner.os }}-

- name: 👏🏻 grant execute permission for gradlew
run: chmod +x gradlew

- name: 🐘 build with Gradle (without test)
run: ./gradlew clean build -x test --stacktrace

- name: 🐳 Docker build & push
run: |
docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
docker build --build-arg PORT=${{env.APP_PORT}} -f Dockerfile -t ${{ secrets.DOCKER_USERNAME }}/${{ secrets.DOCKER_IMAGE }} .
docker push ${{ secrets.DOCKER_USERNAME }}/${{ secrets.DOCKER_IMAGE }}
Comment on lines +52 to +56

@coderabbitai coderabbitai Bot Aug 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

이미지 태그 불변성 확보(릴리즈 재현 가능성 및 혼선 방지)

현재 단일 태그(기본 latest)가 사용되어 dev/prod 간 경쟁 조건이나 롤백 어려움이 생길 수 있습니다. SHA를 포함한 불변 태그를 추가로 빌드/푸시하고, 배포에서도 해당 태그를 참조하세요.

예시:

-          docker build --build-arg PORT=${{env.APP_PORT}} -f Dockerfile -t ${{ secrets.DOCKER_USERNAME }}/${{ secrets.DOCKER_IMAGE }} .
-          docker push ${{ secrets.DOCKER_USERNAME }}/${{ secrets.DOCKER_IMAGE }}
+          IMAGE=${{ secrets.DOCKER_USERNAME }}/${{ secrets.DOCKER_IMAGE }}
+          TAG=${{ github.sha }}
+          docker build --build-arg PORT=${{env.APP_PORT}} -f Dockerfile \
+            -t $IMAGE:latest -t $IMAGE:$TAG .
+          docker push $IMAGE:latest
+          docker push $IMAGE:$TAG

배포 스크립트(deploy.sh)에서도 $TAG를 사용하도록 조정 필요 시 말씀 주세요. 수정안 드리겠습니다.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: 🐳 Docker build & push
run: |
docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
docker build --build-arg PORT=${{env.APP_PORT}} -f Dockerfile -t ${{ secrets.DOCKER_USERNAME }}/${{ secrets.DOCKER_IMAGE }} .
docker push ${{ secrets.DOCKER_USERNAME }}/${{ secrets.DOCKER_IMAGE }}
- name: 🐳 Docker build & push
run: |
docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
IMAGE=${{ secrets.DOCKER_USERNAME }}/${{ secrets.DOCKER_IMAGE }}
TAG=${{ github.sha }}
docker build --build-arg PORT=${{env.APP_PORT}} -f Dockerfile \
-t $IMAGE:latest -t $IMAGE:$TAG .
docker push $IMAGE:latest
docker push $IMAGE:$TAG
🤖 Prompt for AI Agents 
In .github/workflows/cd-workflow-prod.yml around lines 52 to 56, the Docker
image is currently built and pushed with a single mutable tag, which can cause
issues with release reproducibility and deployment confusion. Modify the
workflow to build and push the Docker image with an immutable tag that includes
the commit SHA (e.g., using the GitHub SHA environment variable) alongside the
existing tag. Update the docker build and push commands to use this SHA-based
tag, and ensure the deployment scripts reference this immutable tag for
consistent releases.


- name: 🚀 deploy to server
uses: appleboy/ssh-action@master
with:
host: ${{ secrets.EC2_HOST }}
username: ${{ secrets.EC2_USERNAME }}
key: ${{ secrets.EC2_KEY }}
port: ${{ secrets.EC2_PORT }}
envs: GITHUB_SHA
script: |
Comment on lines +58 to +66

@coderabbitai coderabbitai Bot Aug 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

서드파티 액션 버전 고정 필요(@master 사용 지양)

appleboy/ssh-action@master는 가변 참조입니다. 안정성/공급망 보안상 릴리즈 태그나 커밋 SHA로 고정하세요.

최신 안정 버전 확인:

확인 후 예시:

-        uses: appleboy/ssh-action@master
+        uses: appleboy/ssh-action@<verified-latest-tag>

🌐 Web query:

appleboy/ssh-action의 최신 안정 릴리스 태그는 무엇인가?

💡 Result:

appleboy/ssh-action의 최신 안정 릴리스(Stable Release) 태그는 v1.2.2입니다[1][4].

  • GitHub 공식 Releases 페이지에서 v1.2.2(2024년 3월 9일 릴리스)가 "Latest"로 표시되어 있습니다[1].
  • 여러 최신 사용 사례와 문서, 커뮤니티 질의응답에서도 모두 최신 버전으로 v1.2.2를 안내하고 있습니다[4].

따라서 워크플로우에서 안정 버전을 사용하시려면 아래와 같이 명시하면 됩니다.

uses: appleboy/ssh-action@v1.2.2

추가 참고

  • 이전에는 master나 v1 태그를 사용하는 예시가 있었으나, 실제 최신 안정 릴리스 기준은 v1.2.2입니다[1][4].

Citations:

서드파티 액션 버전 고정: appleboy/ssh-action@v1.2.2 사용
안정성 및 공급망 보안을 위해 가변 참조(@master) 대신 최신 안정 릴리스 태그로 고정하세요.

  • 파일: .github/workflows/cd-workflow-prod.yml
  • 라인: 58–66
-        uses: appleboy/ssh-action@master
+        uses: appleboy/ssh-action@v1.2.2
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: 🚀 deploy to server
uses: appleboy/ssh-action@master
with:
host: ${{ secrets.EC2_HOST }}
username: ${{ secrets.EC2_USERNAME }}
key: ${{ secrets.EC2_KEY }}
port: ${{ secrets.EC2_PORT }}
envs: GITHUB_SHA
script: |
- name: 🚀 deploy to server
uses: appleboy/ssh-action@v1.2.2
with:
host: ${{ secrets.EC2_HOST }}
username: ${{ secrets.EC2_USERNAME }}
key: ${{ secrets.EC2_KEY }}
port: ${{ secrets.EC2_PORT }}
envs: GITHUB_SHA
script: |
🤖 Prompt for AI Agents 
In .github/workflows/cd-workflow-prod.yml around lines 58 to 66, the GitHub
Action uses a floating tag @master for appleboy/ssh-action, which can cause
instability and supply chain risks. Replace the version reference from @master
to the fixed stable release tag @v1.2.2 to ensure consistent and secure
deployments.

echo "🗂️ Change Directory to Compose Path"
cd ${{ env.COMPOSE_PATH }}

sudo docker ps -a

echo "🥳 Pulling new image"
sudo docker pull ${{ secrets.DOCKER_USERNAME }}/${{ secrets.DOCKER_IMAGE }}

echo "🚀 Run Blue-Green Deploy Script"
sudo bash deploy.sh